All Articles

TL;DR for CISOs: Critical infrastructure led the weekend. New Jersey and Alabama became the latest states to confirm that their water and wastewater facilities were targeted in a campaign, reported as linked to Iran, that has now touched at least a dozen US states and focused on internet-exposed control systems. Alongside it, a JetBrains TeamCity remote code execution flaw sits in the CISA Known Exploited Vulnerabilities catalog with a public proof of concept in circulation, Levi Strauss disclosed that attackers used social engineering to steal corporate data from employee machines, and the person behind the 2024 Snowflake customer-account breaches pleaded guilty in a US court. The connective thread is exposure at the edges of the enterprise: control systems, build pipelines, and the people who hold access.

Water utility cyberattacks spread to at least a dozen states as New Jersey and Alabama confirm

What happened

Water systems are an unusually exposed corner of critical infrastructure. Many are run by small municipal operators with limited security staff, and the control equipment they depend on was often connected to the internet for convenience rather than designed to sit there safely. This campaign has taken advantage of exactly that gap, reaching programmable logic controllers directly rather than breaking through layers of enterprise defense first. The steady drumbeat of new states confirming involvement, from Minnesota through to New Jersey and Alabama, points to broad opportunistic scanning for reachable devices rather than a handful of hand-picked targets.

The reassuring part is that the disclosed cases describe limited operational effect, with phone systems disrupted in one instance and control systems touched without interrupting water service in another. The uncomfortable part is what the pattern signals. A capability that can reach a PLC at a water plant can reach one at a manufacturing line, an energy site, or a building management system, and the same weakness, an internet-facing controller with weak or absent authentication, applies everywhere. The Iran attribution should be read as reported rather than settled, but the exposure it exploits is real regardless of who is behind it.

Evidence

Two independent sources:

• SecurityWeek: New Jersey, Alabama Join States Targeted in Water Cyberattacks
• ABC News: 2 New Jersey municipal water systems targeted in cyberattacks

What this means for your team

If you own or influence operational technology, treat internet reachability as the first question, not the last. Build a current inventory of every controller, HMI, and remote-access path that can be seen from outside your network, and take the exposed ones off the public internet or put them behind enforced authentication and a monitored gateway. Confirm that your operators can run the process manually and know how to do it, because the disclosed cases show that a fast move to manual control is what kept impact small. If you sit in an enterprise that is not a utility, use this as a prompt to ask the same questions of your building systems, manufacturing lines, and any third party that manages OT on your behalf. This is a good moment to bring peers together on operational technology and ICS defense rather than solving it in isolation.

JetBrains TeamCity RCE is under active exploitation and in the CISA KEV catalog

What happened

A build server is a high-trust machine that most organizations underprotect. It holds signing keys, deployment credentials, and source access, and it pushes artifacts into environments that downstream teams trust by default. Unauthenticated code execution on that server, which is what this flaw allows, hands an attacker the credentials and the reach in one step. The move from patch to exploitation was quick here, and the public proof of concept means the window for quiet patching has effectively closed. Because the impact scales with whatever privileges the server process runs under, an over-permissioned service account turns a single-server compromise into a pipeline compromise.

Evidence

• The Hacker News: CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation
• Rapid7: Analysis of CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity

What this means for your team

Find every TeamCity On-Premises server, prioritize any that are internet-facing, and patch to a fixed version or apply the plugin now. Patching stops new exploitation but does nothing about access an attacker may already hold, so rotate the credentials and tokens the server stored and review recent builds for tampering. Assume any exposed and unpatched server has been reached, and hunt for unexpected processes, new files, and outbound connections. This belongs in the same discipline you apply to other actively exploited vulnerabilities, with the added step of treating build systems as identity infrastructure whose service accounts deserve least privilege.

Levi Strauss says social engineering led to corporate data theft

What happened

This is a small-footprint intrusion with a familiar starting point. Three employee laptops, reached through social engineering rather than a software flaw, were enough to pull corporate data out of a large consumer brand. The company frames the outcome as contained and immaterial, which may well hold, but the entry method is the part worth carrying forward. Attackers continue to find that persuading a person is cheaper and faster than defeating a control, and endpoints that hold business data are a productive place to land once that person is fooled.

Evidence

• BleepingComputer: Levi Strauss & Co. says hackers stole corporate data in cyberattack
• SecurityWeek: Corporate Data Stolen in Levi Strauss Cyberattack

What this means for your team

Use this as a check on your human-and-endpoint layer rather than a headline to file away. Confirm that your help-desk and account-recovery processes can withstand a convincing caller, since that is the path these operations usually take. Make sure the data that sits on employee laptops is inventoried, encrypted, and covered by endpoint detection, and that a compromised device can be isolated quickly. The point is not that a jeans maker was breached, it is that three endpoints and one convincing story were the whole attack.

Snowflake customer-breach hacker pleads guilty in US court

What happened

The legal outcome closes a loop on one of the largest credential-driven breaches of recent years, but the operational lesson has not aged. The damage did not come from a flaw in the SaaS platform. It came from customer accounts protected by a password alone, reached with credentials collected elsewhere. That is a shared-responsibility failure, and it is one that still describes a large share of SaaS environments today.

Evidence

• SecurityWeek: Snowflake Hacker Pleads Guilty in US Court
• The Hacker News: coverage of the Snowflake customer-account breach guilty plea

What this means for your team

Read the guilty plea as a reminder to close the same gap in your own SaaS estate. Enforce phishing-resistant multi-factor authentication on every account in your major data platforms, with no standing exceptions, and confirm that federation and conditional access actually cover the service accounts and integrations that people forget. Then pair that with monitoring for logins from stolen credentials, because MFA reduces the odds but does not remove the need to watch. The connection to identity runs through most of today's briefing, which is why it belongs in a wider conversation on identity and access as a security control.

FAQ

Which US states have confirmed water utility cyberattacks?

Reporting places at least 12 states in scope. Minnesota was first to confirm, citing more than 30 affected water systems, followed by Michigan, South Dakota, and Georgia. New Jersey and Alabama are the latest to confirm. Wisconsin, Pennsylvania, and Washington have warned utilities without confirming attacks.

Is drinking water safe after these attacks?

The utilities and states that have come forward report limited disruption and say drinking water is safe. Some operators shut systems down or moved to manual operation as a precaution, and the disclosed activity targeted control systems rather than treatment outcomes.

Why is the JetBrains TeamCity flaw urgent?

CVE-2026-63077 is an unauthenticated remote code execution flaw rated CVSS 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on August 5, and a public proof of concept is now available. A build server compromise can expose stored credentials and tamper with software artifacts.

What should I do if I run TeamCity On-Premises?

Upgrade to version 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin for TeamCity 2017.1 and later. Treat any internet-facing server that was unpatched after July 27 as potentially accessed, rotate stored secrets, and review it for unexpected commands and new files.

What is the main CISO takeaway from the August 9 briefing?

Internet-exposed operational technology is being probed at scale, and unauthenticated code execution on developer and management infrastructure remains a fast path to credentials. Inventory exposed OT and CI/CD systems, patch the actively exploited TeamCity flaw, and treat identity as the control that decides how far an intruder gets.