Manuel Urueña
@muruenya.bsky.social
Security Architect at Redeia. Entropy fighter. @muruenya@infosec.exchange
Read my full story about DEF CON Franklin, and why it could be a template for other forms of volunteer cyber aid, right here on @cybersecuritydive.bsky.social: www.cybersecuritydive.com/news/water-c...
How volunteer cyber experts are helping protect rural water systems
A first-in-the-nation program is seeing promising results as it charts a path for supporting the U.S.’s most vulnerable infrastructure.
cybersecuritydive.com
NEW: An industry memo obtained by @wired.com links dozens of cyberattacks on Minnesota’s water system to Iran-backed hackers. Clues point to the IRGC’s Cyb3rAvengers group, but other details point to another group, Handala. No official attribution has been made. @agreenberg.bsky.social w/ the scoop:
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran
A memo obtained by WIRED, issued by the water utilities information sharing group WaterISAC, links dozens of cyberattacks against Minnesota water utilities to Tehran.
wired.com
Breaking News: Water supplies in at least seven U.S. states were targeted by cyberattacks that officials say appear to be the work of Iran.
Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran
Michigan and Minnesota are among at least seven states coping with cyberattacks aimed at disrupting water systems nationwide.
nyti.ms
ICYMI, my latest CSO piece is about the coordinated cyber attack on 30 Minnesota water utilities and how it has alarmed ICS cybersecurity pros because it is the first distributed campaign against multiple small utilities linked by a common OT weakness. 1/2 www.csoonline.com/article/4203...
A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture?
Investigators are chasing two open questions in the coordinated attack on Minnesota water systems: who was behind it, and whether a shared vulnerability in widely used industrial controllers made doze...
csoonline.com
U.S. officials say Iran is likely responsible for the recent cyberattacks on Minnesota water systems. www.nytimes.com/2026/07/30/u...
U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems
Investigators cautioned that the assessment was preliminary. There were no indications that any water supply had been rendered unsafe to drink.
nytimes.com
More than 30 water systems in Minnesota have been hit in what officials call a “coordinated cyberattack.” One said the hacking shared characteristics with those that federal agencies have been warning against — shortly after federal alerts about Iranian hacking. www.reuters.com/legal/litiga...
Minnesota IT officials disclose 'coordinated cyberattack' at more than 30 local water systems
A "coordinated cyberattack" targeted more than 30 community water systems in the U.S. state of Minnesota on July 26 and July 27, the state's IT agency said in a statement.
reuters.com
Releasing: Post mortem analysis of the Hugging Face incident was written over the weekend by hundreds of CISOs (and reviewed by Hugging Face). Link: cloudsecurityalliance.org/artifacts/hu... (+free download) From CSA, SANSInstitute, Knostic, [un]prompted, RSAC, FIRST
Hugging Face Incident Initial Post Mortem I CSA
AI Security Alliance's initial post-mortem on the Hugging Face incident, the first documented autonomous AI attack, with CISO guidance on detecting, responding to, and governing agentic AI risk.
cloudsecurityalliance.org
this is one of the most insane security incidents I can recall
Catalin Cimpanu@campuscodi.risky.biz · 2w agoOpenAI takes credit for the Hugging Face breach last week The company says that some of its models, including a pre-release one, escaped their testing sandboxes during a test evaluation and then... just hacked Hugging Face's package repo 🤣 openai.com/index/huggin...
Tip: If you are working with a PDF and you are unsure if it is safe, you can use a tool like Danger Zone to convert it to a fully secure format. dangerzone.rocks If it's useful to your networks, please pass on the word so we can clear up the incorrect information
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
dangerzone.rocks
Latvia has increased security around a hydroelectric dam upstream from its capital Riga and at a huge underground gas storage facility due to intelligence pointing to a threat from Russia, Prime Minister Andris Kulbergs told Reuters on Thursday. www.reuters.com/world/latvia...
👀 one of my fav #CyberSecurity reporters on one of my fav #cybercrime warriors: 'Tracking Peter Stokes and The Com: @nixonnixoff.bsky.social and Her Work Unmasking Cybercriminals.' I feel like the term of FAFO was made for cybercriminals who want to test Nixon. www.zetter-zeroday.com/tracking-pet...
Tracking Peter Stokes and The Com: Allison Nixon and Her Work Unmasking Cybercriminals
Any time a member of The Com gets arrested, there’s a good chance Allison Nixon played a role in it. Nixon is chief research officer at the cyber investigations firm Unit221B, named after the apartmen...
zetter-zeroday.com
New: A cyberattack that threatened to cut heating to half a million people in Poland last winter was formally attributed Monday to Russia’s Federal Security Service, as the United Kingdom and European Union imposed their first coordinated package of cyber sanctions against Russian hackers.
Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions
The allies blamed Center 16, the FSB’s signals intelligence arm, for acts of attempted cyber sabotage targeting Poland’s energy sector and water treatment facilities, alongside “a wide range of malici...
therecord.media
The U.S. and a bunch of partners are reiterating warnings to critical infrastructure organizations about Russian government hackers exploiting vulnerabilities in edge devices like routers: media.defense.gov/2026/Jul/09/...
Every year we write about the exciting developments in post-quantum signatures. Last year didn't disappoint. But it's too late. As ekr wrote in 2024 "You go to war with the algorithms you have, not the ones you wish you had." ML-DSA will have to do for now. blog.cloudflare.com/ml-dsa-will-...
Why we cannot wait for better post-quantum signature algorithms
NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and sh...
blog.cloudflare.com
Personally I think Dashlane's update to its 2FA-busting data breach is still lackluster and doesn't say much more beyond its original post. That said, @dangoodin.bsky.social does a solid job of reading between the lines and filling in the gaps. tl;dr: Bruteforcing 2FA codes was relatively easy.
Dashlane explains how attackers managed to download encrypted password vaults
By targeting large numbers of users, attackers increased their chances of success.
arstechnica.com
The first cyberattack in history using prompt injection. Attackers used Meta’s chatbot as a tool to take over Instagram accounts belonging to well-known people, brands, and institutions. Basic mistake: using LLM as a security boundary. www.theverge.com/tech/941179/...
Meta’s own AI was exploited to hijack Instagram accounts
Does this count as vibe hacking?
theverge.com
Exclusive: Fast16 malware has raised questions about what it was designed to do. Researchers at Symantec finally confirm it was subverting software used to simulate nuclear weapons explosions. Nuclear experts also tell me Iran was the likely target and explain how it impacted nuclear weapons tests
Experts Confirm the Fast16 Malware Was Sabotaging Nuclear Weapons Tests, Likely in Iran
Fast16 didn't predate Stuxnet but was contemporaneous with it. It also wasn't aimed at altering nuclear weapons but was simply feeding false data to engineers about the nuclear detonation tests they w...
zetter-zeroday.com
I ORDER MY COFFEE BLACK. NO SUGAR. NO MILK. NO WATER. NO CUP. THEY HAND ME THE BEANS. I EAT THEM IN THE PARKING LOT LIKE A HORSE. THE BARISTAS HAVE STOPPED CHARGING ME. I HAVE NOT SLEPT SINCE TUESDAY. I CAN HEAR THE WIFI
Amid government cutbacks, major critical infrastructure companies are banding together to do more work analyzing and mitigating cross-sector threats. Here's my look at their new group, which wants to transform how we protect vital systems: www.cybersecuritydive.com/news/critica...
New: A British utilities company supplying drinking water to 1.6 million people failed to discover hackers hidden inside its computer network for nearly two years before the intrusion came to light through an IT performance slowdown, the UK's data protection regulator has found.
UK water company allowed hackers to lurk undetected for nearly two years, regulator finds
The Information Commissioner's Office (ICO) fined South Staffordshire Water £963,900 ($1.3 million) on Monday over an attack by the Cl0p ransomware group that led to the personal data of 633,887 custo...
therecord.media
NEW: A Russian hacker who broke into and damaged critical oil and gas infrastructure facilities in the US, Ukraine and other countries was arrested and pleaded guilty to charges that carry up to 27 years in prison. www.bloomberg.com/news/article...
Russian Charged in Oil and Gas Facility Hacks Pleads Guilty
A Russian hacker who helped to breach critical oil and gas facilities in the US, Ukraine and other countries pleaded guilty to charges that carry as many as 27 years in prison.
bloomberg.com
Thank you Microsoft for removing TLS 1.0 & 1.1 support for POP & IMAP clients connecting to Exchange Online, starting July 2026. It is only 5 years and a month since RFC 8996 / BCP 195 was published, deprecating TLS 1.0 & 1.1 for use on the Internet 😎 www.bleepingcomputer.com/news/microso...
Microsoft to deprecate legacy TLS in Exchange Online starting July
Microsoft says it will start blocking legacy TLS connections for POP and IMAP email clients in Exchange Online starting in July 2026.
bleepingcomputer.com
Russian APTs are using AI, per the Dutch military intel agency www.politico.eu/article/russ...
Russia uses AI to hack Europe, Dutch intelligence warns
The Netherlands says Russian cyberattacks on Europe are accelerating.
politico.eu
Kaspersky has a report out on Lotus Wiper, which it believes was the malware behind the Petroleos de Venezuela "ransomware" attack in December of last year They don't specifically say it, but they imply it very obviously. They also don't mention the US once. securelist.com/tr/lotus-wip...
Lotus Wiper: a new threat targeting the energy and utilities sector
Kaspersky researchers analyze the attack chain of a highly destructive Lotus Wiper that can be linked to a targeted attack on the energy and utilities sector.
securelist.com
There are no technical or compliance reasons to double the size of symmetric keys in response to the threat of quantum computers. This common misunderstanding of Grover's algorithm risks wasting limited resources that should go towards deploying actually urgent post-quantum algorithms.
Quantum Computers Are Not a Threat to 128-bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
words.filippo.io
Europol-led crackdown on The Com hackers leads to 30 arrests www.bleepingcomputer.com/news/securit...
Europol-led crackdown on The Com hackers leads to 30 arrests
A yearlong Europol-coordinated operation dubbed "Project Compass" has led to 30 arrests and 179 suspects being tied to "The Com," an online cybercrime collective that targets children and teenagers.
bleepingcomputer.com
