Colorado Water Utilities Breached in August; Fake Online Job Interviews Spreading Malware

Colorado Governor Jared Polis has disclosed that operational technology (OT) systems at two small water utilities suffered breaches in late August 2026, several weeks after similar incidents at other water utilities around the US made headlines. Both targeted utilities are private, and both serve fewer than 200 people. A spokesperson for the governor said the "incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles." Both utilities addressed the security issues themselves; the incidents did not affect the utilities' ability to provide services, nor did they threaten public safety. Earlier this summer, water utilities in at least 12 other US states reported being targeted by cyberattacks; on July 30, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert that it was "observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector," and providing organizations in that sector with suggested mitigation to secure those systems. Several weeks later, CISA published broader Internet Exposure Reduction Guidance, and noted that it had observed breaches at more than 100 water and wastewater utilities in July 2026.

Security agencies in Australia, Germany, Japan, and the US have published a joint advisory warning of malicious activity conducted by a threat actor group with ties to North Korea. According to the advisory, the threat actor group, dubbed WaterPlum or Contagious Interview, "conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency. WaterPlum is victimizing individual IT professionals in Japan, the United States, Europe, and other countries." By posing as employers offering job interviews for software developers and other professionals, the group has reportedly infected more than 30,000 devices in more than 100 countries and stolen funds and cryptocurrency wallet credentials. The group’s method is to contact targeted individuals via social media and online job platforms, coax them to be interviewed or receive a call about potential work, and use a variety of social engineering tactics to trick the targets into running malicious code on their devices. The advisory includes the threat actors' known tactics, techniques, and procedures (TTPs), and notes in closing that "The techniques described in this advisory are only examples; actors continuously evolve and refine their methods [and advises individuals to] stay informed by monitoring alerts from domestic and international security agencies and by reviewing reports published by security vendors."

Threat actors have impersonated more than 40 organizations to spread infostealer malware known as “Rapuncel.” The campaign was detected on August 13, 2026, when “the LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team identified a fraudulent GitHub organization impersonating LastPass Authenticator which redirected visitors to attacker-controlled infrastructure which ultimately served the installer." The attackers used search engine optimization (SEO) to elevate a GitHub page serving the fraudulent LastPass installer; the threat actors appear to have done the same thing for a fraudulent macOS LastPass application. LastPass writes that "the campaign delivered a Microsoft-attested kernel driver with zero VirusTotal detections that terminated 145 antivirus and EDR processes from kernel mode, enabling potential credential theft across browsers, cryptocurrency wallets, Discord, Steam, Telegram and Windows Credential Manager."

SolarWinds has released an update that fixes a high-severity unauthenticated remote code execution vulnerability stemming from a hardcoded static key in Access Rights Manager (ARM). The flaw, CVE-2026-28326, CVSS score 8.8, is addressed in ARM 2026.2.1, released on Thursday, September 17. CVE-2026-28326 is the only CVE fixed in the update, which also addresses nine customer issues, including changes to group membership updating automatically for Azure AD resources without requiring a re-scan; collectors remaining connected after ARM service restart and no longer requiring re-registration or reconnection steps; and service actions scheduled for a future date through the web client executing at the scheduled time instead of running immediately. The ARM 2026.2.1 release notes remind users that "ARM and SolarWinds Platform products must be installed on separate servers. ARM is not a SolarWinds Platform product, and if you are on a version earlier than ARM 2023.2.4, first upgrade to 2023.2.4 and then upgrade to the current version." The document also includes a list of end-of-Life dates for various ARM versions. SolarWinds credits Kai Huang from Armadin with the flaw's discovery.

Sarah Wight, VP of Legal for Litigation, Competition, and Enforcement at LinkedIn, has posted that a federal court in California "has entered a consent judgment in LinkedIn's favor," prohibiting ProAPIs, Netswift, and their founder and CTO Rehmat Alam from scraping, selling, and transferring data from LinkedIn member profiles. The companies created millions of phony LinkedIn accounts through which they conducted their activity. The October 2025 complained alleged breach of contract; fraud and deceit; breach of the Computer Fraud and Abuse Act; breach of the California Comprehensive Data Access and Fraud Act; unlawful, unfair or fraudulent business practices; violation of the Lanham Act; misappropriation; and trespass to chattels.

The US Cybersecurity and Infrastructure Security Agency (CISA) has upgraded its coordinated vulnerability reporting platform from the Vulnerability Information and Coordination Environment (VINCE) to VINCE-NT, where NT stands for New Technology. CISA says the updated platform offers clearer reporting fields, updated workflows and standardized processes, improved communication and triage capabilities, and increased support for multi-party coordination and developing advisories. VINCE-NT launched on Thursday, September 17, 2026, and current VINCE cases will transition to the new system over the next few weeks. The associated FAQ notes that VINCE-NT's terminology differs from VINCE's: VINCE-NT uses the term "Supplier" in place of vendor, developer, and maintainer; "Component" in place of product; and "Reporter" in place of researcher and finder. "A more significant difference is that VINCE-NT supports more specific and formal vulnerability status information than Vendor Information provided in VINCE-generated Vulnerability Notes. This aligns more closely with CSAF and the CVE Record Format."

Japanese software company Helpfeel has acknowledged a data breach of its Gyazo image-sharing service and has apologized "for the significant concern and inconvenience caused by this incident." Helpfeel said the platform suffered "unauthorized access by a third party, which exposed both customer data and image metadata." The company "blocked all access routes used in the incident and have completed remediation of the vulnerability that was exploited." According to Helpfeel's ongoing investigation, the incident compromised roughly 23.62 million customer-related records, which include names, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens (if connected), profile information, and other data. Helpfeel's breach notice page also lists the type of image metadata exposed, and notes that they "have also confirmed that the third party obtained a list identifying private images, ... [and] cannot rule out the possibility that some private images may have been viewed by the third party." The company plans to notify affected customers via email. Users are urged to change their passwords and be alert to suspicious communications.

Ireland’s Data Protection Commission (DPC) has fined Google €403 million (US$462 million) for violations of the European Union's data privacy rules. Specifically, Google failed to process users' Web & App Activity and Location History data in compliance with standards established by the General Data Protection Regulation (GDPR). DPC has ordered Google to bring their data processing practices into compliance with GDPR within six months. The finding was the result of an inquiry that looked at Google's data processing practices between May 25, 2018 and February 4, 2020. DPC is Lead Supervisory Authority for Google in the EU because Google's European headquarters is in Dublin. Google has stated that "From 2019 onwards, [they]’ve significantly evolved [their] practices and launched robust tools that make managing location data simple."

Ludwig Maximilian University (LMU) in Munich, Germany, is recovering from a cybersecurity incident that compromised sensitive student data. Over the weekend, LMU said that the intruders accessed an IT system that contains enrollment information, and the university says it is assuming the information was retrieved. The compromised information may include names, dates of birth, contact details, LMU email addresses, bank account data, and details about students’ courses of study and previous educational qualifications. The incident was detected on Wednesday, September 16, but LMU has not yet determined when the intruders first gained access to the affected system. The compromised server has been disconnected from the internet, and LMU is working with third-party cybersecurity experts and law enforcement. Students have reported difficulties accessing LMU systems; the university plans to extend the deadline for enrollment for the winter semester. An investigation is ongoing.