Iran Probes US Water Systems, Passkeys Get Bypassed, and a Patch That Didn't Hold

The common thread this week is inherited trust — synced passkeys, RMM platforms, third-party contractors, IDE extensions. Your perimeter is everyone else's security posture. Here's what mattered.

The lead: Hackers are inside US water systems

At least a dozen states — including Michigan, Minnesota, Georgia, New Jersey, and South Dakota — have reported intrusions into municipal water systems, CBS News reports. Federal investigators suspect Iran-backed hackers, though no formal attribution has been made; the tactics resemble the 2023 CyberAv3ngers campaign linked to the Iranian Revolutionary Guard.

The attackers didn't bother with office IT. Per a July 30 FBI/EPA advisory, they remotely accessed internet-exposed Rockwell Automation MicroLogix programmable logic controllers — then changed their IP addresses and passwords, locking operators out. In Minnesota, more than 30 community water systems were hit over July 26–27. In Georgia, the Clayton County Water Authority (300,000 customers) saw a pressure drop that triggered a boil-water advisory. Several utilities lost remote control entirely and switched to manual operations. Drinking water has stayed safe throughout — but as researcher William Akoto notes in Fortune, PLCs connected directly to the internet remain America's soft underbelly.

Takeaway: If you run OT of any kind, inventory internet-exposed controllers now. CISA's guidance: get PLCs and HMIs behind firewalls, route remote access through a VPN with MFA, kill default credentials, and segment OT from business networks.

Passkeys aren't unbreakable — three teams just proved it

Three separate research teams demonstrated ways to defeat passkey protections and phishing-resistant MFA — not by breaking the cryptography, but by exploiting implementation weaknesses: replaying signed authentication material, abusing cloud-synced passkey systems, and hijacking compromised sessions. Affected: Windows, Microsoft Entra ID, and Google Password Manager.

Takeaway: Passkeys still beat passwords, but synced passkeys inherit the security of the cloud account they sync through. Treat session hijacking as your main residual risk, and prefer device-bound credentials for privileged accounts.

Patched isn't fixed: N-able N-central bypass fuels new ransomware

Microsoft attributes a new ransomware strain, StormEncryptor, to the China-linked group Storm-1175, likely exploiting CVE-2026-18577 — a bypass of the patch for an earlier authentication bypass (CVE-2026-18556) in N-able N-central. Account takeover on an RMM platform means attacker access to every endpoint it manages.

Takeaway: If an MSP manages your fleet, confirm their N-central version today. Patch-bypass CVEs deserve the same urgency as the original zero-day.

Quick hits

• Levi Strauss & Co. disclosed a breach in an SEC filing (Aug 7) after social engineering compromised three employee machines.
• Amgen reported theft of patient health data and proprietary data from externally managed cloud storage.
• Ceva Logistics: a cyberattack disrupted eight European warehouses; the Dutch Data Protection Authority is investigating.
• Żabka, Poland's largest convenience chain, was breached via a third-party contractor account; stolen data is being offered for sale.
• Head Mare is exploiting TrueConf server flaws (versions ≤5.5.5) to swap legitimate client installers for PhantomCore backdoors.
• A malicious VS Code extension, "Solidity Pro" (distributed via Open VSX and GitHub), stole browser wallet credentials and API keys.
• OpenAI and Anthropic both warned about autonomous AI agents conducting real-world cyber operations; OpenAI paused some internal work on its Astra model after capability evaluations.

Bottom line

Audit what you trust by default: who syncs your credentials, who manages your endpoints, who holds contractor accounts, and what your developers install. That's where this week's attackers walked in.