Cybersecurity Roundup: Major Incidents and Emerging Threats Recent weeks have seen a surge in high-profile cybersecurity incidents, vulnerabilities, and warnings across critical infrastructure, AI systems, and enterprise software. UK Power Plant Hit by Iran-Linked Hackers A previously unidentified UK power plant was disabled for four days in what The Telegraph called "the most successful cyberattack of its kind against UK energy infrastructure." While the outage did not disrupt the national grid, the government has issued warnings to power companies, framing the attack as a demonstration of Iran-linked hackers' capabilities. The incident underscores growing threats to energy sector resilience. Zero-Click AI Chat Data Theft via Cryptographic Exploit Security researcher Rony Utevsky of Adversa revealed a novel attack technique that bypasses AI safety filters by embedding malicious instructions in AES-encrypted data. Demonstrated against Grok and Gemini, the exploit allows threat actors to steal chat histories without user interaction in Grok and generate restricted content in Gemini. The method exploits gaps in how AI models process encrypted inputs, highlighting vulnerabilities in production AI systems. OpenAI Warns of Persistent AI-Driven Cyber Threats Chris Lehane, OpenAI’s chief global affairs officer, cautioned that advanced AI models are increasingly capable of launching "ongoing, persistent cyber-attacks," with offensive capabilities outpacing defensive measures. The warning follows OpenAI’s decision to pause development of its most advanced internal models amid safety concerns. Lehane reiterated calls for U.S. government regulation to address frontier AI risks. Canada’s SickKids Hospital Suffers Second Cyberattack Toronto’s Hospital for Sick Children, Canada’s largest pediatric health center, experienced a data breach exposing current and former employees' personal information. The incident, linked to a third-party software vulnerability, follows a 2022 ransomware attack. While no clinical systems or patient data were compromised, the breach raises concerns about third-party supply chain risks in healthcare. Critical Flaws in Cisco Secure Workload Software Cisco disclosed four high-severity vulnerabilities in its Secure Workload (formerly Tetration) micro-segmentation tool, including two CVSS 10.0 flaws (CVE-2026-20315, CVE-2026-20317) tied to improper access control. Additional vulnerabilities (CVE-2026-20231, CVE-2026-20318) involve input validation and neutralization issues. While SaaS fixes are available, users must manually upgrade Agent and Connector tools to mitigate risks. Congress Probes CISA Staffing Cuts Democratic lawmakers, led by Rep. Bennie Thompson, have requested a Government Accountability Office (GAO) investigation into how staffing reductions nearly one-third of CISA’s workforce impact the agency’s ability to protect critical infrastructure. The inquiry reflects growing concerns over resource constraints in federal cybersecurity efforts. Leaked AWS Keys Grant Full Corporate Account Control Researchers at Truffle Security identified over 9,300 active and valid AWS access keys exposed between 2022 and 2026, including 526 root keys and 242 admin-level IAM keys. The findings underscore persistent risks from misconfigured cloud credentials, with many keys linked to high-privilege accounts capable of full resource manipulation. Time-Sensitive Networking (TSN) Protocols Vulnerable to OT Manipulation Nozomi Networks, owned by Mitsubishi Electric, revealed critical weaknesses in TSN protocols designed for industrial reliability that could allow attackers to inject commands or alter timing signals in operational technology (OT). While patches exist for some flaws, underlying protocol limitations make comprehensive fixes challenging. Network segmentation and firmware updates remain key defenses against potential disruptions to machinery and industrial processes.