• Cyberattack hits operational technology at more than 30 Minnesota community water systems, briefly taking treatment plant offline and forcing several towns onto manual operations
• A leaked WaterISAC memo obtained by WIRED relays a state fusion center assessment tying the intrusions to Iranian-affiliated hackers, but no US agency has formally attributed the attack yet
• The CISA had warned four days earlier that Iranian-affiliated actors were compromising internet-facing PLCs, repeating guidance that has mostly fallen on deaf ears

More than 30 community water systems across Minnesota were hit by a coordinated cyberattack, targeting the operational technology running pumps, wells, water towers, and wastewater lift stations rather than the office networks behind them.

Minnesota IT Services disclosed the attack on July 28 2026 and activated a statewide incident response, stating that it wasn't aware of any Minnesota city asking residents to change their drinking water use just yet.

A memo obtained by Wired, circulated by the water sector information-sharing group WaterISAC and carrying a restricted TLP: AMBER handling marking, relays a Minnesota state fusion center assessment that ties the intrusions to Iranian-affiliated hackers.

A warning that was more or less ignored

Four days before the attacks, CISA updated an advisory, AA26-097A, warning that Iranian-affiliated actors were compromising internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens, and possibly others across the US water, energy, and government sectors. It documented confirmed disruptions and financial losses.

This drew no immediate response from state functionaries, and it is easy to see why: the US has tens of thousands of community water systems that serve small populations and lack budgets for dedicated cybersecurity staff.

This is despite there being a precedent: Iranian-linked actors hit the Municipal Water Authority of Aliquippa in Pennsylvania in November 2023, defacing a Unitronics controller with an anti-Israel message. CISA said at the time those devices were exposed to the internet with default passwords still in place. The advice issued then is the same advice being issued this week, which is telling about how little has changed since.

The WaterISAC memo, dated the day the attacks concluded, passes on a state fusion center report linking the activity to Iranian-affiliated actors. That memo was not meant to be public, but it has been corroborated by The New York Times and The Washington Post, which reported that they spoke to federal officials and US intelligence agencies, respectively, lending credence to the claims.

CISA later warned that attackers are changing PLC passwords to lock operators out of their own equipment, and repeated the advice that has been unchanged for years: get PLCs off the public internet and put remote access behind a VPN or gateway.

Who was affected?

The worst of the cyberattack hit Braham, a town of roughly 1,700 people, where the city said attackers shut down the operating controls, taking the water treatment plant and the well offline. Crews restored it manually within a couple of hours, and residents were told to minimize water use in the meantime.

Plymouth, a Minneapolis suburb of about 80,000, found the problem confined to equipment connected over cellular links at two water towers and several wastewater lift stations. Its IT division disconnected the affected kit from the network entirely to stop the attack and prevent retargeting during reconfiguration.

Maple Plain declared a local state of emergency to manage its response, and South St. Paul reported that some automated controls were compromised. In most cases, contingency procedures held and water and wastewater operations continued.

None of this is happening in a vacuum, however. The June memorandum that paused fighting between the US and Iran has broken down, and both are trading strikes, including recent US attacks near the Strait of Hormuz that destroyed a water facility and cut supply to more than 20,000 people. Whoever carried out the Minnesota attacks, the symbolism of targeting municipal water is unlikely to be accidental.

The damage that these intrusions caused was limited; they produced brief outages that trained staff fixed by hand. That is an outcome with a silver lining, and it depended on utilities having people who knew how to run a treatment plant without its automation, even if its digital defenses collapsed outright.

• Instructions hidden as white text in a Word document can make Microsoft 365 Copilot silently alter the file it is drafting and copy the instructions into the output
• Each poisoned document becomes a carrier, so the attack spreads through ordinary internal workflows without the original malicious file and needs no macros, malware, or code execution
• Microsoft has shipped two mitigations across a 144-day disclosure, including a model upgrade, and the attack was still reproducible by the researcher

A security researcher has published a proof of concept showing that instructions hidden inside a Word document can cause Microsoft 365 Copilot to silently alter the file it is drafting, then copy those same instructions into the finished document, so the next person to use it becomes a carrier too.

Håkon Måløy, a data scientist with a doctorate in applied machine learning, disclosed the technique as the third installment of his Context Collapse series, after a 144-day coordinated disclosure with the Microsoft Security Response Center.

The reason this is being reported ahead of a fix is that it still works despite multiple attempts by Microsoft, as he notes that no robust mitigation for the broader vulnerability class is currently available.

A clever attack designed around Copilot's approach to text

The underlying attack belongs to a family known as cross-domain prompt injection, or XPIA. An attacker writes instructions in a natural-language document, formats them as white text on a white background at a small point size, and shares the file.

Because Copilot for Word strips formatting before passing text to the underlying language model, the model reads text the human never sees. This is true even for documents that are not opened by the user on purpose: The attack can trigger either when a user manually attaches a document to Copilot or when Copilot, working in Work IQ mode, searches the user's OneDrive for relevant files and finds the malicious one on its own.

It is also more dangerous than other exploits because of one key element: propagation. The hidden prompt in Måløy's proof of concept had two parts. One instructed Copilot to alter the document being drafted, in his demonstration halving every financial figure in a quarterly report.

The other instructed Copilot to copy the prompt into the new document and conceal it, framed innocuously as source tracking and readability formatting. Copilot did both, appending the instructions in white text and mentioning neither action to the user.

The disclosure timeline is the most uncomfortable part of the report. Måløy reported to MSRC on March 6 2026. Microsoft confirmed the behavior on March 31 and shipped a first mitigation in early April via a reworked Edit with Copilot experience, which successfully blocked his original prompt wording. He reproduced the attack with different wording the same week, and a second case was opened.

The second fix, on July 14, consisted of upgrading the underlying model to GPT-5.5. Måløy broke it the following day using GPT-5.6, then voluntarily offered Microsoft a further two-week delay to attempt another mitigation. The class still reproduced on the disclosure date, indicating that although a fix is in the works, the exploit is still possible to run.

A complicated issue that lacks a proper resolution

The issue goes far beyond Microsoft Word: an AI assistant must ingest untrusted content to determine whether it is relevant or hostile. But the content enters the same context window as the system prompt and the user's actual request, so by the time the model evaluates whether the text is an attack, the attacker's tokens have already shaped that evaluation.

As Måløy puts it, "the content being inspected participates in the act of inspection."

Microsoft confirmed it had reviewed the findings in a statement to The Register but stopped short of indicating a timeline for a complete fix:

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure," the company said.

"To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests. We are continuously strengthening these safeguards as the technology and threat landscape evolve. We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”

Måløy's recommendations are to treat externally sourced documents as untrusted when using them with Copilot, review attachments before starting an AI-assisted draft, and review Copilot's output carefully before sharing or reusing it.

He also suggested that generated documents should carry provenance metadata that records source material and model edits, which would not prevent injection but would make an infection traceable after the fact.

With Copilot extending further into agentic products that create and manipulate documents with less human oversight, the scope of how exploits like this could affect workflows (and users) will widen rather than narrow, and a complete solution is not yet in sight.

• Kaspersky says empty web pages are watching you, and the research backs up the warning
• Over 90% of parked domains now send visitors somewhere malicious, and clearing your cookies will not help
• Blank pages are also a problem: many 'Coming Soon' placeholders are quietly fingerprinting your device

Kaspersky has unveiled a rather underreported attack vector which is increasingly being used by threat actors to harvest private data from unsuspecting victims: registered websites that are yet to be developed.

Its warning focuses on parked domains, the registered web addresses that have no real website behind them yet, arguing that the blank screens and "Coming Soon" placeholders users dismiss as harmless are frequently doing work in the background.

The company says simply loading one of these pages can trigger silent collection of a visitor's IP address, approximate location, User-Agent string and cookie identifiers, and that operators go further by building browser fingerprints through other techniques, then feeding the result into advertising networks to assemble targeted profiles without consent from users.

Browser fingerprinting sans the permissions

The mechanics Kaspersky describes are worth understanding, because fingerprinting is the part most readers will not have encountered, and the part that conventional privacy habits do not touch.

For context, a cookie is a file placed on your machine that you can delete, thereby limiting tracking. A fingerprint is not stored on your machine at all. It is derived from how your specific hardware and software combination renders a test image, draws 3D graphics, or processes an audio signal, producing a value distinctive enough to identify the same device across unrelated sites.

Browser fingerprinting, the method used to capture such data within a browser session, is attractive to trackers because it is considerably harder to shake off. A private browsing window prevents your machine from keeping a local record of the visit, but it does not change how your hardware renders the test image, so the fingerprint it produces remains largely the same.

Such domains can also cause more direct damage than selling one's information to advertisers. Kaspersky says threat actors embed scripts that bounce visitors onward to fraudulent platforms, adult content, or online casinos. It flags typosquatting as a particularly acute risk, in which a domain differing from a well-known brand by a letter or two can capture mistyped traffic, landing the user on a phishing page or triggering a drive-by download.

This isn't the first time the problem has been reported, either, as recent research from Infoblox finding that in large-scale experiments, over 90% of the time, a visitor to a parked domain was routed to illegal content, scams, scareware, antivirus subscription traps, or malware.

Kaspersky recommends several ways to mitigate the risk, including avoiding suspicious links, clearing cache and cookies after an unintended visit, and using software that blocks web tracking.

Clearing cookies is worth noting, though: it addresses the cookie identifiers Kaspersky mentions, but by the company's own explanation it does nothing about fingerprinting, because there is nothing stored locally to clear.

Parked domains, including blank pages that appear inert, are now a routine part of criminal infrastructure rather than digital litter and should be treated with caution. At best, you give away more information than you meant to. At worst, you become the victim of an attack you never saw coming.

• Cloudflare summary logs a typhoon, two earthquakes, power failures, and thirteen government exam shutdowns
• It also identified a fiber cut, drone damage to an AWS region, and a botched DNSSEC key rollover
• The report's sharpest finding is that Tanzania's accidental power blackout looked almost identical in the data to its deliberate election-day shutdown in 2025

Cloudflare has published its latest account of what recently knocked chunks of the Internet offline, and the list reads like a catalogue of everything that can go wrong at once: a typhoon, two earthquakes a minute apart, a national power failure, ten government shutdowns timed to school exams, a fiber cut, drone damage to a cloud region, and a routine cryptographic key update that briefly made every .de website in the world unreachable.

Drawn from traffic telemetry on Cloudflare Radar, it is a useful reminder that the systems most people treat as a utility are held together by a surprisingly small number of things.

With geopolitics in the Middle East shaping traffic in Iran, the UAE, Iraq and Sudan, Cloudflare found that not only did the former's traffic drop even after a shutdown ended two months ago, but the UAE seems to be one of the most affected by the on-again, off-again US-Iran conflict thanks to two AWS facilities being struck by Iranian drones.

An accidental blackout and a government shutdown look similar from the outside

Cloudflare's insights tend to make for an interesting read on how the connected world functions, often defying expectations about traffic, online activity, and user behavior, with the recent FIFA 2026 World Cup being an excellent place to start.

When it comes to the most severe disruptions, one would turn to Iran's approach, which cut off internet access during its conflict with the US, an engagement that also had ramifications for most of its Gulf neighbors.

Interestingly, Radar began picking up signs of restoration on May 26 2026, ending an 88-day shutdown that had left the country almost entirely offline since February 28, but it never reached peak pre-conflict levels.

By May 27, traffic had returned to 40% of pre-outage levels, consistent with reports that access was being reintroduced selectively. It has since climbed as high as 90% before settling at roughly 59% of pre-shutdown levels, suggesting that more stringent restrictions may be in effect even as the country grapples with a war that threatens to reignite at a moment's notice.

The most consequential item on the list, as a result of the conflict, is ironically the one that does not look like an Internet outage at all. HTTP traffic to AWS me-central-1, the cloud region in the United Arab Emirates, has remained low, matching AWS status reports at the end of April 2026 stating that the region had been damaged by the conflict in the Middle East and could not reliably support customer applications.

This followed earlier reports in March of physical damage to facilities in both the UAE and Bahrain caused by drone strikes, with two UAE facilities directly hit. It also highlights an interesting insight: A cloud region has become the sort of concentrated dependency that a submarine cable used to be, with the added complication of being a physical target that is much easier to locate than an undersea cable.

The longest single disruption came from Super Typhoon Sinlaku, the strongest storm of the 2026 Pacific typhoon season so far, which tracked through the Mariana Islands in mid-April and passed just north of Guam. The island avoided a direct hit, but tropical-storm-force winds knocked out power, disrupted water systems, and took connectivity with them. Traffic from the territory fell as much as 80% below expected levels on April 13 and 14.

Venezuela lost connectivity on June 24 when two major earthquakes struck northern Venezuela within roughly a minute of each other, at Yumare and San Felipe, followed by an aftershock near the coast outside Caracas, coinciding with a fall in traffic visible across Fibex Telecom, which serves an estimated 1.6 million users.

Three days later, a power outage in Tanzania produced a sharp drop in HTTP traffic lasting at least five hours, with Cloudflare drawing parallels to the country's election-related blackout in 2025.

Saint Lucia lost most of its connectivity on June 21 when traffic on Karib Cable's network fell to essentially zero by 21:00 UTC and remained flat for the better part of a day, reportedly due to a fiber cut near the island. Karib Cable is one of the largest providers there, so the loss was registered nationally, with the country's overall traffic falling by around 60% compared with the previous week.

In terms of a self-inflicted wound, Germany takes the cake: On 5 May, DENIC, the registry for the .de domain, performed a DNSSEC key rollover, the routine periodic replacement of the cryptographic keys used to sign a zone's DNS records, and the process began producing invalid signatures.

Because DNSSEC-validating resolvers only trust answers whose signatures match the current published keys, a mismatch is read as evidence of tampering, so resolvers worldwide rejected every .de lookup and returned errors until normal service resumed at 23:15 UTC. To users, it did not appear to be a cryptographic failure. It presented as German websites not loading, email bouncing, and apps timing out. It resulted in global .de query volume going up during the outage rather than down, indicating that users were, as a result, looking for ways to access said sites, amplifying the failure, at least statistically.

Taken together, Cloudflare's insights about the quarter are less a parade of exotic failures than a fairly consistent argument about concentration.

One registry's keys gate an entire national domain for the whole world. One provider carries enough of Saint Lucia's traffic to take the country with it. One cloud region hosts applications that have no idea they are under attack by a drone strike, causing unintended blackouts. The causes are both ordinary and extraordinary. It is the dependencies, however, that are extreme, making the case for redundancies worldwide.