Hackers are increasingly targeting America's water systems. Over the last two weeks, cyberattacks have affected dozens of municipal water facilities, including at least 30 in Minnesota and nine in Michigan. The attacks came days after federal agencies renewed warnings about Iranian cyber threats targeting U.S. critical infrastructure. Here's what you need to know about the cyberattacks on U.S. water systems in less than a minute.

Hackers stole around $3 million from Polymarket users after compromising one of the company’s third-party vendors in a supply-chain attack. The attackers injected a malicious script into part of Polymarket’s website. When some users visited the site, they were tricked into approving fake crypto transactions, allowing the hackers to steal funds from their wallets. Polymarket says the attack has been stopped, the compromised third-party software has been removed, and every affected user will receive a full refund.

hackers are now hiding malicious code inside .cursorrules and CLAUDE.md files. invisible Unicode characters, your AI reads them, you don't. → 34 malicious packages across npm, PyPI and Crates .io → 384 versions designed to steal SSH keys, crypto wallets, and API tokens → attackers opened real PRs to LangChain, LlamaIndex, and MetaGPT to sneak these files in → your AI runs a fake "security scan" that silently exfiltrates everything Socket detected it in under 6 minutes. check your repos.

Hackers breached automatic tank gauge systems used to monitor fuel levels in underground storage tanks at gas stations across the United States. These systems were connected to the internet but lacked basic security protections such as passwords. U.S. officials suspect Iranian hackers. The intruders could view and alter the readings on tank monitors but could not change actual fuel amounts or cause physical damage or operational disruptions. The main concern is that attackers could mask a real fuel leak by falsifying data, creating safety or environmental hazards. No such incidents have been reported.

Hackers are actively exploiting a critical vulnerability in cPanel and WHM known as CVE-2026-41940. This authentication bypass allows attackers to gain full admin access to web servers without needing any login information, the issue affects all currently supported versions of cPanel and WHM. The flaw has been under active attack since February 2026 and presents a major threat to shared hosting providers and the millions of websites they host. Attackers could steal data, install malware, or take over entire servers. cPanel released security patches on April 28 and recommends updating immediately. Many large hosting companies such as HostGator and Namecheap have already deployed the fix. If your server runs cPanel, apply the update now or contact your host to make sure you are protected.