The CIP Briefing

A relatively quiet week on the vulnerability front for water utility operators — but that quiet is deceptive, because the compliance clock didn't stop ticking. The headline this week is a new CISA Cybersecurity Advisory (AA26-281A) published October 8 detailing Chinese government-linked cyber threat actors combining automated scanning tools with hands-on keyboard intrusion techniques to steal sensitive data from U.S. critical infrastructure. This is not a rehash of earlier Volt Typhoon or PLC-specific advisories — this is a fresh advisory describing a blended attack methodology where adversaries use automated mass-scanning to find internet-exposed devices, then hand off targets to human operators for deeper exploitation. If your SCADA HMI, historian, or remote access portal has any exposure to the public internet, you are in the target set. Separately, CISA added five new CVEs to the KEV catalog on October 8, including a vulnerability in ISC BIND — the DNS server software that underpins name resolution at many small utilities. If your DNS infrastructure runs BIND, this is a mandatory patch. On the compliance front: utilities serving 3,301–49,999 people now have fewer than 12 weeks until the December 31, 2026 deadline for updated Emergency Response Plans under AWIA. That deadline falls on a Thursday. With Thanksgiving and the December holidays consuming most of the remaining calendar, your realistic working window is closing fast. If you haven't started drafting your updated ERP, this week is your last comfortable starting point.

🟡 [ACTIVE THREAT INTEL] CISA Advisory AA26-281A — Chinese Government-Linked Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

On October 8, 2026, CISA published Cybersecurity Advisory AA26-281A, warning that Chinese government-linked cyber threat actors are employing a two-phase intrusion methodology against U.S. critical infrastructure. In the first phase, adversaries deploy automated scanning and exploitation tools to identify internet-exposed assets at scale — including VPN gateways, firewalls, web-facing HMIs, and unpatched services. Targets that show promise are then handed off to skilled human operators who conduct hands-on-keyboard intrusion, lateral movement, credential harvesting, and data exfiltration. This matters to the water sector because the advisory describes exactly the kind of attack chain that exploits the IT/OT boundary: an internet-exposed device (e.g., a remote access portal to SCADA, or an unprotected HMI) gets flagged by automated scanning, and within hours or days, a human operator is inside your network navigating toward operational technology. Unlike purely automated attacks, this blended approach means the adversary can adapt in real time to your specific network architecture — making generic perimeter defenses insufficient. The advisory specifically calls out critical infrastructure sectors, and the water sector's well-documented pattern of internet-exposed HMIs and legacy remote access configurations makes it a natural target for this methodology.

Source: CISA Advisory AA26-281A — Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools

🟠 [CRITICAL VULNERABILITY] ISC BIND Data Processing Errors Vulnerability Added to KEV Catalog (CVE-2015-5477)

On October 8, 2026, CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities catalog. This is a data processing errors vulnerability in ISC BIND, the most widely deployed DNS server software in the world. While this CVE dates back to 2015, its addition to the KEV catalog now means CISA has confirmed it is under active exploitation in the current threat environment. Many small water and wastewater utilities run BIND as their internal DNS resolver — often on aging Linux servers that haven't been patched in years. A compromised DNS server gives an attacker the ability to redirect internal name resolution, potentially sending SCADA workstations to malicious servers, intercepting authentication traffic, or disrupting communications between OT components that rely on DNS for hostname resolution. If your facility runs BIND in any capacity — including as a caching resolver on your IT network — this requires immediate verification that your version is patched.

Source: NVD CVE-2015-5477

🔴 [REGULATORY MANDATE] AWIA Compliance — Emergency Response Plan Deadline for Systems Serving 3,301–49,999 People

Utilities serving 3,301–49,999 people have a legally mandated deadline of December 31, 2026 to submit updated Emergency Response Plans (ERPs) under the America's Water Infrastructure Act (AWIA). That is now fewer than 12 weeks away. The recertified Risk and Resilience Assessment (RRA) for this same population tier was due June 30, 2026 — if your RRA is not yet submitted, you are already past due and need to address that immediately in addition to the ERP. Utilities serving 50,000–99,999 people should already have their updated ERPs filed (those were due June 30, 2026). There is no extension mechanism built into the statute. Non-compliance is reportable and auditable by the EPA.

Source: EPA Cybersecurity for the Water Sector