CrunchAtlasCISA expanded warnings about actively exploited vulnerabilities and introduced new incident reporting capabilities. France attributed destructive refrigeration attacks to Iranian-linked hackers, while DOE tested cyberattack response on an operational power grid. Massachusetts also awarded more than $108 million for wastewater infrastructure, and new federal programs opened opportunities for energy technology developers.
November 10 | CISA Expands Exploited Vulnerability Warnings Across Security and Remote Access Systems
CISA added 11 vulnerabilities to its Known Exploited Vulnerabilities catalog between November 6 and 10, including flaws affecting SonicWall, Cisco, Barracuda, and other widely used products.
Among them was CVE-2026-19868, affecting SonicWall SonicOS SSLVPN. Under certain configurations, attackers possessing valid credentials for an alternate authentication method could bypass SAML authentication controls, potentially including multifactor authentication.
On November 10, CISA added six more exploited vulnerabilities, including two affecting Barracuda products. Barracuda confirmed exploitation affecting a small number of organizations. When combined, CVE-2026-116606 and CVE-2026-111560 could allow attackers to bypass authorization and obtain root access if an affected device's administrative interface is reachable.
Why it matters: The 2024 exploitation of Ivanti VPN appliances is a prime example of why compromised infrastructure requires more than just installing a patch. With this week's SonicWall and Barracuda vulnerabilities, affected operators should establish whether their VPN configurations or appliance administration interfaces were exposed, review access logs, configuration changes, and downstream connections during the vulnerable period. Patching closes a known weakness but doesn't show whether an attacker already gained access.
November 9 | France Attributes Destructive Refrigeration Attacks to Iranian Cyber Unit
France's national cybersecurity agency, ANSSI, attributed the October refrigeration attacks to Shahid Kaveh, an offensive cyber unit affiliated with Iran's Islamic Revolutionary Guard Corps.
The October 11–12 attacks targeted refrigeration controllers at approximately 700 French retail sites. Attackers modified defrost settings to high temperatures, causing food losses and at least 15 reported fires.
ANSSI also disclosed that the campaign targeted Schneider Electric equipment at several small hydroelectric facilities, with more limited effects on the equipment.
Why it matters: In 2023, Iranian-linked hackers compromised Unitronics controllers at U.S. water facilities through internet-exposed devices using default passwords. France's attacks involved a different identified group, but both campaigns targeted industrial equipment at distributed facilities. This week's findings also connect refrigeration sabotage with the targeting of hydroelectric infrastructure. Operators should check controller exposure, authentication settings, and whether unauthorized operating changes would be detected before equipment is damaged.
November 9 | DOE Tests Cyberattack Response on a Live, Isolated Power Grid
The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response released details about its Liberty Eclipse exercise on Plum Island, New York.
Unlike conventional tabletop exercises, Liberty Eclipse uses an energized, isolated electrical grid where utility teams can practice responding to cyberattacks without affecting mainland infrastructure.
Participants worked through scenarios involving ransomware at substations and compromised protective relays. Teams coordinated across control rooms, threat-hunting personnel, and incident command structures while managing simulated attacks against operating equipment.
Why it matters: The 2015 Ukraine power grid attack left approximately 225,000 customers without power, forcing crews to restore service manually. A November 5 Berkeley Lab study surveyed customers of 18 rural electric cooperatives and estimated that a single 24-hour outage costs the average business customer about $15,106. That's an estimated loss per affected business, not the utility's total outage cost. Liberty Eclipse tests whether utilities can isolate compromised equipment and restore power before outages cause prolonged disruption.
November 9 | Massachusetts Awards $108 Million for Municipal Wastewater Infrastructure
The Massachusetts Clean Water Trust announced $108.1 million in grants, provided through loan forgiveness, for 46 wastewater infrastructure projects across 35 communities.
The awards support approximately $716.8 million in total project costs, helping municipalities modernize wastewater infrastructure while reducing costs for local ratepayers.
The funding comes through the state's existing water infrastructure financing programs and isn't specifically designated for cybersecurity improvements.
Why it matters: EPA already allows certain cybersecurity expenses under the Clean Water State Revolving Fund for publicly owned wastewater treatment facilities. That doesn't mean municipalities can redirect these awards toward cybersecurity. Communities upgrading SCADA systems, PLCs, or supporting networks should determine whether remote access protections, segmentation, and monitoring qualify within their approved project scope before finalizing engineering plans and procurement.
The $108.1 million has already been awarded. There's no new application round for those funds.
November 9 | CISA Updates Cyber Incident Reporting to Capture More Detailed Attack Evidence
CISA introduced an enhanced cyber incident reporting form designed to collect more consistent information about malicious activity.
The updated form requests more detail about malware, social engineering, hacking techniques, and insider threats. It also incorporates MITRE ATT&CK terminology to help investigators compare attacker behavior across incidents and identify potentially related campaigns.
The form's introduction doesn't create new reporting requirements for private utilities. CISA continues to encourage voluntary reporting outside existing mandatory requirements.
Why it matters: CISA's 2024 Volt Typhoon advisory documented attackers using legitimate credentials and administrative tools to maintain access to U.S. critical infrastructure networks. Those techniques can look like normal activity without supporting evidence. CISA's updated reporting process puts greater emphasis on what attackers actually did. Operators should preserve authentication records, internal connections, timestamps, and observed behavior so investigators can distinguish isolated incidents from a larger campaign.
November 5 | Federal Agencies Warn of Ongoing Attacks on Industrial Refrigeration
CISA, the FBI, and three other federal agencies issued a joint warning about malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems.
Attackers are targeting unpatched or internet-accessible refrigeration controllers used by grocery stores, cold-storage facilities, and industrial operators. Exploitation can allow unauthorized temperature changes, including continuous heating and defrost cycles that damage equipment or spoil inventory.
The warning also identifies risks to healthcare, chemical facilities, food production, and transportation. Federal agencies recommended removing unnecessary internet exposure, securing remote access, and updating affected systems.
Why it matters: October's refrigeration attacks in France caused widespread food losses and fires, while Censys identified thousands of internet-exposed refrigeration management interfaces. Exposure doesn't mean every controller was compromised, but it identifies systems attackers could potentially reach. Hospitals, food distributors, and cold-storage operators should identify remotely accessible controllers, check who can change temperature settings, and verify that independent alarms can detect unauthorized changes even when the management system can't be trusted.
November 5 | DOE Opens More Than $10 Million in Energy Technology Commercialization Support
The Department of Energy announced three new voucher opportunities offering more than $10 million in technical and commercialization assistance to eligible U.S. companies and public authorities.
Administered through EnergyWerx, the opportunities cover three areas:
Pre-Demonstration Commercialization Support (VO-1): Helps eligible companies prepare advanced energy technologies for market through feasibility studies, manufacturing assessments, and commercialization planning.
Performance Validation, Modeling, and Certification Support (VO-2): Provides independent testing, performance validation, modeling, and certification-related services.
Energy Infrastructure Siting and Permitting Support (VO-3): Helps eligible public authorities address permitting and siting challenges for advanced energy projects.
The program provides in-kind services rather than unrestricted cash grants. Applications close December 16, 2026, at 3:00 PM ET.
Why it matters: DOE's October SBIR/STTR announcement supports early-stage technology development, while its September SENTRY awards funded specific energy security projects. These vouchers help eligible technologies move toward commercial deployment through testing and specialized support. Developers moving beyond pilots should check which services they qualify for before the December 16 deadline. This isn't unrestricted cybersecurity funding.
That's it for this week. We'll be back next Thursday with the next Weekly Roundup.
