Attacks on 100+ US Water Systems Spur CISA Exposure Guidance
NEOSEC enrichment — no mirror of the original source
Citing cyberattacks that targeted over 100 internet-exposed US water and wastewater systems (WWS) in July 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) has published guidance urging organizations to proactively reduce
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Bischoping, Dukes, Honan, Murray, Neely, Sachs, Skoudis.
More on Exposure
Other advisories
- Not ratedosv:CLEANSTART-2026-DP56505Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA
- Not ratedosv:CVE-2026-92086MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
- Not ratedosv:CVE-2026-91153Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
- MediumCVE-2026-90865Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4
- Not ratedosv:CVE-2026-61542Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools
- Not ratedosv:CVE-2026-118647n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
- Not ratedosv:CVE-2026-118643n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
- Not ratedosv:CVE-2026-118272a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
Other news entries
- Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical RiskNewsDark Reading
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
- State Bank of India confirms customer data exposed on the dark webBreachpwn.watch
- Joshin network intrusion may have leaked up to 6 million member recordsBreachpwn.watch
- The Blind Spots of Agentic Pentesting and How to Close ThemNewsBleepingComputer
- Criminal IP Introduces AITEM as the Next Evolution of Attack Surface ManagementNewsBleepingComputer
- Dell patches 18 critical flaws that could hand attackers the keys to storage and KubernetesNewsCSO Online
- IQVIA fined $7.8 million for failing to properly anonymize health dataNewsBleepingComputer
ID