Cyber incidents of 2026: lessons from official reports

This post sums up what official agencies said about three 2026 incident cases: the Axios npm compromise, the Cisco SD-WAN exploitation and the attacks on Poland’s energy sector. It uses only pages from CISA, the UK NCSC and CERT Polska, read as of 9 October 2026. The lessons are the agencies’ own recommendations, not ours.

Where do these three cases come from?

We keep incident pages for the npm package compromise, the SD-WAN exploitation and the Poland energy attacks. This post goes back to the official pages behind them. Where a page shows a date, we give it, and we use the page’s own wording for what it asks.

What did CISA say about the npm supply chain compromise?

CISA’s alert, released on April 20, 2026, gives guidance on the software supply chain compromise of the npm package. It says that on March 31, 2026, two npm packages injected a malicious dependency that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan. For the general idea, see our glossary entry on supply chain attacks.

CISA urges organizations to monitor and review code repositories, CI/CD pipelines and developer machines that ran npm install or npm update with the compromised version. It also says to pin dependency versions to known safe releases, and to rotate or revoke credentials that may have been exposed. For developer accounts, it recommends phishing-resistant multifactor authentication.

Two npm settings are named as well. CISA says ignore-scripts=true prevents potentially malicious scripts from executing during install, and min-release-age=7 installs only packages published for at least seven days. For a similar case in a build pipeline, see our post on how to catch the tj-actions compromise.

What did the agencies say about the SD-WAN exploitation?

CISA and partners published an alert, last revised May 14, 2026. It says they have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations globally. CISA’s Emergency Directive 26-03, originally issued February 25, 2026 and updated March 11, 2026, requires federal civilian agencies to inventory these systems, update them and assess compromise.

The authoring organizations are CISA, the NSA and the cyber agencies of Australia, Canada, New Zealand and the UK. They urge network defenders to inventory all in-scope systems, collect artifacts, fully patch, and hunt for evidence of compromise. The UK NCSC adds a plain rule: management interfaces must never be exposed to the internet. For patching practice in general, see our glossary entry on patch management.

The order in the directive matters. It says its actions must be taken in the identified order, and that updates come after the first two actions, which are identifying systems and collecting artifacts. It also asks that logs be stored externally, outside the SD-WAN technology. The NCSC lists hardening steps from the vendor’s guide, such as keeping control components behind a firewall and forwarding logs to a remote syslog server. If a root account compromise is found, the directive says organizations must rebuild the control management plane. When the weak point is a vendor’s own product, our posts on the F5 breach and Salt Typhoon cover related questions.

What did CERT Polska and CISA report on the Poland energy attacks?

CERT Polska’s report, dated 30 January 2026, says coordinated attacks took place against more than 30 wind and photovoltaic farms, a private manufacturing company and a large combined heat and power plant. It says the attacks on the farms disrupted communication with the distribution system operator but did not affect electricity production. At the plant, it says the wiper’s operation was blocked by the organization’s EDR software.

CISA’s alert of February 10, 2026 amplifies that report. It says the actor gained initial access through vulnerable internet-facing edge devices, and, as indicated by CISA’s Binding Operational Directive 26-02, that end-of-support edge devices pose significant risks. It adds that OT devices without firmware verification can be permanently damaged, and that default credentials were used to pivot onto the HMI and RTUs. Its mitigations: change default passwords immediately, prioritize updates that allow firmware verification, and, if updates are not immediately feasible, make sure incident response plans account for inoperative OT devices.

CERT Polska’s follow-up, dated 08 August 2026, says a second incident took place in parallel at a smaller plant supplying heat to 50,000 residents. After an investigation of more than three months, it reports the use of a private APN to reach the OT network, which it calls the first time this attack vector was observed in a real-world cyberattack. It names a misconfiguration among the factors, and ends with recommendations for organizations using private APN-based solutions. Read that report for the details.

How do the three cases line up in time?

What do the sources ask for first?

Agency outlooks look further ahead, and we cover them in threat intelligence priorities for 2027. This post only summarizes the pages as of 9 October 2026. Several of them were updated after first release, so check the current page before you act on any of it.

Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.

For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.