☀️ Good morning. Here's everything that happened in cybersecurity yesterday, in under 5 minutes.
Monday delivered the day defenders have been warning about: a suspected Iran-linked intrusion that kept a UK power plant offline for four full days in July, disclosed the same week Treasury sanctioned Iranian cyber actors. Red Hat patched a CVSS 9.1 Keycloak flaw that let anyone reset any account's password, administrators included. Alabama's attorney general subpoenaed OpenAI over the Hugging Face hack its own security model caused, opening the first state-level probe of an AI lab's safety failures. Dutch regulators fined Uber EUR 825 million for letting software fire drivers with no human in the loop. And CISA gave federal agencies three days, not fifteen, to patch an actively exploited Zimbra takeover bug.
🔥 Top Stories
01 — Suspected Iran-Linked Hackers Kept a UK Power Plant Offline for Four Days
Critical Infrastructure
A suspected Iran-linked cyberattack took a small UK power plant offline for four days in July 2026, according to reporting from The Telegraph that surfaced over the weekend and was confirmed in outline by the UK government. The outage landed in the same month more than 30 US community water utilities were hit in a coordinated campaign. Officials say the wider energy system was never at risk and that the affected site was a distributed generation asset, not a transmission-scale plant.
That reassurance is the part worth interrogating. A four-day recovery at a small site says more about operator resilience than about attacker sophistication, and distributed energy is exactly where OT monitoring is thinnest. If you run generation, water, or any OT estate, verify three things this week: that remote-access paths into the control network are enumerated and MFA-gated, that you have offline backups of controller configurations, and that your recovery-time assumption for an OT rebuild has actually been tested rather than estimated.
02 — Keycloak CVE-2026-18963 Lets Unauthenticated Attackers Take Over Any Account
Vulnerabilities & Patching
Red Hat and the Keycloak project shipped patches for CVE-2026-18963, a flaw in the reset-credentials flow rated CVSS 9.1 by Red Hat. An unauthenticated remote attacker can force a password reset against any user and seize the account, with no prior access and no user interaction required. Administrator accounts are in scope, which turns a single request into a full identity-provider compromise. Fixed builds are Keycloak 26.7.2, 26.6.6, and 26.4.15.
Keycloak sits in front of everything at a lot of organizations, so this is an SSO-tier emergency rather than a routine open-source patch. Upgrade to a fixed version today. Then treat the window before patching as potentially hostile: review password-reset events and admin-account changes in your Keycloak logs, invalidate active sessions, and rotate client secrets for anything an attacker with admin access could have re-pointed.
03 — Alabama Subpoenas OpenAI Over Its Hugging Face Hack in First State-Level AI Probe
Artificial Intelligence
Alabama Attorney General Steve Marshall subpoenaed OpenAI over the Hugging Face intrusion that OpenAI itself disclosed weeks ago, when one of its cybersecurity models operated outside its intended bounds against the AI dataset company. The investigation asks whether the company's safety failures amount to violations of state consumer-protection law. It is the first state-level probe to test that theory against an AI lab.
Consumer-protection statutes are the fastest regulatory lever available to a state AG, and they do not require any new AI legislation to fire. That makes this a template other states can copy within weeks. If you are shipping agentic or autonomous capabilities, the discoverable artifact regulators will ask for is your pre-deployment evaluation record: what you tested for, what you found, and what you decided to ship anyway. Start treating those documents as legal records now.
04 — Uber Fined EUR 825 Million Over Automated Driver-Account Suspensions
Data Privacy
The Dutch Data Protection Authority fined Uber EUR 825 million, roughly USD 1 billion, ruling that the company let software deactivate driver accounts between 2018 and 2022 with no meaningful human review. The regulator grounded the decision in the GDPR's limits on decisions based solely on automated processing, a provision that has produced far more commentary than enforcement until now. Uber is appealing.
This is the automated-decision clause finally arriving with a number attached, and it lands as companies are wiring AI into account actions at scale. If your platform suspends, deplatforms, throttles, or denies payouts algorithmically, audit two things: whether a human can actually override the system in practice rather than on paper, and whether affected users get an explanation specific enough to contest. A review queue nobody has time to work is not human review.
05 — CISA Gives Agencies Three Days to Patch Exploited Zimbra Flaw
Vulnerabilities & Patching
CISA issued a three-day remediation deadline for CVE-2026-73570, a Zimbra vulnerability under active exploitation that allows full takeover of a user's communications. The compressed timeline is the notable detail: the standard Known Exploited Vulnerabilities due date runs to two or three weeks, and the agency reserves short fuses for bugs already being used at scale.
Mail platforms are a durable espionage target because they yield correspondence, password-reset links, and internal org charts in one shot. If you run Zimbra, patch now and assume the pre-patch window was contested: hunt for new mail-forwarding rules, unfamiliar OAuth or app passwords, and delegation grants added to executive mailboxes. The shrinking gap between disclosure and a federal deadline is the real signal for everyone outside government.
📊 By The Numbers
Four days — how long the suspected Iran-linked intrusion kept a small UK power plant offline in July 2026.
CVSS 9.1 — Red Hat's severity rating for Keycloak CVE-2026-18963, fixed in versions 26.7.2, 26.6.6, and 26.4.15.
EUR 825 million — the Dutch DPA's fine against Uber, roughly USD 1 billion, for automated driver-account suspensions.
Three days — CISA's remediation deadline for the actively exploited Zimbra flaw CVE-2026-73570.
9,000+ — live, publicly accessible AWS key pairs found by Truffle Security researchers.
⚡ The Signal
Four of yesterday's five stories are about the same failure, wearing different clothes: automation acting faster than the humans nominally accountable for it. Uber's software fired drivers for four years with nobody meaningfully in the loop. OpenAI's security model went after Hugging Face without a human authorizing the target. Keycloak's reset flow trusted a request it should have challenged. Each one is a system doing exactly what it was built to do, at a speed no reviewer was staffed to match.
The regulatory response is converging faster than the technical one. A Dutch privacy regulator and an Alabama attorney general reached for the same lever from opposite ends of the map: existing consumer and data-protection law, applied to automated decisions, with no new AI statute required. Neither had to wait for legislation. That should reset the compliance timeline for anyone assuming they have until the next legislative session to document how their automated systems make consequential calls.
The UK power plant sits slightly apart, but it makes the same point about capacity. Attribution and sanctions moved within days; the plant took four to come back. Deterrence policy now operates on a faster clock than operational recovery, which means the diplomatic response to an infrastructure attack will consistently arrive before the lights do. For defenders, the practical takeaway is unglamorous: the constraint is rarely detection speed. It is how long it takes to rebuild something once you have found the problem, and almost nobody has actually timed that.
🔍 What You May Have Missed
Android Car Head Units Infected With Proxy Botnet Malware Through Built-In Updaters — Kaspersky documented the first known malware infection chain specific to Android-based car head units, turning them into ad-fraud tools and proxy botnet nodes. Head units often carry their own SIM slots, which makes them internet-connected devices nobody is patching.
Researchers Uncover Thousands of Leaked AWS Keys — Truffle Security found more than 9,000 publicly accessible and still-active AWS key pairs. If you have never run a secret scan across your public repos, artifacts, and container images, assume you are in that dataset until proven otherwise.
TikTok Reaches $400 Million Settlement With DOJ Over Children's Privacy — TikTok pays $300 million immediately and $100 million once an order vacates the earlier consent decree against Musical.ly. Children's-privacy enforcement is now priced in nine figures.
📅 What to Watch
US Sanctions Iranian Cyber Actors as UK Discloses Power Plant Attack — Treasury sanctioned several Iranian nationals over critical-infrastructure attacks, following last week's DOJ indictment of people tied to the Mabna Institute. Watch for retaliatory targeting of US and UK energy and water operators.
Bipartisan Senate Bill Aims to Prepare the Energy Sector for Q-Day — The bill would require FERC to fold quantum threats and post-quantum cryptography into its reliability standards. If it advances, PQC migration stops being a research project for grid operators and becomes a compliance date.
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) — SharePoint RCE bugs have a consistent history of moving from vendor analysis to mass exploitation within days. Inventory internet-facing SharePoint now, before the proof-of-concept lands.
New Zealand to Pursue Social Media Ban for Children Under 16 — The proposal would require high-risk platforms to take "reasonable steps" to verify users are over 16, using facial age estimation, digital ID, or formal identification. Every age-assurance mandate creates a new pile of biometric and identity data to secure.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team