🚨 What Mattered This Week
Water-System Attacks Reach at Least Seven States
The FBI and EPA warned that malicious actors are remotely accessing internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers used by water and wastewater utilities. Since July 27, utilities in at least seven states have reported incidents to the FBI, and some activity degraded water operations. The actors changed IP addresses and passwords, causing loss of monitoring or control; reported effects included pressure loss and flooding. Minnesota separately said a coordinated attack targeted operational technology at more than 30 community water systems on July 26 and 27. The current FBI notice does not attribute these incidents, so attribution remains unresolved. Defenders should remove PLCs and cellular modems from direct internet exposure, mediate remote access through monitored gateways, validate project files and ladder logic against known-good copies, and test the ability to operate safely in manual mode.
Key Takeaway: Standardized, internet-facing OT configurations turned one access method into a repeatable path to operational disruption.
Cisco Confirms Active Exploitation of Static FMC Credentials
Cisco disclosed CVE-2026-20316, a static-credential flaw in Cisco Secure Firewall Management Center Software. An unauthenticated remote attacker can use a built-in low-privilege account to log in and access sensitive data. The CVSS score is 5.3, but Cisco rates the issue High because it can be chained with other FMC vulnerabilities to elevate privileges. Cisco PSIRT said it became aware of active exploitation in July 2026. There is no workaround. Cisco issued release-specific hot fixes for FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 and provided a log check: the presence of /var/tmp/license.tmp in matching package_info messages may indicate exploitation. Cloud-Delivered FMC, FDM, ASA Software, FTD Software, and Security Cloud Control are not affected. Patch first, then run the indicator check and contact Cisco TAC if compromise is suspected.
Key Takeaway: A modest CVSS score should not outrank confirmed exploitation, a management-plane location, and a vendor-provided compromise indicator.
Sources: Cisco security advisory
Rails Image Processing Can Expose Application Secrets
Ruby on Rails disclosed CVE-2026-66066 in Active Storage variant processing. In affected applications, an unauthenticated attacker who can upload a crafted file may cause libvips to read arbitrary files available to the application process, including its environment. That can expose secret_key_base, the Rails master key, cloud-storage credentials, database passwords, and third-party tokens, creating paths to remote code execution or lateral movement. Applications are affected when they use libvips for Active Storage image processing and accept untrusted uploads—a default introduced by load_defaults 7.0. Fixed releases are 7.2.3.2, 8.0.5.1, and 8.1.3.1, with libvips 8.13 or later required. After researchers published proof-of-concept code, the Rails security team released attack details and forensic tools. No active exploitation was confirmed in the retrieved sources. Upgrading closes the flaw; it does not invalidate secrets that may already have been read.
Key Takeaway: Treat this as a potential credential-exposure incident, not only a framework patch.
🔎 Other Signals
Amgen Discloses Material Cloud Data Exfiltration
Amgen said unauthorized activity affected data stored in third-party-hosted cloud environments. Proprietary data, patient protected health information, and other information were exfiltrated. The company found no impact to products, manufacturing, financial reporting, or its ability to meet patient needs; the investigation remains ongoing.
Source: Amgen SEC Form 8-K
Broadcom Patches Critical vCenter and ESX Flaws
VMSA-2026-0006 fixes five VMware vulnerabilities. CVE-2026-59309 can bypass vCenter authentication, CVE-2026-59310 can lead to arbitrary code execution, and CVE-2026-47876 can let a guest administrator execute code on an ESX host through VMXNET3. Broadcom lists no workarounds and no confirmed exploitation.
Source: Broadcom VMSA-2026-0006
Every TeamCity On-Premises Version Needed a Fix
JetBrains disclosed CVE-2026-63077, an unauthenticated TeamCity On-Premises flaw reachable over HTTP(S) that can execute operating-system commands as the server process. All on-premises versions were affected. Update to 2025.11.7 or 2026.1.3, or use the patch plugin for 2017.1 and later. JetBrains reported no known active exploitation at publication.
Source: JetBrains TeamCity advisory
Adobe Campaign Classic Receives a Priority-One Patch
Adobe fixed CVE-2026-48449, an unauthenticated code-execution flaw rated 10.0, and CVE-2026-48448, an SQL-injection flaw enabling arbitrary filesystem reads. The bulletin applies to fully on-premises ACC v7 and on-premises hybrid components through 7.4.3 build 9397; build 9398 is fixed. Adobe reported no in-the-wild exploits.
Source: Adobe APSB26-114
FCC Makes Basic EAS Cyber Controls Mandatory
A final FCC rule requires Emergency Alert System participants to replace default credentials, use strong unique passwords or equivalent authentication, promptly test and install security updates, and restrict remote management through firewalls or comparable segmentation. The rule was published July 31 and becomes effective after the 60-day compliance window.
Source: Federal Register final rule
📈 Defender Trend
This week’s common problem was inherited authority. The water-sector attackers reached PLCs that could affect physical operations; Cisco FMC sits above an enterprise firewall estate; Rails Active Storage processing could read the application’s secrets; VMware vCenter and TeamCity control infrastructure and delivery pipelines. Amgen’s disclosure shows the same consequence on the data side: intermediary cloud environments accumulated sensitive information at scale. Defenders should inventory exposed services together with what each service can reach, decrypt, modify, or deploy after compromise. That shifts hardening toward narrower service privileges, secret isolation, segmented management access, and fewer directly reachable control interfaces.
⚔️ Actionable Defense Move of the Week
Action: Treat CVE-2026-66066 as a potential secret-exposure event. Inventory Rails applications using Active Storage with libvips, upgrade affected applications, run the Rails forensic tools, and rotate every credential readable by the application process.
Who runs it: Application security and platform engineering, with the Rails application owner, SOC, IAM, database, and cloud teams.
Check these specifically: activestorage versions below 7.2.3.2, 8.0.5.1, or 8.1.3.1; libvips below 8.13; config.active_storage.variant_processor = :vips; untrusted upload paths; Active Storage blobs and object-store records identified by rails-forensics-CVE-2026-66066; secret_key_base; RAILS_MASTER_KEY or config/master.key; credentials.yml.enc contents; S3, GCS, or Azure keys; database credentials; third-party tokens; active sessions.
Evidence you're done: A signed application inventory, version output for Rails and libvips, saved forensic-tool results, documented findings for suspicious crafted files, completed credential-rotation records, invalidated sessions where required, and a ticket linking each affected application to its remediation evidence.
🧠 Final Word
Security architecture often treats helper and control systems as supporting infrastructure. Attackers treat them as leverage. The service that resizes an image, manages a firewall, polls a build agent, stores cloud data, or remotely monitors a pump may sit outside the main business workflow while inheriting far more access than its job requires. That mismatch is where modest initial access becomes organization-wide consequence.
The useful question is not merely whether an intermediary is exposed. It is what the intermediary can read, change, or deploy after it is reached. Map that authority now, then remove permissions that exist only because they were convenient when the service was deployed.