The US government issued an updated advisory warning that Iranian hackers are actively disrupting critical infrastructure systems used by American water and energy providers.
The advisory details ongoing exploitation attempts by Iran-linked threat actors targeting operational technology systems at utilities nationwide. The hackers are leveraging vulnerabilities in software and hardware commonly deployed across the water and energy sectors.
US authorities did not specify the scope of disruptions or name affected providers. The warning urges facility operators to implement immediate security measures, including network segmentation, access controls, and monitoring for suspicious activity.
This marks an escalation in cyber threats against US critical infrastructure. Previous Iranian cyber operations have targeted financial institutions and government agencies. Water and energy systems are classified as critical infrastructure essential to national security.
The advisory recommends utilities prioritize patching known vulnerabilities, disable unnecessary network access, and report any suspected breaches to federal authorities. The Cybersecurity and Infrastructure Security Agency (CISA) is coordinating the government response.
Apple has published SOC 3 audit reports for its Private Cloud Compute infrastructure, providing third-party verification of security controls for on-device AI processing that routes some tasks to Apple servers.
A developer discovered their coding interview assignment included hidden malware designed to execute via Git hooks. The sophisticated setup raised questions about interview practices and candidate vetting.
Engineers designing passkeys overlooked critical usability issues that confuse average users, according to criticism gaining traction in tech communities. The passwordless authentication standard is struggling with consumer adoption due to poor design decisions.
Upbound Group disclosed that hackers exploited stolen data to create $13 million in fraudulent Acima leases. The fintech company's security breach gave threat actors access to customer information used to establish fake lease accounts.