South Carolina launched a new program for rural hospitals, and EPA continued helping water utilities find and fix security gaps. Meanwhile, ransomware disrupted municipal services, hospital systems faced outages, and researchers uncovered attacks against government networks.
The electric sector also saw $5.1 billion in federal financing and new proposals for managing large data-center loads. A breaking Reuters investigation raised concerns about suspected attacks on refrigeration systems at U.S. military bases
October 22 | NIST Updates Guidance on Measuring Cyber Risk
NIST released a draft update to SP 800-221, its guidance for measuring cyber risk alongside financial and operational risks.
The update covers IT, industrial control systems, connected devices, and third-party technology. Public comments are open through December 7.
Why it matters: Last week's attack on an Idaho school reached door locks, cameras, and climate controls. This week, we'll see more examples of everyday systems becoming part of a cyber incident. A vulnerability might carry the same technical score whether it's on an office computer or a controller operating a water treatment process, but the consequences aren't remotely the same. NIST's guidance is an opportunity to make sure those real-world consequences are reflected in how organizations measure and prioritize risk.
October 22 | CISA Releases 20 Industrial Security Advisories
CISA published 20 advisories covering industrial equipment and software, including Siemens S7 controllers, WinCC, RUGGEDCOM, and building automation systems.
The agency also corrected an earlier notice that incorrectly claimed 20 vulnerabilities had been added to its Known Exploited Vulnerabilities (KEV) Catalog. The advisory release didn't add any vulnerabilities to KEV.
Why it matters: Attackers were already attempting to exploit PHP2Shell on October 17, four days before patches were available. According to VulnCheck's latest research, nearly one in four known exploited vulnerabilities in the first half of 2026 showed evidence of exploitation before or on the day they were publicly disclosed.
Now we're seeing industrial vendors identify affected products and researchers report attacks involving government systems. The problem isn't just how quickly operators can patch. It's that attackers may have had access before anyone even knew what needed fixing. Installing an update doesn't tell you whether someone was already inside. That's why investigating activity before the disclosure date matters just as much as applying the patch.
October 22 | University Hospitals Disconnects Systems After Suspicious Activity
University Hospitals in Ohio disconnected systems from the internet after detecting unusual server activity.
The shutdown took MyChart offline and disrupted some administrative services. Most appointments and procedures continued, but patients still couldn't access MyChart as of October 28. The hospital hadn't confirmed ransomware or disclosed the cause.
Why it matters: Last week, Parkview Health in Indiana took network services offline after detecting suspicious activity. Now University Hospitals has done the same. Neither case required a confirmed ransomware attack for patients to lose access to important services. Add UNM Health's ambulance diversions later this week, and we're seeing three hospital incidents with different operational consequences. The question isn't just whether a hospital's systems were breached. It's which services have to stop when the network is disconnected, and whether staff can keep treating patients without them.
October 23 | Columbia Confirms Ransomware Attack on City Systems
Columbia, South Carolina, confirmed ransomware was behind its October 20 network disruption.
Several public applications remained offline, including MyColaSC, park reservations, and geographic information systems. Police, fire, 911, Columbia Water, and utility payments continued operating.
Why it matters: Last week, Bernalillo, New Mexico, was still recovering from an attack that shut down municipal services and forced its Motor Vehicle Division to close. Now Columbia is dealing with ransomware. Neither incident established a compromise of water operations, but both affected services residents use every day. Municipal networks often support billing, licensing, records, and public communication alongside more critical functions. Water and emergency services continuing to operate is good news, but it doesn't mean the city avoided an operational disruption. These incidents show why cities need to plan for the loss of ordinary government systems, not just attacks on utilities.
October 23 | Siemens and ABB Flag Industrial Products Affected by PHP2Shell
Industrial vendors issued advisories following the disclosure of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619.
Siemens identified affected RUGGEDCOM APE1808 configurations, while ABB published advisories covering industrial software used in manufacturing and process control.
The flaws can allow attackers to run code remotely on affected systems.
Why it matters: When PHP2Shell first appeared in last week's roundup, the obvious concern was exposed websites and web servers. Now Siemens and ABB are identifying affected industrial products. A facility might not run PHP on its own servers but could still have it inside a firewall, industrial application, or management device. The attack surface doesn't stop at software an IT team knowingly installed. It also includes components supplied as part of larger industrial systems.
October 26 | White House Launches Project Lifeline 250 for Rural Hospitals
South Carolina and the White House launched Project Lifeline 250, a six-month pilot providing cyber support to participating rural hospitals at no cost.
The program will help defend hospital networks, replace high-risk equipment, and provide physical backup devices so hospitals can continue critical care after an incident.
It's modeled on Project Watershed 250, which focuses on water infrastructure in Texas.
Why it matters: In the past two weeks, Parkview Health, University Hospitals, and UNM Health have all had to restrict services or take systems offline while responding to suspected threats. That makes Lifeline 250 particularly timely. The program isn't just trying to keep attackers out. It's also giving smaller hospitals equipment to continue treating patients when their normal systems aren't available. The government is taking a model already being tested in water infrastructure and applying it to healthcare, where a network outage can quickly become a patient-care problem.
October 26 | UNM Health Diverts Ambulances During Network Incident
The University of New Mexico Health Sciences Center diverted ambulances for two hours on October 26 while responding to a cyber threat.
Outpatient surgeries and appointments were also suspended. Investigators said some end-user devices were affected, but core servers weren't penetrated. Normal ambulance operations resumed October 27, and clinical services were restored by October 28.
Why it matters: Compare this to University Hospitals in Ohio. Both organizations disconnected systems while investigating threats, but UNM had to divert ambulances to other hospitals. Even without a confirmed compromise of core servers, the response affected where emergency patients could receive care. That's a problem extending beyond one hospital's network. An incident at one facility can place additional pressure on neighboring providers, which means hospitals need to coordinate patient transfers and emergency coverage before an outage forces those decisions.
October 26 | Researchers Find Attack Chain That Compromised 25 Servers
Dream Research reported evidence of an attack campaign involving 25 compromised servers, including systems associated with a U.S. government environment.
Attackers reportedly combined PHP2Shell with a Linux kernel flaw to gain root access to exposed firewalls. Recovered evidence showed access to internal management systems, stolen credentials, and Active Directory reconnaissance.
The firewall vendor wasn't publicly identified.
Why it matters: We've now gone from last week's PHP2Shell disclosure to industrial vendor advisories and a reported compromise involving government systems. The researchers say attackers didn't stop after breaking into the firewalls. They used that access to reach internal systems and collect credentials.
Installing an update fixes the entry point, but it doesn't remove accounts or access the attacker obtained afterward. Anyone investigating exposure needs to determine what happened during the vulnerable period, not just whether the current software version is patched.
October 26 | CISA Releases New National Cyber Defense Strategy
CISA announced its CISA 2030 strategy, called Defend, Harden, Prevail.
The agency wants to place greater emphasis on stopping attackers from gaining and maintaining access to critical networks, particularly systems supporting essential services.
CISA plans to produce an implementation plan within 180 days.
Why it matters: Look at the attacks we've covered recently. ConnectWise credentials were used to reach customer environments, PHP2Shell was reportedly chained with other flaws to gain deeper access, and Volt Typhoon has been targeting central management systems. The recurring problem isn't simply attackers finding a way in. It's what they can reach and how long they can remain undetected once they're there. CISA's strategy is moving toward that problem. What remains to be seen is whether the implementation plan brings operators more practical hunting, investigation, and technical support, rather than another set of recommendations.
October 27 | NERC Adopts Reliability Standards for Large Data-Center Loads
NERC adopted new reliability standards addressing the growth of data centers and other large electricity consumers.
The Board approved the standards October 26. They'll still need FERC approval before becoming enforceable in the United States.
Why it matters: This week's $5.1 billion DOE financing and California ISO's proposed data-center connection rules are two sides of the same problem. The country is investing in more electricity generation while adding facilities that can consume enormous amounts of power. Building capacity is only half the equation. Grid operators also need to understand how these large customers behave and what happens when their demand suddenly changes. As more of that coordination depends on connected control and communication systems, protecting the accuracy of the information those systems exchange becomes part of maintaining grid reliability.
October 28 | EPA Continues Cyber Support for Water and Wastewater Utilities
EPA held three water-sector training sessions during the week. The October 22 session covered IT and OT access controls. On October 27, EPA demonstrated its Water Cybersecurity Assessment Tool, followed by October 28 training on evaluating security vendors.
The agency also offers free assessments and technical assistance to water and wastewater systems.
Why it matters: EPA's earlier findings explain why this support is needed. In 2024, its Inspector General identified 97 drinking-water systems with critical or high-risk vulnerabilities, serving roughly 26.6 million people. In 2025, EPA found weaknesses at 277 systems and reported eliminating 350 vulnerabilities.
Now EPA is helping utilities assess their systems and evaluate the vendors they rely on. For smaller water departments that don't have dedicated cyber staff, the important question is whether those findings turn into fixes rather than another assessment that sits on a shelf.
October 28 | Cyber Incident Takes FEC Filing System Offline for 41 Hours
The Federal Election Commission restored its electronic filing system on October 28 after nearly 41 hours offline.
The agency suspended access following an attempted intrusion. Political organizations couldn't file required spending disclosures during the interruption, just days before the November 3 midterm elections.
The FEC hadn't confirmed a successful breach, and voting systems weren't affected.
Why it matters: Columbia, Bernalillo, and now the FEC have all faced service disruptions tied to cyber incidents, but the FEC's timing made its outage particularly consequential. Its reporting system went down during a period when spending disclosures had strict deadlines and immediate public relevance. Even without a confirmed breach, the shutdown prevented filings and delayed access to information. Protecting a system sometimes means disconnecting it, but agencies with statutory deadlines need an alternative way to carry out those duties when their primary platforms are unavailable.
October 28 | DOE Closes $5.1 Billion in Electric Generation Financing
The Department of Energy closed a $5.1 billion loan package for Alliant Energy, funding new and upgraded power generation across Iowa and Wisconsin.
The projects will add more than 2.6 gigawatts of capacity through natural gas plants, battery storage, and upgrades to existing facilities. DOE projects more than $1 billion in electricity cost savings.
Why it matters: We're spending billions building more power capacity at the same time NERC and California ISO are developing new ways to manage growing demand. That's a lot of infrastructure being built, upgraded, and connected. Every new generating facility or battery installation brings control systems, remote maintenance connections, and equipment that will remain in service for years.
The financing isn't a cyber grant, but protecting these assets needs to be part of the investment from the beginning. It's far easier to specify secure remote access, network separation, and monitoring when buying equipment than to rebuild those protections after the plant is operating.
October 28 | California ISO Advances New Rules for Connecting Data Centers to the Grid
California ISO approved a proposal to speed up connections for data centers and other large electricity users.
The proposal includes better load forecasts, operating data, and communication systems that would let grid operators coordinate remote disconnection of major loads when needed for reliability.
It's scheduled for submission to FERC by November 16.
Why it matters: NERC's new standards and California ISO's proposal show how quickly the grid is adapting to data-center demand. California isn't just discussing how to connect these facilities. It's proposing systems that could allow large loads to be disconnected remotely when grid conditions require it.
That creates a security question alongside the reliability question: who can issue those commands, how are they verified, and what happens if the communications are compromised? These requirements are still proposed, which makes this the point to address those questions rather than after the connections are built.
October 28 | CISA Flags Exploited Linux and VMware Vulnerabilities
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog.
CVE-2026-46300 affects the Linux kernel and can help attackers gain higher privileges. It also appeared in the PHP2Shell attack chain reported earlier in the week.
CVE-2026-41709 affects VMware ESX and can allow certain administrative activity to go unlogged.
Why it matters: Remember CISA's correction on October 22, when it clarified that its industrial advisories weren't additions to the exploited-vulnerability catalog? These two listings are different. They come with evidence of exploitation.
The Linux flaw also connects directly to the PHP2Shell campaign reported this week, where attackers reportedly chained vulnerabilities to gain root access. VMware presents a separate problem: an attacker may be able to operate without leaving expected logs. Together, these cases show why responders need to look beyond individual patches and understand both how attackers gain control and what evidence survives afterward.
October 28 | Volt Typhoon Used Hidden Network to Target Critical Infrastructure
Lumen's Black Lotus Labs published research on Silent Train, a covert attack network attributed to China's Volt Typhoon group.
Researchers found that the group used compromised routers and other internet-connected devices to hide its activity. They identified four zero-day exploitation campaigns targeting centralized network and endpoint management platforms.
Why it matters: Last week's ConnectWise incident showed how attackers could use access granted to a trusted service provider to reach multiple customer environments. Volt Typhoon's methods raise a related concern: compromising a central management platform can give attackers access to many systems without having to break into each one separately.
Silent Train also rotated the compromised devices used to conceal those attacks, making fixed lists of malicious IP addresses less useful. The assets deserving the most attention are the management systems with broad permissions and the independent logs needed to investigate their activity if they're compromised.
October 29 | Pentagon Investigates Suspected Attacks on Freezers at U.S. Military Bases
Breaking update published October 29, after the regular Wednesday cutoff.
Reuters reported that the Pentagon is investigating suspected cyber sabotage following refrigeration failures at commissaries on at least six U.S. military bases in August.
At Fort Huachuca, Arizona, freezer controls reportedly switched into defrost mode overnight, spoiling stored food.
U.S. investigators are working with French authorities after a separate confirmed attack manipulated refrigeration controls at more than 350 commercial establishments in France earlier this month. Some French units reportedly became hot enough to catch fire.
The Pentagon hasn't confirmed that the American failures were caused by hackers or established a connection to the French incidents.
Why it matters: We've all opened the fridge, found spoiled milk, and thrown it out. You buy another carton and move on. But what happens when someone can change the temperature of hundreds of commercial refrigerators remotely?
Last week, we covered attackers manipulating refrigeration systems at French supermarkets. Now the Pentagon is investigating similar equipment failures at U.S. military bases. We don't yet know whether the American incidents were cyberattacks or whether they're connected to what happened in France.
When we talk about OT security, we think of power plants, water treatment facilities, and factories. We don't immediately think about the freezers behind a grocery aisle or the cold storage at a military commissary. Yet those systems can be connected to the internet too.
That's the bigger issue. Organizations need to understand what equipment is connected, who can access it remotely, and whether anyone would notice if the controls were changed. A compromised freezer might sound insignificant compared with an electric grid, until hundreds of stores lose their food inventory overnight.
That's it for this week.
We'll be back next Thursday with the next Weekly Roundup.
