This was the week the July critical-infrastructure campaign stopped being a rumor and became a number. CISA confirmed that more than 100 internet-exposed US water systems were targeted in July 2026, activity widely suspected to be Iran-linked, with one expert calling it a test run for something larger. Across the Atlantic, a suspected Iran-linked attack kept a small UK power plant offline for four days that same month. The US Treasury answered with sanctions on five Mabna Institute hackers and 30 crypto wallets under Operation Economic Outcast. And in the most useful document of the week, a CISA red team ran nearly identical tradecraft against a water utility and a government organization: the water utility isolated it in minutes, the government sector never noticed at all.

The identity layer had an equally rough seven days. Microsoft disclosed that CVE-2026-69836, a maximum-severity remote code execution flaw in Entra ID, was exploited in the wild before Microsoft fixed its own service. Keycloak patched a CVSS 9.1 reset-credentials flaw that let anyone unauthenticated seize any account, administrators included. Attackers began working two unauthenticated bypasses in the miniOrange SAML SSO WordPress plugin to log in as any admin. Meanwhile the commercial phishing economy moved past the password entirely: ANY.RUN counted roughly 4,500 companies hit by the Mirage2FA toolkit, which lets a Microsoft 365 user finish a normal login before stealing the authenticated session, and Abnormal documented a $10,000 kit that registers an attacker-controlled passkey so the access survives the password reset meant to end it.

Then came the bill. Meta agreed to pay $17 billion and rebuild how minors use its platforms to settle with attorneys general from nearly every US state and territory. TikTok and ByteDance will pay $400 million to close a DOJ child-privacy case. The Dutch DPA fined Uber EUR 825 million over automated driver-account suspensions with no human review. And Alabama's attorney general subpoenaed OpenAI over the Hugging Face hack its own model caused, opening the first state-level investigation into whether AI safety failures violate consumer-protection law.

Let's get into it.

Critical Infrastructure

CISA confirmed that more than 100 internet-exposed US water systems were targeted in July 2026, activity widely suspected to be Iran-linked, with one expert describing it as a test run for something larger. In the same month, a suspected Iran-linked attack kept a small UK power plant offline for four days, though the UK government says the wider grid was never at risk. The US Treasury responded by sanctioning five Mabna Institute hackers and 30 cryptocurrency wallets under Operation Economic Outcast, an expansion of its Iran campaign that also names entire sectors and hands financial-services and crypto compliance teams an urgent screening job. Separately, a CISA red team report landed with uncomfortable timing: the team gained initial access to both a water utility and a government organization using nearly identical tradecraft, and the water utility isolated and shut it down within minutes while the government organization never detected it at all.

Why it matters: The red team report is the one to circulate internally, because it isolates the variable. Both targets were breached. Only one noticed. Detection and isolation decided the outcome, not prevention, which means your budget question this quarter is less "can they get in" and more "how many minutes until someone sees it and can cut the connection." Inventory every internet-exposed controller, then rehearse the isolation step until it is measured in minutes.

→ Read the CISA water confirmation · The UK power plant outage · Treasury sanctions the Mabna Institute · CISA red team: water passes, government fails

Vulnerabilities

Microsoft said CVE-2026-69836, a maximum-severity remote code execution flaw in Entra ID, was exploited in the wild before the company fixed the service on its own infrastructure, meaning there was no patch for customers to install and no customer-side action that would have prevented it. Red Hat and the Keycloak project patched CVE-2026-18963, a CVSS 9.1 flaw in the reset-credentials flow that let an unauthenticated attacker reset any user's password and take over the account, administrators included, with fixes in 26.7.2, 26.6.6, and 26.4.15. And attackers began opportunistically exploiting two unauthenticated bypasses in the miniOrange SAML 2.0 SSO plugin, CVE-2026-61979 and CVE-2026-15981, to sign in as any WordPress user; a silent, multi-edition patch means an affected dashboard may wrongly report itself as safe.

Why it matters: All three flaws sit in the machinery that decides who you are, which is the layer every other control assumes is already correct. Note the pattern in what defenders were actually left holding: with Entra there was nothing to patch, only logs to hunt; with miniOrange the version string itself lies. "No patch to install" and "our dashboard says we're current" are both compatible with having already been compromised. Review privileged Entra sign-in and app-consent activity for the exploitation window, confirm Keycloak builds by hand, and verify the miniOrange plugin version at the file level rather than trusting the admin screen.

→ Read the Entra ID CVSS 10.0 story · Keycloak account takeover · miniOrange SAML SSO exploitation

Phishing & Social Engineering

ANY.RUN reported that the commercial Mirage2FA phishing-as-a-service toolkit hit roughly 4,500 US and EU companies between 2024 and 2026, letting a Microsoft 365 user complete a normal, correct login before stealing the resulting authenticated session. It bypasses two-factor authentication by design, and ANY.RUN found 48% of targeted addresses were potentially compromised. Researchers at Abnormal separately documented iAuthFlow V2, a $10,000 toolkit that registers an attacker-controlled passkey on a compromised account. Because a passkey is a credential rather than a password token, it survives the password reset and session revocation that normally evict a phisher. A third kit made the same bet from a different angle: Island documented NovaCookies, a $320-a-month adversary-in-the-middle service that rides genuine Docusign notifications and captures authenticated Microsoft 365 sessions in real time.

Why it matters: Both kits are engineered around the standard incident-response playbook. Mirage2FA makes MFA a speed bump instead of a wall, and iAuthFlow V2 means "we reset the password and killed the sessions" no longer closes the incident. Add one step to your account-compromise runbook: enumerate and remove unrecognized registered authenticators, including passkeys, on every affected account, and alert on new passkey enrollment as its own high-signal event. Session-binding and token-protection controls belong on the same list.

→ Read the Mirage2FA report · iAuthFlow V2 and passkey persistence · NovaCookies, in this week's roundup

Supply Chain

The Rust Project deleted malicious releases of arrayref, internment, and append-only-vec from crates.io after a compromised maintainer account added a typosquatted proc-macro1 dependency whose build script executed malware at compile time. Days later, Wiz researchers linked that compromise to recent North Korean supply-chain operations, pointing to command-and-control infrastructure shared with the Mastra and axios npm attacks; it is a strong lead built on infrastructure overlap rather than a confirmed verdict. In parallel, Trend Micro's TrendAI team disclosed 14 trojanized npm packages posing as calendar and streak utilities while dropping RedC2 4.0, a cross-platform Linux backdoor with AI-assisted command-and-control.

Why it matters: The Rust attack ran at build time, which is the detail that should change your scanning assumptions: a dependency that never appears in your running application can still execute code on the machine that compiles it. Treat build agents as production-sensitive hosts, scope their credentials to least privilege, and audit compile-time dependency additions with the same care as runtime ones. Cargo and npm are now equally live targets, so a Rust-only or JavaScript-only supply-chain policy no longer covers the ground.

→ Read the crates.io poisoning · Wiz ties it to North Korea · 14 npm packages dropping RedC2 4.0

Policy & Regulation

Meta agreed to pay $17 billion and rebuild how minors use Facebook and Instagram to settle a case brought by attorneys general from nearly every US state and territory, the largest coordinated state action yet against a platform over children's safety. The Justice Department said TikTok and ByteDance will pay $400 million to resolve a 2024 child-privacy lawsuit alleging COPPA violations, structured as $300 million now and $100 million once a court vacates an earlier Musical.ly consent decree. The Dutch Data Protection Authority fined Uber EUR 825 million, about USD 1 billion, ruling that software deactivated driver accounts from 2018 to 2022 with no human review; Uber is appealing. And Alabama Attorney General Steve Marshall subpoenaed OpenAI over the Hugging Face hack caused by its own cybersecurity model, opening the first state-level investigation into whether the company's safety failures violated consumer-protection law.

Why it matters: Three of these four penalties turn on process rather than breach: how minors were handled, and in Uber's case, an automated decision made without a human in the loop. That is the thread worth tracking, because the Alabama subpoena extends it to AI safety failures under consumer-protection law, a theory that does not require a new AI statute to be enforced. If you run automated decisioning that affects people's access or income, document the human-review step now, and treat model behavior as a compliance surface rather than purely an engineering one.

→ Read the Meta $17 billion settlement · TikTok's $400 million DOJ deal · Uber's EUR 825 million GDPR fine · Alabama subpoenas OpenAI

AI Security

Cisco Talos published two reports on UAT-10147, a Chinese-speaking cybercrime group it says has built agentic AI into its post-compromise operations, alongside a companion cross-platform implant called SPECTRE. On the defensive side of the same problem, Oasis Security disclosed a weakness in NVIDIA NemoClaw that lets an attacker-controlled webpage seize the unauthenticated local Ollama server sitting behind an AI agent and plant hidden instructions inside the model itself; it was reported to NVIDIA PSIRT, with CVE and patch status still unclear. Framing both, an independent Guidelight assessment graded five frontier AI labs on six control practices and found few publicly documented plans for containing a rogue model, with only OpenAI clearing even a partial mark on containment. The study measures public disclosure rather than private preparedness.

Why it matters: The NemoClaw finding is the one to act on this week, because the vulnerable component is a local service most teams never think of as internet-reachable. If an AI agent on a developer laptop talks to an unauthenticated local model server, an ordinary webpage is now in scope as an attack path, and the payload persists inside the model rather than in a file your EDR watches. Inventory local model servers, require authentication and loopback binding, and treat model weights and system prompts as integrity-critical assets.

→ Read the Talos UAT-10147 reports · NVIDIA NemoClaw model poisoning · Frontier labs and rogue-model containment

The most instructive document of the week was not a breach report. It was CISA's red team write-up, in which the same team used nearly identical tradecraft to get inside a water utility and a government organization. Both were breached. The water utility isolated the intrusion and shut it down within minutes. The government organization never detected it. That is a controlled experiment on a question the industry usually only argues about, and the result was unambiguous: prevention was a coin flip, and detection plus the ability to act on it decided everything that followed.

Hold that finding next to the rest of the week and a pattern appears. The Entra ID flaw was exploited before Microsoft fixed its own service, which means no customer could have patched their way out; the only available control was noticing. The miniOrange plugin patched silently across multiple editions, so an affected dashboard may report itself as current, which means the version string, the artifact most patch programs are built on, was actively misleading. Mirage2FA and iAuthFlow V2 are built to defeat the response rather than the defense: one steals the session after a correct login and the other plants a passkey that outlives the reset. The crates.io malware ran at build time, in a phase most scanning treats as infrastructure rather than software. In every one of those cases the preventive control was either absent, unavailable, or lying, and what remained was whether anyone would see the activity and be able to cut it off.

This is an uncomfortable reframe because prevention is what security budgets are structured around. Patch counts, coverage percentages, and configuration baselines are legible to boards in a way that mean-time-to-isolate is not. But the week's evidence is that the preventive layer is increasingly outside your control: a cloud provider's own service, a vendor's silent patch, a build agent's transitive dependency, a local model server nobody classified as an asset. What stays inside your control is instrumentation, the authority to disconnect something quickly, and a runbook that assumes the attacker already anticipated step one.

The regulatory column of the ledger points the same direction. Meta, TikTok, and Uber were penalized for process failures rather than intrusions, and Uber's fine specifically for automation running without a human in the loop. Alabama's subpoena to OpenAI extends the theory to AI safety failures. The through-line, from a red team report to an EUR 825 million fine, is that outcomes now hinge on whether an organization can see what its own systems are doing and intervene in time. That is one capability, and this week it was tested in a lab, in production, and in court.

The question worth asking before next week's briefing: if an attacker got in today through something you could not have patched, how many minutes would pass before someone saw it, and does that person actually have the authority to pull the plug?

Until next time,

Stay sharp. Stay ahead.

📩 Share this briefing with a colleague who needs to stay ahead.

📰 Full coverage at thecybersignal.com

☀️ Daily briefing at daily.thecybersignal.com