Week of February 9, 2026: Poland Energy Wiper Attack Alert and CISA's KEV Surge

Security leaders tracked CISA's amplification of a wiper attack that hit Polish energy infrastructure in December 2025, two rounds of Known Exploited Vulnerabilities additions covering Microsoft, Apple, SolarWinds, and BeyondTrust products, and new CISO appointments at Salesforce and First Horizon. CISA also opened additional town halls on the CIRCIA incident-reporting rulemaking, published its 2025 Year in Review, and released new guidance on securing legacy OT communication protocols.

CISA Amplifies Report on Poland Energy Sector Wiper Attack

In an alert released February 10, 2026, CISA amplified CERT Polska's report on a December 2025 cyber incident that compromised operational technology at Polish renewable energy plants, a combined heat and power plant, and a manufacturing company. Attackers used vulnerable internet-facing edge devices and default credentials to deploy wiper malware, destroying data on human-machine interfaces and corrupting firmware on remote terminal units. The incident caused system operators to lose view and control between facilities and distribution operators, though affected renewable systems kept producing power without operator oversight. (CISA)

CISA Adds Six Actively Exploited Microsoft Vulnerabilities to KEV Catalog

On February 10, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, and CVE-2026-21533, all affecting Microsoft Windows, Office, MSHTML, and Remote Desktop Services components. CISA's Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog vulnerabilities by set deadlines, and the agency urged all organizations to prioritize the same patches given the frequency with which these vulnerability types serve as attack vectors. (CISA)

BeyondTrust Remote Support Flaw Added to CISA's KEV List

On February 13, 2026, CISA added CVE-2026-1731, an OS command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access products, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The addition triggers Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA again encouraged all organizations to prioritize patching catalog vulnerabilities as part of routine vulnerability management, noting such flaws are frequent attack vectors for malicious cyber actors targeting federal and private-sector networks alike. (CISA)

Salesforce Names Iain Mulholland CISO; First Horizon Hires Leilani Farol

In its February 9, 2026 Industry Moves roundup, SecurityWeek reported that Salesforce named former Google Cloud deputy CISO Iain Mulholland as its new Chief Information Security Officer, drawing on more than 25 years of experience across Google Cloud, VMware, and Microsoft Security Response Center. The same roundup noted First Horizon, a financial services firm listed on the NYSE, appointed Leilani Farol as Senior Vice President and CISO; she previously led Governance, Risk and Compliance for Fidelity Investments and held a cybersecurity role at Bank of America. (SecurityWeek)

CISA Schedules Town Halls on CIRCIA Incident Reporting Rule

CISA announced on February 13, 2026 a series of virtual town hall meetings, beginning March 9, to gather stakeholder input on the pending Cyber Incident Reporting for Critical Infrastructure Act rulemaking. Executive Assistant Director for Cybersecurity Nick Andersen said stakeholder input was critical to finalizing a rule that balances cybersecurity benefit against compliance burden. Once finalized, the CIRCIA rule will require covered critical infrastructure organizations to report certain cyber incidents to CISA within 72 hours and ransom payments within 24 hours. (CISA)

CISA's 2025 Year in Review Highlights Scale of Federal Cyber Defense

Released February 11, 2026, CISA's 2025 Year in Review reported the agency published more than 1,600 products and triaged over 30,000 incidents through its 24/7 Operations Center during the year. The report also said CISA blocked 2.62 billion malicious connections on federal civilian networks and 371 million within critical infrastructure, and led 148 cyber and physical security exercises involving more than 10,000 participants. Acting Director Madhu Gottumukkala said the agency delivered measurable results in 2025 while continuing to safeguard infrastructure Americans rely on daily. (CISA)

CISA Releases Guide Addressing Barriers to Secure OT Communication

On February 10, 2026, CISA published Barriers to Secure OT Communications: Why Johnny Can't Authenticate, a guide developed from interviews with operational technology asset owners and operators across water, transportation, chemical, energy, and food and agriculture sectors. The guide examined why legacy industrial protocols still lack basic authentication and integrity checks despite secure alternatives existing for over two decades, and offered recommendations addressing cost, latency, and interoperability barriers that have slowed adoption. Acting Director Madhu Gottumukkala urged asset owners, integrators, and manufacturers to collaborate on implementing secure communication. (CISA)