The report details multiple cyber incidents and vulnerabilities discovered in late July 2026. A coordinated attack disrupted over 30 water utilities in Minnesota, affecting industrial control systems but not water safety. An Indian bank disclosed an email compromise leaking internal data, while a US biotech firm suffered cloud environment breaches exposing corporate and patient information. Angola's largest telecom provider experienced network outages due to cyberattacks. Several critical vulnerabilities were patched in Cisco Secure Firewall Management Center (CVE-2026-20316), VMware products (including CVE-2026-59309 and CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077), and Rails Active Storage (CVE-2026-66066). Phishing campaigns exploiting Microsoft authentication and supply chain attacks on npm packages were also profiled. The report highlights the persistent threat to critical infrastructure, cloud services, and software supply chains.

The coordinated cyberattacks on Minnesota water utilities caused brief operational disruptions to treatment plants and industrial control systems but did not affect drinking water safety. The Indian bank's email compromise exposed sensitive internal communications and customer data, though core banking systems remained intact. The biotech company's cloud breach led to exfiltration of proprietary and patient health data without disrupting manufacturing or product supply. Angola's telecom attack disrupted voice, data, internet, and electronic payment services for millions. Critical vulnerabilities in major software products could allow unauthorized access, code execution, and privilege escalation if exploited. Phishing and supply chain attacks facilitated credential theft and malware deployment, increasing risk to targeted organizations.

Patches and hotfixes have been released for the critical vulnerabilities in Cisco Secure Firewall Management Center, VMware products, JetBrains TeamCity, and Rails Active Storage. Organizations using these products should apply the updates promptly. The water utility incidents highlight the need for enhanced monitoring and incident response for industrial control systems. The Indian bank and biotech company should review and strengthen email security and cloud environment protections. Microsoft users should be aware of phishing campaigns abusing legitimate login flows and apply recommended security controls. Supply chain risks from npm packages require careful dependency management and verification. No vendor advisories indicate that these vulnerabilities are unpatched or mitigated without action. Patch status for the water utility attacks is not applicable as these are incidents, not software flaws.