Today’s digest is a reminder that “critical infrastructure” isn’t only power grids and pipelines — it’s the cellular modem bolted to a small-town water tower, and it’s the image-upload endpoint on an ordinary web app. A coordinated OT attack takes a Minnesota water plant offline, a maximum-severity Rails bug turns a routine feature into a secrets leak, Cisco confirms in-the-wild exploitation of hardcoded credentials in its own security management console, and a leaked Android spyware kit is already powering over a hundred live servers. Here’s what changed since yesterday’s digest.
Critical infrastructure watch: A coordinated cyberattack knocks a Minnesota water plant offline and disrupts 30+ other systems
Minnesota’s state IT agency confirmed a coordinated cyberattack against operational technology at more than 30 community water systems over July 26–27. Braham took the hardest hit: unknown actors used malware to hijack the wireless connection into its water plant and shut down operating controls, forcing the plant offline and prompting officials to ask residents to minimize water use until treatment resumed. Plymouth reported cellular communications failures at two water towers and multiple wastewater lift stations — “limited to equipment connected via cellular communications,” per the city — and switched to manual operations to keep running. South St. Paul and Maple Plain reported similar disruptions to automated controls and also fell back to manual operation. Officials say there’s no impact on water quality and no indication customer data was accessed, but state officials are warning other systems may still be at risk. Star Tribune · The Hacker News · SecurityWeek
Multiple independent municipal utilities getting hit in the same 48-hour window, all through the same cellular-connectivity pattern, points to a shared weak link — a common remote-access vendor or cellular IoT gateway — rather than four separate intrusions. If your OT environment leans on cellular modems for remote sites, this is a good week to confirm those links are monitored and segmented from control systems, and that staff can actually run the plant manually if the network drops.
Vulnerability watch: A critical Rails flaw lets unauthenticated attackers read server secrets through ordinary image uploads
Ruby on Rails shipped patches for CVE-2026-66066 (CVSS 9.5), an Active Storage vulnerability that lets an unauthenticated attacker read arbitrary files off the application server by uploading a crafted image. The root cause: Active Storage hands untrusted uploads straight to libvips for variant generation (thumbnails, resizing) without disabling the loaders libvips itself considers unsafe for untrusted input — so a crafted file that triggers variant processing can pull files off disk, including secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. Those secrets can, in turn, enable remote code execution or lateral movement. The bug spans Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3, plus 6.0.0–6.1.7.10 wherever Vips was configured as the image processor. Fixes shipped in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1, alongside required updates to libvips (8.13+) and ruby-vips (2.2.1+). A third-party proof-of-concept is already public. The Hacker News · HeroDevs
Any Rails app that accepts image uploads and uses Active Storage for thumbnails or variants is exposed by default, with no authentication required — that’s a same-day patch, not a next-sprint one. Patching alone doesn’t undo exposure that already happened, so if your app has been running a vulnerable version with public upload endpoints, rotate secret_key_base, database credentials, and any API tokens the Rails process could read.
Actively exploited watch: Cisco’s hardcoded FMC credentials land in CISA’s KEV catalog with an August 1 deadline
CISA added CVE-2026-20316, a hard-coded-password vulnerability in Cisco Secure Firewall Management Center (FMC), to its Known Exploited Vulnerabilities catalog on July 29, confirming active exploitation and setting a remediation deadline of August 1, 2026 for federal agencies. The flaw stems from static credentials for a low-privileged account built into FMC’s web interface, letting an unauthenticated remote attacker log in without any prior access. Cisco rates it High severity despite a CVSS base score of 5.3, because that low-privileged foothold can be chained with other FMC vulnerabilities — including CVE-2026-20079, a separate critical authentication-bypass bug Cisco patched in the same advisory that lets an unauthenticated attacker run commands as root — to fully compromise the management console and everything it oversees. No workarounds exist; only hotfixes for FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. BleepingComputer · The Hacker News · CISA
FMC manages the policy and configuration for every firewall beneath it, so a hardcoded low-privilege account that chains into root is effectively a master key to your perimeter. If you run Secure FMC, this is not a wait-for-the-maintenance-window patch — apply the hotfix now and check FMC access logs for logins from the built-in account or from IPs outside your known management ranges.
Threat intel watch: Leaked Android RAT framework “Flying Eagle” is already running on 170 servers, with a successor already live
Source code for Flying Eagle (飞鹰), a previously undocumented Android remote-access-trojan builder and device-control framework, is circulating on criminal Telegram channels after researchers traced it back to a malicious APK impersonating a Chinese Provincial Public Security Bureau app. The framework lets an operator brand and sign a customized Android package — changing app name, icon, and C2 address — then manage infected devices from a web panel supporting keystroke and payment-password capture, screen recording, camera access, and phishing overlays disguised as financial, adult-content, and government-service apps. Fingerprinting panels and TLS certificates, researchers at Hunt.io identified 170 servers running Flying Eagle infrastructure, concentrated in Hong Kong-hosted networks but also present in the US, mainland China, Finland, Malaysia, Canada, and Japan. A successor kit, Night Dragon, was already introduced on the same Telegram channel in June, adding icon-hiding and a fake system-update screen to conceal the infection. The Hacker News · Hunt.io
A leaked builder framework lowers the bar for every opportunistic operator who wants a branded Android RAT without writing one — expect copycat campaigns using the same panel signatures for months. If your organization supports BYOD, this is a good prompt to confirm mobile threat defense or MDM policy actually flags sideloaded APKs mimicking government or financial-service apps, since that’s the lure this kit is built around.
Also noted: Broadcom patches three critical VMware vCenter flaws, two rated CVSS 9.8
Broadcom’s VMSA-2026-0006 advisory fixes five vulnerabilities across VMware ESX, vCenter, Workstation, and Fusion, ranging from CVSS 2.7 to 9.8. The two most severe: CVE-2026-59309, an authentication bypass in VMware Directory Service letting a remote, unauthenticated attacker with network access to vCenter Server gain unauthorized access to the management platform, and CVE-2026-59310, a directory-traversal flaw in the vCenter Syslog server that an attacker with network access can use to execute arbitrary code. A third flaw, CVE-2026-47876 (CVSS 9.3), is an out-of-bounds write in the VMXNET3 virtual network adapter exploitable by anyone with local admin rights on a VM to execute code on the host. The Hacker News · SecurityOnline
An unauthenticated auth bypass into vCenter is a direct path to every VM it manages — treat this as an emergency patch for any internet-reachable or flat-network vCenter deployment, and don’t overlook the VMXNET3 bug if you run any multi-tenant or less-trusted VMs on shared ESXi hosts.
Final thought
Three of today’s five stories share a root cause worth naming directly: a default behavior nobody thought to question — image processing that trusts uploaded files, a management account with a credential nobody rotates, a support tool wired into cellular networks nobody watches — turning into the actual point of failure. CVEs and KEV deadlines matter, but the faster win is auditing what your own “of course that’s safe” defaults actually allow. If you want help finding which of your internet-facing services and management consoles carry that kind of hidden exposure, see our how-to guides or book a discovery call.