Cyberattacks on Poland’s Water Plants: A Blueprint for Hybrid Warfare

Multiple high-impact incidents and vulnerabilities were reported: Poland’s ABW confirmed ICS breaches at five water treatment plants (Russia-linked APTs suspected) that allowed attackers to alter equipment settings; a third-party breach tied to ShinyHunters exposed ~197,000 Zara customer records; an unpatched Linux local privilege escalation (“Dirty Frag”) with public exploit elevates local users to root; and nation-state actors exploited Palo Alto PAN-OS zero-day CVE-2026-0300 (now on CISA KEV) to gain root and deploy tunneling tools. CISA also added Ivanti EPMM CVE-2026-6973 to its KEV list,