Sources familiar with the investigation told CBS News on August 6 that cyberattacks on US water systems suspected to be linked to Iranian-backed hackers have been confirmed in at least 12 states, including Michigan, Minnesota, Georgia, New Jersey, and South Dakota. The incidents began on July 26 and 27 with the coordinated disruption of more than 30 community water systems across Minnesota, covered in Issue 97. The scope expanded steadily through the following week. The FBI and EPA issued a joint public service announcement on July 30 warning water and wastewater utilities in at least seven states had reported incidents with some malicious activity degrading operations. By August 4, reporting expanded that count to 12 states. In Georgia, the Clayton County Water Authority, which serves approximately 300,000 customers in the Atlanta metropolitan area, said cyber activity caused a water pressure drop during late July and forced the agency to issue a boil water advisory. Service was restored within hours. In Minnesota, investigators from the FBI, CISA, and the EPA have conducted on-site assessments at affected utilities. Federal officials have declined to publicly attribute the campaign, though multiple sources across outlets have named Iranian-affiliated actors as the most likely responsible party. The Wikipedia article on the Minnesota incident, citing reporting from The New Republic, notes investigators described Iranian hackers as probably responsible while stressing that assessments could change. The CyberAv3ngers group, associated with Iran's Islamic Revolutionary Guard Corps and previously documented by CISA for targeting internet-facing programmable logic controllers at US water facilities, is the actor class consistent with the techniques observed. No drinking water safety issues have been confirmed beyond the temporary Georgia boil water advisory.

Dimitrios Valsamaras of Microsoft and Ken Gannon of Mobile Hacking Lab presented a complete exploit chain against Samsung Galaxy devices at Black Hat USA 2026 this week, nearly ten months after they first used it to win $50,000 at the Pwn2Own Ireland competition in October 2025. The chain begins with a malicious link sent to the victim through any messaging channel. When the victim clicks the link, a vulnerability in Samsung Members, an official preloaded support and diagnostics application, forces the app to connect to an attacker-controlled website. That connection is used to exploit a second vulnerability in Samsung Members and a third in Samsung Account to establish a foothold with progressively greater access. The researchers then used Bixby, Samsung's virtual assistant, as a pivot point in the chain, leveraging its integration with device functions to escalate control. The final result is full device access with no special permissions required on either the attacker or victim side beyond the victim clicking a single link. The Samsung Members application is preloaded on Galaxy devices and cannot be uninstalled by users. Samsung addressed the underlying vulnerabilities in its August 2026 security update, which covers 38 security improvements including 8 rated critical. The full technical details of the exploit chain were disclosed publicly at Black Hat this week following the coordinated disclosure process. The vulnerabilities span CVE-2025-21079 and related identifiers in the Samsung Members and Samsung Account components.

Security researchers Lidor Ben Shitrit and Assaf Levkovich presented findings at Black Hat 2026 covering 12 vulnerabilities across four enterprise Java platforms, with two yielding complete pre-authentication remote code execution chains. The first affects Bonita BPM, a widely deployed open-source business process management platform used for workflow automation in enterprises. The second affects Apache OFBiz, an open-source enterprise resource planning system used for order management, inventory, accounting, and related functions. In both cases, the attack chains combine individually low-severity findings into unauthenticated compromise. The component flaws include differences in how servlet containers and application layers parse URLs, leading to authentication bypass when an application checks permissions against one representation of a path while serving content from a different one; hardcoded cryptographic keys used for session or token signing that allow an attacker to forge valid authentication artifacts; and incomplete protections on servlet filters that leave certain request paths reachable without proper authorization checks. No single flaw in either chain would rate as critical by itself. The researchers noted that each component looks like a minor implementation oversight in isolation. Chained, the combination reaches unauthenticated code execution on the server. Fixes were developed through coordinated disclosure processes with the respective project teams ahead of the Black Hat presentation.