Hackers used a dedicated mobile gateway to compromise a second facility during the destructive cyberattacks that hit Poland’s energy sector last year.

The second target was a small combined heat-and-power (CHP) plant that supplies heat to around 50,000 residents, resulting in the steam turbine and the water treatment system being shut down.

The Polish Computer Emergency Response Team (CERT) disclosed this second incident in a follow-up report over the weekend, saying that the attacker used a private Access Point Name (APN) to access the operational technology network.

“The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another.”

On December 29, 2025, an attacker believed to be linked to the Russian Electrum threat group targeted 30 wind and solar power installations and a large CHP plant in Poland, destroying key equipment beyond repair.

The threat actor hit distributed energy resource (DER) sites across the country, disabled communications equipment, corrupted operational technology (OT) devices, and wiped Windows systems. Despite this effort to destabilize the grid, energy generation and distribution were not disrupted.

In the newly disclosed attack at a second, smaller CHP plant, the threat actor switched off the programmable logic controllers (PLC) and protected access with a password, thus deactivating a steam turbine and the plant’s process-water treatment system and interrupting cogeneration operations.

The staff at the plant managed to restore impacted systems quickly, so the outage was short-lived and had no impact on the population.

Novel attack path

Upon investigating the incident, the Polish CERT determined that the attacker initially compromised a FortiGate VPN/firewall at a wind farm and used a Teltonika cellular router on its network to tunnel into a private APN managed by the distribution system operator.

The APN lacked client isolation, allowing the attacker to scan for and communicate with devices at other facilities.

Beginning on December 18, the attacker found a WAGO PFC200 PLC at the CHP plant whose web interface was exposed on the APN and protected with default administrator credentials.

After compromising the controller, the attacker enabled SSH and used it as a bridge into the plant’s OT network.

Over the following week, they scanned the network for SCADA systems and industrial devices, and on December 25 they connected to three Siemens PLCs, likely in preparation for the attack.

At approximately 5:30 a.m. on December 29, the attacker accessed the SCADA interface and Siemens PLCs, switching them into STOP mode, activating password protection, and shutting down the steam turbine and process-water treatment system.

The attacker also reset and reconfigured several Moxa devices to impede recovery, destroyed logs, and hindered forensic analysis by corrupting or resetting the WAGO controller, Teltonika router, and FortiGate firewall used throughout the intrusion.

The Polish CERT believes this to be the first known real-world cyberattack in which an attacker entered an OT network by moving laterally through a private APN.

“To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack,” commented CERT Polska.

The surveys that followed the investigation determined that this configuration was common in Poland at the time, and the country’s CERT estimates that it’s likely similar arrangements are widely used internationally.

It is recommended to treat private APNs as untrusted external networks, enable isolation between connected clients, use allowlists for essential traffic between APN gateways and OT systems, and disable exposed SSH and Telnet administration services.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Sounding off: Microsoft’s push to bake AI into every product and service it sells is understandably facing some backlash. Even Office is turning into a vessel for Redmond’s chatbots, which may be why one developer decided to go back in time instead, releasing a wild modern port of an early Word release.

Developer Justin Marshall recently ported Word for Windows 1.1a to modern Windows systems. The open-source conversion draws on the source code of the original program, which Microsoft shared with the community in 2014.

Marshall’s port brings the original WfW experience to Windows x64, replacing non-working 16-bit code with modern programming conventions. The coder explains there’s no emulation, virtualization, or reimplementation trick involved: the original Word application runs with its original resources and UI elements intact.

Porting WfW to Windows x64 wasn’t exactly a “plug-and-play” affair. Marshall said that while the original C code and resource files are still part of the port, he had to make the 16-bit code behave properly in a modern 64-bit Windows environment. Specific behaviors tied to the Win16 API had to be adapted to modern Win32 APIs, while dialogs, cursors, and bitmap elements had to be rebuilt with native host tools through the CMake build process.

“CMake inventories the legacy assembly tree but does not compile those modules into native targets. This keeps the historical implementation available as a reference while ensuring all shipped code is valid for AMD64,” Marshall explained on the project’s GitHub page.

Word, and Word for Windows 1.1a specifically, hold a special place in Microsoft’s software history. The original Word for Windows debuted in 1989, bringing the DOS-based productivity tool to a new GUI paradigm; version 1.1a followed a year later as the release that added dedicated support for Windows 3.0. Over time, Word became the de facto standard for word processing in lieu of WordPerfect.

Compared to the barebones GUI of Word for Windows 1.1a, today’s Word is a completely different beast. Microsoft now treats its productivity software largely as a means of promoting its AI services. Thanks to chatbots and LLMs, the latest Microsoft 365 version of Word can even write documents and expand drafts on its own. No pesky human intelligence required.

While Microsoft keeps cramming more AI into Office, some developers are trying to fight back by returning to the roots of its software tools. Before the WfW port, Marshall built other projects blending old software with modern tech, including a ray-tracing port of Quake 1 and a merge of the Quake 4 SDK with the Doom 3 graphics engine, among others.

Security

Franklin project adds new security providers, employs digital twins and AI

DEF CON hackers expanded their efforts to provide free cyber-defenses to rural water systems in the US to include managed detection and response providers, digital twins, and AI agents.

On Friday, at the annual hacker’s conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers – Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies – to help small water utilities serving fewer than 10,000 people detect and mitigate breaches. 

The security providers will exchange threat info and share that with the NRWA, which provides technical assistance and operational support to small water and wastewater utilities across all 50 states.

“We’ve had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we’ve realized is that there’s just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses,”  Jake Braun told The Register during an interview at DEF CON.

Braun co-founded the Franklin project at DEF CON in 2024, and 350 people signed up that year to donate their time and talent to securing water facilities.

“We groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses – it’s MSSPs,” Braun said. “So why don’t we just do that?”

He described the new Water Watch Center as a pyramid, with the NRWA at the top, the managed detection and response providers’ sensors hunting for security vulnerabilities across the utilities’ networks, and then Franklin volunteers fixing issues or responding to instructions as needed.

“We have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions,” Braun said. “And then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we’re not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That’s been the missing piece: there has been no delivery mechanism for cybersecurity that’s scalable nationally – that’s what this is.”

Suspected Iranian hackers have hit numerous water systems in recent weeks, and most were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. There’s no indication that the attackers used AI to help plan or carry out these digital disruptions. However, as both cyber and national security experts told The Register during conversations on the sidelines of Black Hat and DEF CON, it’s only a matter of time until that happens.

DEF CON Franklin has a plan for that scenario, too.

The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few WWC water and wastewater system environments, and then researchers will deploy both red- and blue-team agents across these digital dupes.

The red-team attack agents try to hack the water systems, testing the blue-team defenders’ automated detection and response capabilities, with the eventual goal of deploying AI-based defense to water and wastewater facilities across the US.

“They let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities,” Braun said.

“There’s already a 500,000-person shortage of cyber professionals. The idea that we’re magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things.” ®

Facepalm: Microsoft’s default Weather app in Windows 11 can use nearly 1.2 GB of RAM while sitting open on a forecast screen, according to testing by Windows Latest. The app doesn’t need to be actively used to reach that level of memory consumption. The report found that MSN Weather launches as many as nine Chromium-based subprocesses, suggesting the app is built around a web wrapper rather than as a fully native application. That design helps explain why a basic system utility can use so much memory.

MSN Weather is the standard weather app included with Windows 11. It provides a detailed set of tools, including live radar, hourly forecasts, wind and precipitation data, air-quality readings and moon phases. The data comes from several weather providers, with Foreca serving as a primary source.

The app’s interface is modern and works smoothly, but still, the level of resource use stands out when compared with Apple’s Weather app on macOS, which uses about 250 MB of RAM while providing similar forecast details. That is about five times the RAM usage for the built-in Windows alternative.

The Windows app also carries advertising. Windows Latest’s testing cited ads for Adobe Acrobat while others saw ads for LendingTree and Spotify. Microsoft may need to offset the cost of delivering weather data, but ads in a Microsoft-owned app remain a point of frustration for users who have already paid for a Windows license.

The report arrives as Microsoft has been talking more openly about Windows 11 performance. The company recently removed material recommending 32 GB of RAM for gaming PCs, and has said Windows 11 is optimized to run smoothly on systems with 8 GB of memory.

On an 8 GB machine, an app using close to 1.2 GB of RAM would take up roughly 15% of the system’s available memory. That is a significant share for an application users may open only to check the temperature or see whether rain is expected.

But it seems Microsoft has been building simple apps like this one using WebView2, the company’s framework for embedding web content inside Windows apps. It runs on the same Chromium engine that powers Microsoft Edge, splitting rendering, networking and GPU work into separate processes. That’s why Task Manager shows Weather behaving less like a single lightweight app and more like a small browser session running in the background.

Apple’s Weather app uses far fewer resources than MSN Weather.

Microsoft has said it plans to improve performance, reliability and memory use across Windows 11. It has also discussed updating the apps included with the operating system as it shifts from older Win32 and UWP approaches toward WinUI-based development.

It’s not clear whether that work will include MSN-branded services such as Weather and News. Those services are built into the Windows experience, but Microsoft hasn’t specifically said they’ll be part of the planned overhaul.

For now, the Weather app shows the gap between Microsoft’s broader optimization goals and the experience of using some Windows utilities today. The app is visually polished and offers plenty of forecast data, but its browser-based structure, high memory use and ads make it an awkward fit for a default desktop app.

Good morning! Let’s play Connections, the NYT’s clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.

What should you do once you’ve finished? Why, play some more word games of course. I’ve also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc’s Wordle today page covers the original viral word game.

HR startup Rippling filed a lawsuit Monday accusing MCP gateway startup Runlayer of infringing on three of its patents, according to the lawsuit seen by TechCrunch.

The filing comes after Runlayer sued the HR startup last month, accusing it of breach of contract and stealing its product ideas.

It’s the latest saga between the two companies after Rippling spent nearly a year testing the startup’s MCP product. The two companies never agreed on a price, and the trial never turned into a paid contract. Instead, Rippling built its own MCP server, and will soon offer it as a product that competes with Runlayer. (Rippling often turns its internally used tech into products, like its recently released AI Spend Console.)

Their battle serves as a warning of how the relationship between customers and startups can devolve in this AI-powered age of fast product building.

Runlayer, which launched its product about a year ago, bundles an MCP gateway with cybersecurity features like threat detection. MCP is an open standard that allows AI agents to connect with data and software systems needed to work independently.

Runlayer has raised a total of $42 million and was founded by third-time founder Andrew Berman. (His previous companies were baby-monitor maker Nanit and an AI video conferencing tool, Vowel, that sold to Zapier in 2024). Rippling became one of Runlayer’s earliest potential customers trialing its software.

The most dramatic detail in the lawsuit is Runlayer’s claim that a Rippling employee reached out to Berman to warn him that his employer was building a “copy” of Runlayer’s product. A Rippling spokesperson tells TechCrunch that its employee has since revised that view.

On Rippling’s side, perhaps the most dramatic claim is that it informed Runlayer of the patents it believed Runlayer had infringed soon after the startup filed its lawsuit.

One might infer that the suit is intended as leverage to bring Runlayer to the settlement table. Indeed, that’s how Runlayer views it.

“This is a desperate, retaliatory ploy to distract from the fact Rippling misappropriated our proprietary technology. We clearly have a standout AI product that has nothing to do with these patents. No attempt to bully or distract will prevent us from protecting our IP and continuing to innovate and create the best product for our fast-growing customer base,” Berman said in a written statement.

Rippling loves a good fighting-words statement too. Its spokesperson told TechCrunch: “It takes a certain boldness to accuse a competitor of violating intellectual property laws while infringing on that competitor’s inventions. But that’s exactly what Runlayer has done here. Rippling’s lawsuit calls out Runlayer’s hypocrisy. Having manufactured claims against Rippling to distract from its business failures, it now has to face a lawsuit for repeatedly copying Rippling’s inventions in building its own products.”

Now it’s up to the courts to unwind who did what to whom, unless the parties settle. But these dueling cases still serve as a buyer- and seller-beware warning. With AI advances, enterprises have never before been more empowered to build tech in-house. Yet they still may put a startup through its paces before choosing that option.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts.

Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review.

BdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.

Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.

WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7.

The researchers say that the attacker “poisoned a static remote JSON data stream fetched by an administrative promotional banner component” after obtaining write access to the vendor’s storage bucket.

According to the researchers, the plugin developer had introduced a cross-site scripting (XSS) vulnerability in the JSON response parsing code, allowing the attacker to replace the legitimate promotional JSON with malicious code that exploited the security issue.

The researchers report that the attack was enabled by a coding flaw introduced in March 2026 in the JSON response-parsing code, which created a cross-site scripting (XSS) vulnerability in the BdThemes infrastructure.

The flaw is in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor’s API server and showing them in the customers’ WordPress admin dashboard.

A report from Defiant explains that the malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites, while an additional payload (w2.js) establishes persistence via a webshell (emer-run.php) by installing a fake plugin.

“The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping,” Wordfence researchers say.

“This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”

The issue was assigned a “medium” severity score, and Defiant’s report lists it as unpatched as of publishing.

Because the attack is entirely API-driven, requires no interaction, file modification, or plugin update, it is entirely stealthy, and the payload executes every time a logged-in administrator opens a wp-admin page.

The injected code manipulates WordPress database queries to hide rogue administrator accounts from the user list, making the compromise more difficult to spot.

Defiant’s Wordfence researchers say that reports that the command-and-control (C2) infrastructure used in the observed attacks points to the same attacker behind the recent Advanced Responsive Video Embedder and OptinMonster supply-chain compromises.

After discovering the attacks, the researchers analyzed available records and determined that the earliest possible start of the campaign was June 23.

The affected plugins were pulled from the WordPress.org directory on August 8, pending investigation, while two poisoned API endpoints now return clean JSON data.

At the time of writing, the vendor has not published an official statement about the incident on its website.

BleepingComputer has contacted BdThemes for a statement, but we have not received a response.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Samsung’s upcoming “budget” flagship has leaked so many times over the past few months that there is not much left for the company to reveal. We have already seen its colors, redesigned camera housing, older processor, and familiar cameras. Now, a new leak appears to have filled in nearly the entire spec sheet.

WinFuture has obtained detailed specifications for the Galaxy S26 FE, pointing to a 6.7-inch Dynamic AMOLED 2X display with a 2340 x 1080 resolution, 120Hz refresh rate, and brightness reaching 1,900 nits in high-brightness mode. The phone is expected to come in Graphite, Pistachio, and Blueberry.

The older chip is no longer much of a surprise

The leak once again points toward Samsung’s Exynos 2500 paired with 8GB of RAM and either 128GB or 256GB of storage. We already covered an alleged Geekbench result for the phone in April, where the older chip trailed the Exynos 2600 inside the regular Galaxy S26 series by a sizeable margin.

The cameras are looking equally familiar. WinFuture lists a 50MP main camera with optical image stabilization, an ultrawide camera, and an 8MP telephoto offering 3x optical zoom. A 12MP camera sits on the front. An earlier leak already suggested Samsung would recycle much of the Galaxy S25 FE’s camera hardware, so there are few surprises here.

At least the battery gets some attention

The Galaxy S26 FE is said to pack a 4,900mAh battery and support 45W charging, which is exactly what Samsung already offers on the Galaxy S25 FE. The more interesting part is the battery chemistry. WinFuture believes Samsung may have switched to silicon-carbon technology.

If accurate, Samsung could be taking a similar approach to the Galaxy Z Flip 8. The foldable retained the same battery capacity as its predecessor, but the newer battery technology helped Samsung make the device slimmer. The Galaxy S26 FE could follow the same playbook, using silicon-carbon to reduce thickness rather than squeeze in a larger battery. Other specifications include IP68 protection, Wi-Fi 6, Bluetooth 5.4, NFC, Android 17, and One UI.

The phone is expected to cost €799 in the European market, which is €50 more than the launch price of the Galaxy S25 FE. Considering the current market conditions around RAM and storage, that price increase doesn’t look too bad, and Samsung has already warned that its future devices could get pricier due to rising component costs. Still, an older processor, familiar cameras, and no increase in the battery department could make the price harder to justify.

When heat waves descended on California this summer, Shreyas Sudhakar, founder and chief executive officer of heat pump installation firm Vayu, took his chance.

Just 54 percent of homes in the state have central air-conditioning, but rising temperatures are making cooling a must-have. Sudhakar saw the hot weather as an opportunity to sign up multiple households to a heat pump “group-buy” scheme, offering them a chance to purchase technology that provides carbon-free heating and cooling at a discount. After advertising the venture online, he was flooded with queries.

Heat pumps often cost more than cooling-only air conditioners, which is why adoption hasn’t been more widespread in the US. But the group-buy approach offers would-be purchasers a bulk discount that can defray part of the cost. Group-buys also mean installers can line up a tidy string of jobs—a win-win potentially enabling whole neighborhoods to switch to heat pumps.

Along with heat pump marketplace VoltHub, Vayu launched the first California Heat Pump Group Buy last year. “Nobody, to our knowledge, had done it in California,” recalls Sudhakar. “We thought, ‘Let’s try it out.’” The program is available around Los Angeles and the Bay Area.

Air-source heat pumps run on electricity. They work by harvesting heat from outside air and distributing it indoors, or gathering excess internal heat and dumping it outside.

This isn’t exactly rocket science. Except, perhaps, to a former rocket propulsion engineer.

“I tell people this all the time,” laughs Sudhakar, who previously designed rocket engines at Blue Origin. “At the end of the day, it’s a bunch of pipes and a heat exchanger moving energy from one place to another.”

Among the first group of roughly 10 customers in the initial group-buy scheme was Naoya Kanai, a data scientist who lives with his wife and toddler in the Bay Area city of San Mateo. Kanai stumbled on the group-buy online and jumped at the chance, knowing that federal rebates for carbon-free appliances would soon disappear under the Trump administration.

“It was one of the most affordable ways to get a quality system,” he says of the program. Kanai recalls thinking, “I can really sell it to my spouse.”

Once households are signed up to the group-buy, Sudhakar and his colleagues work out what equipment they’ll need for each installation. Then, they shop around for deals from distributors so they can make offers to participants. “We’re looking for what is the best value across the entire group,” he adds. “Typically, we’re getting 15 to 30 percent discounts on the equipment.”

Kanai’s house is a two-story 1980s suburban home that has about 2,500 square feet of space. The new heat pump system cost roughly $14,500 and provides heating and cooling via ductwork that was already in place. Kanai says the flow of temperature-controlled air is much more comfortable and steady compared to his old gas furnace and air conditioner. He’s barely noticed this summer’s heat waves until going outside. “A lot of times we’ll step out the front door [and realize] ‘Oh, wow, it was actually really hot today.’”

Other group-buy programs are available across North America, with one of the oldest operational programs on Gabriola Island, British Columbia, a 58-square-kilometer land mass home to about 4,500 people. In 2010, a group called Energy Gabriola set itself up as a heat pump dealer via a distributor, so it could buy heat pumps in bulk and sell them at cost. This was possible because, until that point, there was no heat pump market or installation service on the island whatsoever.

Relying partly on volunteers, the group has installed more than 1,000 heat pumps to date, electrifying nearly half of the island’s households. “We think we’re the heat pump capital of Canada,” says Steven Earle, of Vancouver Island University, who is involved in Energy Gabriola.