Week of July 27, 2026: Amgen Discloses Breach, CISA Warns on Water Sector PLC Attacks

Security leaders tracked Amgen's disclosure of a material cloud data breach involving patient health information, a CISA alert warning water utilities about attackers hijacking internet-exposed PLCs, and three new CISA Known Exploited Vulnerabilities additions covering Cisco, Fortinet, and Arista products. CISA also joined international partners on updated software bill of materials guidance and critical infrastructure isolation advice, while JetBrains patched a critical unauthenticated remote-code-execution flaw in TeamCity On-Premises.

Amgen Discloses Material Cloud Data Breach

In July 2026, Amgen Inc. identified unauthorized activity in cloud environments hosted by third-party providers and activated its cybersecurity response plan. The company confirmed that proprietary data and patient protected health information had been exfiltrated, though it found no impact to products, manufacturing, or financial reporting systems. On July 29, 2026, Amgen determined the incident was material under SEC rules, citing the volume of affected files and the sensitivity of the information involved, while stating the incident was not reasonably likely to materially affect its financial condition. (SEC EDGAR)

River Financial Updates Data Theft Disclosure

River Financial Corporation filed an amended Form 8-K on July 30, 2026, updating investors on an incident first reported in June. The company said an unauthorized threat actor accessed portions of its network and removed data, and that it obtained representations from the actor that the data had been deleted. River stated it had not yet confirmed whether personally identifiable information was affected or whether the incident was reasonably likely to materially affect its business or financial condition. (SEC EDGAR)

CISA Warns Water Utilities Over PLC Hijacking Activity

CISA issued an alert on July 30, 2026, warning Water and Wastewater Systems Sector operators about a significant increase in threat actors targeting internet-exposed programmable logic controllers. The agency said attackers had modified PLC passwords to lock out operators and changed IP addresses to disconnect devices, producing boil water notices and forcing sustained manual operations at affected utilities. CISA urged owners to remove PLCs from the internet, route remote access through a VPN, and audit undocumented cellular modems installed by vendors or integrators. (CISA)

CISA Adds Cisco Firewall Flaw to Exploited Vulnerabilities List

CISA added CVE-2026-20316, a hard-coded password vulnerability in Cisco Secure Firewall Management Center, to its Known Exploited Vulnerabilities Catalog on July 29, 2026, citing evidence of active exploitation. The agency said Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of catalog vulnerabilities on exposed assets capable of granting full post-exploitation control, while CISA encouraged all organizations to adopt the same risk-based patching approach for the flaw. (CISA)

CISA Flags Fortinet and Arista Flaws as Actively Exploited

On July 27, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-68686, an information-exposure flaw in Fortinet FortiOS, and CVE-2026-16812, a command-injection vulnerability in Arista VeloCloud Orchestrator On-Prem. CISA said both vulnerabilities showed evidence of active exploitation and reminded Federal Civilian Executive Branch agencies that Binding Operational Directive 26-04 requires prioritized remediation of catalog entries on internet-exposed assets, while urging other organizations to adopt the same risk-based vulnerability management approach. (CISA)

CISA and Allies Issue OT Isolation Guidance for Crisis Response

CISA joined the Australian Signals Directorate, the UK's National Cyber Security Centre, and Canada's Centre for Cyber Security on July 28, 2026 to publish CI Fortify, Advice for Isolating Vital Systems. The joint guidance gives critical infrastructure operators steps to isolate essential operational technology from other networks during a cyberattack, crisis, or geopolitical disruption, covering asset mapping, building separation points, graduated isolation planning, and regular testing, so organizations can sustain essential services for extended periods if networks are compromised. (CISA)

CISA and Partners Update Minimum Elements for SBOMs

CISA, the NSA, the FBI, and international partners released updated guidance on July 29, 2026 titled 2026 Minimum Elements for a Software Bill of Materials, replacing the 2021 NTIA baseline. The revision incorporates more than 90 public comments and applies to SBOMs covering all software types, including open-source, artificial intelligence, and software-as-a-service products. New elements include Component Hash Algorithm, Component License, and SBOM Generation Context, intended to give organizations stronger supply chain risk data as they evaluate vendors and components. (CISA)

JetBrains Patches Critical Unauthenticated TeamCity Flaw

JetBrains fixed CVE-2026-63077, a critical unauthenticated remote-code-execution vulnerability in TeamCity On-Premises, disclosed by researcher Antoni Tremblay and patched on July 28, 2026. The flaw could let an attacker bypass authentication through the TeamCity agent polling protocol and execute OS commands with server-process privileges, potentially exposing credentials and compromising CI/CD pipelines. JetBrains urged self-hosted customers to upgrade or apply a security patch plugin and said it found no evidence of active exploitation at the time of disclosure. (Help Net Security)