Energy & Utilities — Cybersecurity News & Threat Intelligence

6 articlesUpdated 4 Oct 2026

Cyber AttackEnergy & Utilities

China-Nexus Warlock Ransomware Crew Breaches Water Utility and Telecom Operator Through Unpatched SharePoint

Longlegs (Storm-2603) used on-prem SharePoint access, a BYOVD EDR killer and SYSVOL replication to push Warlock ransomware to 33+ hosts. IOCs inside.

4 Oct 20269 min read

Mei-Lin Chen

ThreatsEnergy & UtilitiesHigh
AVEVA Pipeline Integrity Monitor Vulnerabilities Threaten Critical Energy Infrastructure
CISA issued an energy sector ICS advisory warning of memory corruption and authentication defects in AVEVA Pipeline Integrity Monitor supervising oil and gas transport.
Daniel Okafor14 Sep 20268 min read
IndustryGov & Defence
CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced
CISA issued its landmark final rule under CIRCIA, legally mandating critical infrastructure operators report major cyber incidents within 72 hours and ransom payments within 24 hours.
Tom Verhoeven14 Sep 20268 min read
InsightsEnergy & Utilities
EU AI Act High-Risk Rules Slip to December 2027, but Logging Work Cannot
Regulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Tom Verhoeven9 Sep 20266 min read
InsightsEnergy & Utilities
NIS2 simplification and CSA2: what the January 2026 cybersecurity package actually changes
The European Commission’s cybersecurity package proposes amendments to NIS2 and a revised Cybersecurity Act. Here is what compliance teams need to track.
Tom Verhoeven8 Sep 20267 min read
ThreatsTelecom & MediaCritical
Cisco Nexus 9000 Silicon One Switches Exposed to Unauthenticated Root RCE
Cisco disclosed CVE-2026-20212 (CVSS 9.8), an unauthenticated root code execution flaw on Silicon One-based Nexus 9000 datacenter switches due to open debugging ports.
Daniel Okafor3 Sep 20265 min read

Threat scope

Power grids, substations, water treatment facilities, pipeline telemetry and critical directives.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy

China-Nexus Warlock Ransomware Crew Breaches Water Utility and Telecom Operator Through Unpatched SharePoint

AVEVA Pipeline Integrity Monitor Vulnerabilities Threaten Critical Energy Infrastructure

CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced

EU AI Act High-Risk Rules Slip to December 2027, but Logging Work Cannot

NIS2 simplification and CSA2: what the January 2026 cybersecurity package actually changes

Cisco Nexus 9000 Silicon One Switches Exposed to Unauthenticated Root RCE