Seven states have reported cyberattacks on their water supply control systems, with some officials suspecting that Iran is behind these actions. According to the New York Times, there isn’t any definitive proof yet that Iran orchestrated these attacks but it said that moves like this have been escalating since the U.S. began its bombing campaign of the country. It was also noted that the attackers made zero financial demands, making it more likely to have been conducted by state actors that aren’t just motivated by money.

Minnesota was the first to report this kind of attack, with Michigan soon saying that it was targeted, too. While there have been no major disruptions that have made tap water unsafe to drink, the authorities across local and state governments are still on the lookout for potential problems. They’re particularly concerned about older computer systems that monitor water quality, adjust chemical treatments, and control water pressure, especially those that are connected to the internet.

Braham, Minnesota, is one of the areas affected by the cyberattacks. The mayor of the small city, which has a population of less than 2,000 people and is located about 50 miles north of Minneapolis, said it has already received guidance on how to resolve the issue and strengthen its defenses against future attacks. It’s currently using manual control to keep the water service on, but its mayor, Nate George, told the publication, “I think the troubling thing on the horizon is how do we move forward to a more secure system. IT infrastructure upgrades are very costly, and we are a very small municipality.”

He also repeated the suspicions that some federal officials had but declined to confirm. “We’re getting bits and pieces of information from the state of Minnesota and the F.B.I. They are pretty sure it’s Iranian actors.”

While states scramble to protect their utilities and other critical infrastructure, the White House has downplayed the suspected state-sponsored cyberattacks. President Donald Trump told a reporter, “I think Minnesota is behind it. I don’t think there was an Iranian cyberattack.”

This isn’t the first time that Iranian hackers have hit a U.S. institution during the 2026 war, but it’s the first time that essential services and infrastructure within the mainland have been affected. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has previously warned about potential Iranian cyberattacks, but smaller municipalities remain vulnerable.

Iran was also once on the receiving end of a cyberattack that many experts link to the U.S. The most famous of these was Stuxnet, which was supposedly used in 2009 to significantly damage and destroy critical tools used by the Iranian nuclear program. More recently, the CanisterWorm malware attacked Iranian machines and wiped them clean for no apparent reason. Again, no one has claimed responsibility for this attack.

Wars have always been fought on land and on sea, and more recently, in the air and in space. But as the internet has become indispensable for society, cyberspace has quickly become a fifth domain that states must protect and dominate. “This is what modern warfare looks like,” Gov. Tim Walz said on X.

• Cyberattack hits operational technology at more than 30 Minnesota community water systems, briefly taking treatment plant offline and forcing several towns onto manual operations
• A leaked WaterISAC memo obtained by WIRED relays a state fusion center assessment tying the intrusions to Iranian-affiliated hackers, but no US agency has formally attributed the attack yet
• The CISA had warned four days earlier that Iranian-affiliated actors were compromising internet-facing PLCs, repeating guidance that has mostly fallen on deaf ears

More than 30 community water systems across Minnesota were hit by a coordinated cyberattack, targeting the operational technology running pumps, wells, water towers, and wastewater lift stations rather than the office networks behind them.

Minnesota IT Services disclosed the attack on July 28 2026 and activated a statewide incident response, stating that it wasn't aware of any Minnesota city asking residents to change their drinking water use just yet.

A memo obtained by Wired, circulated by the water sector information-sharing group WaterISAC and carrying a restricted TLP: AMBER handling marking, relays a Minnesota state fusion center assessment that ties the intrusions to Iranian-affiliated hackers.

A warning that was more or less ignored

Four days before the attacks, CISA updated an advisory, AA26-097A, warning that Iranian-affiliated actors were compromising internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens, and possibly others across the US water, energy, and government sectors. It documented confirmed disruptions and financial losses.

This drew no immediate response from state functionaries, and it is easy to see why: the US has tens of thousands of community water systems that serve small populations and lack budgets for dedicated cybersecurity staff.

This is despite there being a precedent: Iranian-linked actors hit the Municipal Water Authority of Aliquippa in Pennsylvania in November 2023, defacing a Unitronics controller with an anti-Israel message. CISA said at the time those devices were exposed to the internet with default passwords still in place. The advice issued then is the same advice being issued this week, which is telling about how little has changed since.

The WaterISAC memo, dated the day the attacks concluded, passes on a state fusion center report linking the activity to Iranian-affiliated actors. That memo was not meant to be public, but it has been corroborated by The New York Times and The Washington Post, which reported that they spoke to federal officials and US intelligence agencies, respectively, lending credence to the claims.

CISA later warned that attackers are changing PLC passwords to lock operators out of their own equipment, and repeated the advice that has been unchanged for years: get PLCs off the public internet and put remote access behind a VPN or gateway.

Who was affected?

The worst of the cyberattack hit Braham, a town of roughly 1,700 people, where the city said attackers shut down the operating controls, taking the water treatment plant and the well offline. Crews restored it manually within a couple of hours, and residents were told to minimize water use in the meantime.

Plymouth, a Minneapolis suburb of about 80,000, found the problem confined to equipment connected over cellular links at two water towers and several wastewater lift stations. Its IT division disconnected the affected kit from the network entirely to stop the attack and prevent retargeting during reconfiguration.

Maple Plain declared a local state of emergency to manage its response, and South St. Paul reported that some automated controls were compromised. In most cases, contingency procedures held and water and wastewater operations continued.

None of this is happening in a vacuum, however. The June memorandum that paused fighting between the US and Iran has broken down, and both are trading strikes, including recent US attacks near the Strait of Hormuz that destroyed a water facility and cut supply to more than 20,000 people. Whoever carried out the Minnesota attacks, the symbolism of targeting municipal water is unlikely to be accidental.

The damage that these intrusions caused was limited; they produced brief outages that trained staff fixed by hand. That is an outcome with a silver lining, and it depended on utilities having people who knew how to run a treatment plant without its automation, even if its digital defenses collapsed outright.

Planning a summer getaway but worried about leaving your house for a few weeks? While statistically you are more likely to suffer a break-in during the winter months when it’s much darker, summer also presents an ideal opportunity for burglars. Even if you're at home there are increased risks, especially if you leave your windows open to get some fresh air into the house during a heatwave.

Of course, there are basic steps you can take to reduce your risk such as asking a neighbor to take in your mail and packages, and making sure windows are closed when you go out. But technology can help big time too. What’s more, you don’t have to spend a fortune on all the gear. Whereas once you had to spend thousands on security cameras and PVRs (personal video recorders) that had to be professionally installed, now you can buy cameras and video doorbells for a fraction of the price that can be controlled easily via your smartphone.

Starting simple

The trick is to start simple. A good idea if you are going away for a long time is to have an indoor camera focused on the most vulnerable part of the house where a burglar is most likely to break in — such as a back door. I’ve got a Nest Cam IQ Indoor focused on my patio doors leading out to the garden. I like it because it can record when it hears sound (such as glass breaking) as well as motion.

However, there are other cheaper models available from companies such as Amazon-owned Blink and Ring as well as lesser-known, but popular, Chinese brands such as EZVIZ, Reolink and Aqara.

Focused on the front door I have a tiny Blink Mini 2K+ which also provides a chime for the Blink video doorbell so we can hear it ringing in the house. Usually, I switch the motion sensor off on the Blink Mini during the day because it’s triggered every time a family member opens the front door which can be a bit of a pain. However, when I go on holiday I switch the motion sensor on just in case.

One important consideration is how footage is stored — either locally on a MicroSD card or in the cloud. Personally, I prefer storing footage locally on an SD card, although the downside is that you will usually have to buy a card separately. The advantage of local storage is that not only is it generally more secure (there have been cases of servers being hacked and private security footage being leaked), it also often works out cheaper in the long term.

That’s because many home security companies will charge you a monthly subscription fee to store all your recorded footage and access advanced AI-driven features such as facial recognition and text descriptions of videos.

While these features may be vaguely useful, especially if you have lots of people coming to the door, for the vast majority it’s probably not worth the monthly fee.

Let’s go outside

Obviously, no discussion of home security is complete without talking about outdoor cameras and video doorbells. Whether it’s summer or winter, these devices are invaluable when it comes to optimizing your home security set-up and helping to prevent burglary.

Choosing the type of outdoor camera you want is largely down to personal choice and the type of property you live in. Generally speaking, outdoor cameras should be mounted reasonably high on your property to give you a better view and to prevent theft.

Many offer a wide viewing angle of between 130 and 180 degrees, while some of the latest models, such as the latest IMOU AOV PT, are pan-and-tilt models that detect and track movement automatically.

Want a security camera to act as a deterrent to an opportunist burglar? Then it’s worth considering a device with a powerful built-in spotlight and loud siren. If there are two things that burglars hate more than anything else, they're excessive noise and light that draws attention to what they are up to. Reolink’s Solar Floodlight Cam covers both bases with twin spotlights either side of the camera and an integrated 110dB siren.

Going solar

Unlike indoor cameras, which usually plug into the mains, powering an outdoor camera is a little more challenging. Although some are designed to plug into the mains via a waterproof housing, most now rely on either disposable/rechargeable batteries and/or solar power. Indeed, solar-powered cameras, such as the Reolink Solar Floodlight Cam mentioned above, have become increasingly popular in the UK particularly as summers have got hotter and panels have become more efficient.

While many of the latest outdoor cameras comprise separate solar panels that need to be mounted separately and plugged into a USB-C socket on the camera, others such as the IMOU Cell 3C come with a solar panel built in. Chinese company Baseus even has an innovative solar-powered camera, the Baseus Security S2, that boasts an innovative rotating solar panel that moves as the sun moves in order to maximize power to the camera.

Deciding how to power your outdoor camera isn’t the only factor you need to consider either. You also need to think about the technology you are going to use to transmit video clips to your phone’s security camera app. While for indoor cameras this is usually WiFi, for outdoor devices getting a connection between the indoor router and outdoor camera can be more challenging — especially over distances of around 30m.

One option therefore, may be to buy a device that offers dual-connectivity, including Wi-Fi and cellular (usually 4G), such as the IMOU AOV PT or Eufy 4G LTE Cam S330.

Optimizing your setup

So you’ve got your outdoor camera. What next? Well, now begins the process of optimizing it for your security needs. Generally, most outdoor cameras are far too sensitive and record far more footage than you actually need to look at. As a result, you could find your entire time on holiday viewing footage of someone walking past your house, or a car whizzing by, instead of enjoying quality time away.

Not only is this highly annoying, it could really waste battery power — something that's both costly and time-consuming, especially if you have to climb up on a ladder to take the device down to recharge or change the batteries every couple of weeks.

Within the app, it’s therefore a good idea to set the motion detection zones so that the camera only records footage captured on your property and also reduce the sensitivity settings too so the camera isn’t recording too much footage. If you know you are going to be away for a set period of time then it’s probably a good idea to ensure the camera can detect motion 24/7, but when you are home you may want to use the menus so it only records at time of the day when you know family members or flat mates aren’t going to be entering or leaving the property (such as night time).

When it comes to video quality, most outdoor cameras now offer at least 1080p video quality. However, some such as the Baseus Security S2 and the Reolink Altas PT Ultra, offer stunning 4K picture quality. While this is great, especially if you want to zoom in on close ups of a potential suspect, most of the time it’s probably unnecessary. By reducing video quality you will be able to store more footage on the SD card/in the cloud and not consume as much power either.

For night-time monitoring, standard infra-red (IR) night vision provides clear monochrome visibility in total darkness while a colour night-vision option uses advanced low-light sensors or built-in LED spotlights to capture colour details after dark.

Video doorbells — it’s good to talk

Think someone may be intruding on your property while you’re not around? All security cameras that I’ve ever tested (probably over 50 now) feature two-way audio so you can, if you so wish, talk directly to the intruder to tell him or her to get off your land. And they can also talk back to you, of course, using the built-in microphone.

Some of the latest models even generate automated messages or use different voices so the person doesn’t actually know who they are talking to (for example the Aqara G100 indoor/outdoor security camera lets you turn your voice into that of a robot or clown.) It’s a feature that some women and teens in particular might find reassuring, especially if they don’t want a man to think they are at home by themselves — though I can’t help thinking of Kevin McCallister in the film Home Alone.

Essentially video doorbells take the technology one step further by enabling you to speak directly to people who press the button, even if you are sitting on beach sipping a strawberry daiquiri on your summer vacation (as with the G100, Aqara’s G410 Doorbell Camera Hub also allows you to disguise your voice). Invented by Ring’s founder Jamie Siminoff back in 2013, video doorbells have really taken off in the last few years with most home security manufacturers now producing models.

Usefully, not only do video doorbells enable you to talk to whoever comes to the door as if you were at home, they can also be set up to detect and record nearby movement just like standard outdoor security cameras. The only real difference is that, whereas outdoor security cameras often have a wide viewing angle and wide aspect ratio, video doorbells tend to offer a much squarer field of view — often 1:1 — so you can see whoever is at the door more clearly.

Advanced functionality

For those looking to replace their traditional doorbell, video doorbells are a great solution. With many models, it’s even possible to use existing doorbell wiring to power them, rather than having to rely on disposable or rechargeable batteries. Many come with separate plug-in chimes so you can hear the doorbell clearly inside the house with a choice of customizable ‘ringtones’, ranging from classical music to Christmas carols.

That’s not to say that video doorbells are the perfect security solution for everyone. They’re not. Often, I’ve found there is quite a lag when you are talking to someone and if you live on a busy street it can be difficult to hear what they are saying. To counter this, some models, including those from Ring, enable you to play automated responses to the visitor, a bit like an old-fashioned answerphone — for example, ‘please leave the parcel outside’ or ‘call back in an hour’s time’.

Another issue is that with subscription services such as Ring Pro you can spend up to $19.99 / £15.99 a month on premium features such as person, package and vehicle alerts, video descriptions and 180 day video playback. At least with a Blink video doorbell it’s possible to store clips on the Blink Sync Module 2 hub using a separate USB drive while the TP Link Tapo D235 is one of the few doorbells with integrated MicroSD storage (it also offers free AI smart detection to distinguish between vehicles, pets and people).

Complete security solutions

Looking for a more advanced security solution for when you go away over the summer? Most manufacturers will allow you to view several cameras via their app. However, if you want to put different types of security devices together — such as locks, lights and a burglar alarm — then you will need a more advanced setup.

For example, one advantage of the Aqara G410 video doorbell is that it’s actually a fully-fledged smart home hub with a built-in Matter bridge and Thread border router that can be used as part of a smart home ecosystem such as Apple HomeKit, Google Home, Amazon Alexa and Smart Things.

Owned by Amazon, Ring products including cameras, video doorbells and burglar alarms can easily be controlled using Alexa routines with footage viewable via Echo Show devices. Furthermore, Ring Alarm also supports certified third-party products via the encrypted Z-Wave network, including smart locks from Yale, Schlage and Kwikset. This means you can lock/unlock doors, manage guest PIN codes and trigger automated security routines (such as arming the alarm when the door is locked) all inside the Ring app.

Securing your home for summer

With the summer holiday season well and truly upon us, and houses left empty as we down tools for a well needed break, now is the time to think about securing your home. While traditional precautions — such as securing windows, clearing letterboxes and locking away garden tools (including ladders) — remain essential precautions, modern technology can help too.

Protecting your home against burglary needn’t cost the earth either. You can now buy indoor cameras focused on vulnerable parts of the house for less than $70 / £50 while most outdoor cameras and video doorbells cost between $120 / £100 and $250 / £200. And while subscription charges do push up prices, often these aren’t necessary — especially if you can store footage locally on an SD card or USB drive.

Ultimately, combining the latest tech solutions with solid physical security will give you the peace of mind needed for you to truly unwind, ensuring your home remains a well-guarded fortress while you enjoy your break.

• Instructions hidden as white text in a Word document can make Microsoft 365 Copilot silently alter the file it is drafting and copy the instructions into the output
• Each poisoned document becomes a carrier, so the attack spreads through ordinary internal workflows without the original malicious file and needs no macros, malware, or code execution
• Microsoft has shipped two mitigations across a 144-day disclosure, including a model upgrade, and the attack was still reproducible by the researcher

A security researcher has published a proof of concept showing that instructions hidden inside a Word document can cause Microsoft 365 Copilot to silently alter the file it is drafting, then copy those same instructions into the finished document, so the next person to use it becomes a carrier too.

Håkon Måløy, a data scientist with a doctorate in applied machine learning, disclosed the technique as the third installment of his Context Collapse series, after a 144-day coordinated disclosure with the Microsoft Security Response Center.

The reason this is being reported ahead of a fix is that it still works despite multiple attempts by Microsoft, as he notes that no robust mitigation for the broader vulnerability class is currently available.

A clever attack designed around Copilot's approach to text

The underlying attack belongs to a family known as cross-domain prompt injection, or XPIA. An attacker writes instructions in a natural-language document, formats them as white text on a white background at a small point size, and shares the file.

Because Copilot for Word strips formatting before passing text to the underlying language model, the model reads text the human never sees. This is true even for documents that are not opened by the user on purpose: The attack can trigger either when a user manually attaches a document to Copilot or when Copilot, working in Work IQ mode, searches the user's OneDrive for relevant files and finds the malicious one on its own.

It is also more dangerous than other exploits because of one key element: propagation. The hidden prompt in Måløy's proof of concept had two parts. One instructed Copilot to alter the document being drafted, in his demonstration halving every financial figure in a quarterly report.

The other instructed Copilot to copy the prompt into the new document and conceal it, framed innocuously as source tracking and readability formatting. Copilot did both, appending the instructions in white text and mentioning neither action to the user.

The disclosure timeline is the most uncomfortable part of the report. Måløy reported to MSRC on March 6 2026. Microsoft confirmed the behavior on March 31 and shipped a first mitigation in early April via a reworked Edit with Copilot experience, which successfully blocked his original prompt wording. He reproduced the attack with different wording the same week, and a second case was opened.

The second fix, on July 14, consisted of upgrading the underlying model to GPT-5.5. Måløy broke it the following day using GPT-5.6, then voluntarily offered Microsoft a further two-week delay to attempt another mitigation. The class still reproduced on the disclosure date, indicating that although a fix is in the works, the exploit is still possible to run.

A complicated issue that lacks a proper resolution

The issue goes far beyond Microsoft Word: an AI assistant must ingest untrusted content to determine whether it is relevant or hostile. But the content enters the same context window as the system prompt and the user's actual request, so by the time the model evaluates whether the text is an attack, the attacker's tokens have already shaped that evaluation.

As Måløy puts it, "the content being inspected participates in the act of inspection."

Microsoft confirmed it had reviewed the findings in a statement to The Register but stopped short of indicating a timeline for a complete fix:

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure," the company said.

"To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests. We are continuously strengthening these safeguards as the technology and threat landscape evolve. We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”

Måløy's recommendations are to treat externally sourced documents as untrusted when using them with Copilot, review attachments before starting an AI-assisted draft, and review Copilot's output carefully before sharing or reusing it.

He also suggested that generated documents should carry provenance metadata that records source material and model edits, which would not prevent injection but would make an infection traceable after the fact.

With Copilot extending further into agentic products that create and manipulate documents with less human oversight, the scope of how exploits like this could affect workflows (and users) will widen rather than narrow, and a complete solution is not yet in sight.

• Kaspersky says empty web pages are watching you, and the research backs up the warning
• Over 90% of parked domains now send visitors somewhere malicious, and clearing your cookies will not help
• Blank pages are also a problem: many 'Coming Soon' placeholders are quietly fingerprinting your device

Kaspersky has unveiled a rather underreported attack vector which is increasingly being used by threat actors to harvest private data from unsuspecting victims: registered websites that are yet to be developed.

Its warning focuses on parked domains, the registered web addresses that have no real website behind them yet, arguing that the blank screens and "Coming Soon" placeholders users dismiss as harmless are frequently doing work in the background.

The company says simply loading one of these pages can trigger silent collection of a visitor's IP address, approximate location, User-Agent string and cookie identifiers, and that operators go further by building browser fingerprints through other techniques, then feeding the result into advertising networks to assemble targeted profiles without consent from users.

Browser fingerprinting sans the permissions

The mechanics Kaspersky describes are worth understanding, because fingerprinting is the part most readers will not have encountered, and the part that conventional privacy habits do not touch.

For context, a cookie is a file placed on your machine that you can delete, thereby limiting tracking. A fingerprint is not stored on your machine at all. It is derived from how your specific hardware and software combination renders a test image, draws 3D graphics, or processes an audio signal, producing a value distinctive enough to identify the same device across unrelated sites.

Browser fingerprinting, the method used to capture such data within a browser session, is attractive to trackers because it is considerably harder to shake off. A private browsing window prevents your machine from keeping a local record of the visit, but it does not change how your hardware renders the test image, so the fingerprint it produces remains largely the same.

Such domains can also cause more direct damage than selling one's information to advertisers. Kaspersky says threat actors embed scripts that bounce visitors onward to fraudulent platforms, adult content, or online casinos. It flags typosquatting as a particularly acute risk, in which a domain differing from a well-known brand by a letter or two can capture mistyped traffic, landing the user on a phishing page or triggering a drive-by download.

This isn't the first time the problem has been reported, either, as recent research from Infoblox finding that in large-scale experiments, over 90% of the time, a visitor to a parked domain was routed to illegal content, scams, scareware, antivirus subscription traps, or malware.

Kaspersky recommends several ways to mitigate the risk, including avoiding suspicious links, clearing cache and cookies after an unintended visit, and using software that blocks web tracking.

Clearing cookies is worth noting, though: it addresses the cookie identifiers Kaspersky mentions, but by the company's own explanation it does nothing about fingerprinting, because there is nothing stored locally to clear.

Parked domains, including blank pages that appear inert, are now a routine part of criminal infrastructure rather than digital litter and should be treated with caution. At best, you give away more information than you meant to. At worst, you become the victim of an attack you never saw coming.