Iran-Linked Cyberattack Shuts Down UK Power Plant
A cyberattack attributed to Iran-linked threat actors forced a small UK power generator offline for four days in July, marking the first confirmed state-linked cyberattack to cause operational disruption of British energy infrastructure. The Telegraph first reported the incident on 22 August; the UK government has briefed energy companies on strengthening cybersecurity defences, while the NCSC is assessing the threat.
The affected facility, believed to be a gas peaker plant supplying on-demand capacity, was taken offline for four days with staff forced to restore operations manually. The government confirmed the incident posed no risk to national electricity supply. Neither the specific actors nor the attack vector have been formally confirmed, though experts note that compromising critical infrastructure does not necessarily require sophisticated techniques: exposed internet-facing devices, compromised remote access credentials, and vulnerable gateways all present viable entry points.
The significance extends beyond the generating capacity lost. Security researchers at Orange Cyberdefense note a "second-order cognitive effect" — demonstrating that UK energy infrastructure can be reached and disrupted through cyber activity, which can undermine public trust and confidence. e2e-assure CEO Rob Demain raises the more systemic concern: the question is not how to protect one small generator, but whether the same route into that generator exists across fifty others. The UK's increasingly distributed electricity system means vulnerabilities repeated across multiple assets compound into a much larger risk.
This incident validates longstanding NCSC warnings about state-backed threats to critical national infrastructure. It follows a pattern of Iranian cyber operations escalating alongside geopolitical confrontation, with Iran-linked groups using cyber operations as a primary weapon favouring disruption and strategic messaging.
VMware vCenter Under Active Exploitation — CVE-2026-59310
German incident response firm Quirso has documented active exploitation of CVE-2026-59310, a CVSS 9.8 path traversal vulnerability in VMware vCenter's Syslog server. The flaw allows unauthenticated remote code execution by an attacker with network access to vCenter.
Broadcom published the advisory on 29 July, stating no observed exploitation. By 3 August, compromised systems were already contacting attacker infrastructure. Within 48 hours, 361 victim IP addresses appeared across 47 countries, with Germany, the US, Turkey, Iran, and France accounting for 185 of them. The speed from disclosure to mass exploitation points to the advisory itself as the campaign trigger.
For persistence, the threat actor deployed reverse_ssh, an open-source SSH-based reverse shell framework designed for penetration testing. Because it dials outward rather than accepting inbound connections, it bypasses controls designed to block unsolicited access. CISA added CVE-2026-59310 to the KEV catalogue on 18 August with a remediation deadline of 21 August.
Patching alone is insufficient. As Sectigo's Jason Soroko notes, there are two clocks to manage: one for closing the vulnerability and one for evicting anyone who entered before the patch. No workaround exists. Fixed releases are vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k, and 8.0 U2f.
So What / Action
For the Iran-linked energy attack: audit all internet-facing OT and ICS assets, particularly in energy and utilities. Remove unnecessary remote access routes, rotate credentials for supplier and dormant accounts, and restrict network access to operational systems. Assume that the same attack paths present in one facility exist across your estate. Confirm that IT/OT segmentation is enforced, not just documented. The distributed nature of modern energy infrastructure means a single vulnerability pattern replicated across sites is a systemic risk, not an isolated incident.
For vCenter: if you run VMware vCenter and have not yet patched to the fixed releases, treat this as an active compromise assumption. Patch immediately, then hunt for reverse_ssh and other persistence mechanisms. Credential rotation and full incident response triage are essential — patching without eviction is leaving the front door closed with intruders already inside.