Cyber War 2026: What Is Happening Now and How to Protect Your Business

By Eoin Villarin, 2026-10-30

The Iran war's cyber front, allegations of China-linked hacking, hacked French supermarket fridges and AI-powered break-ins: the 2026 cyber war explained, with a protection checklist.

The cyber war 2026 has brought is not one battle with a start and an end. Since February, state-backed hackers, pro-government hacktivists and criminal gangs have hit water systems, supermarkets, military bases, construction sites and thousands of ordinary business websites in the United States and Europe. In October alone, Western security agencies published joint advisories alleging China-linked hacking and describing a ransomware group with more than 600 victims, while Reuters reported that a single hacker used AI agents to break into the websites of more than 100 companies.

This guide explains what is actually happening, who is believed to be behind it, and why small and mid-sized businesses are in the blast radius even when they are not the target. It ends with a practical checklist for protecting your website, online store and email.

Facts come from official advisories and from reporting by Reuters, NPR and Al Jazeera, linked next to each claim. Government advisories reflect the position of the governments that publish them, and attribution in cyber attacks is often disputed, so I treat claims about who is responsible as claims, not settled facts.

Cyber War 2026 at a Glance

Is There a Cyber War Happening Right Now?

Not in the sense of a declared war fought only online. What is happening is a long-running conflict in the grey zone between peace and war. Governments use their own hackers, contractors and friendly hacktivist groups to spy, steal and disrupt, while criminal gangs exploit the same weaknesses for money. The result looks like a war to the businesses caught in it, even when nobody has formally declared anything.

Three things make 2026 different from earlier years. A shooting war involving Iran has spilled into cyberspace. Attacks on physical equipment, from water pumps to supermarket fridges, are now common enough to make headlines every month. And AI agents have made hacking cheaper and faster, which puts small businesses in range of attacks that once only targeted large companies.

The Iran War's Cyber Front

The war that began with US and Israeli strikes on Iran on February 28, 2026 had a cyber front from day one, as summarized in the record of cyberwarfare during the 2026 Iran war. On the first day, US and Israeli cyber operations disrupted Iranian communications and sensor networks, hijacked broadcasts and pushed messages through a hacked prayer app with millions of users, while Iran's internet connectivity fell to a few percent of normal for more than 60 hours. Iranian-affiliated groups and dozens of hacktivist teams answered with attacks on media, energy, healthcare and government targets across the Middle East and the US.

Inside the US, the biggest impact has been on water. In late July, attacks disrupted dozens of small municipal water systems in Minnesota, and NPR reported that investigators have found attacks on the water sector in at least seven states. A link to the Iran conflict is suspected but has not been confirmed.

Reuters also reported on October 29 that officials suspect a cyberattack behind freezer failures at stores on US military bases in late August. No one has been identified as responsible.

China-Linked Hacking Allegations: What the October 8 Advisory Claims

On October 8, security agencies from the US, UK, Australia, Canada, Japan, New Zealand and Spain published joint advisory AA26-281A. It alleges that Integrity Technology Group, a China-based company, supplied hacking tools and infrastructure to actors targeting organizations worldwide, and links the activity to groups tracked as Flax Typhoon. These are the publishing governments' allegations, Beijing has rejected similar accusations in the past, and none of it has been tested in court.

Whoever is behind it, what matters for ordinary businesses is the list of techniques, because it is the same playbook attackers of every kind use against small websites every day:

• Mass scanning with common tools, including WordPress vulnerability scanners, to find weak sites and servers.
• Fake login pages built with cross-site scripting to steal passwords.
• Password spraying against Microsoft 365 and Exchange email logins.
• Known vulnerabilities that were never patched. The advisory lists eight exploited CVEs.

The advisory's top defenses are equally basic: patch quickly, require multifactor authentication on email and VPNs, sanitize input in web applications, close unused ports and keep offline backups.

Europe: Supermarket Fridges, a Tunnel and Hybrid Attacks

Europe saw some of the strangest attacks of the year. Overnight on October 11 to 12, hackers remotely raised the temperature of fridges and freezers at more than 500 French stores, including Intermarché, Carrefour and Coopérative U locations, spoiling food and in some cases causing fires, Al Jazeera reported. The attacks targeted internet-connected Danfoss refrigeration controllers, which the manufacturer said were mostly legacy units with outdated firmware. French authorities told affected companies to disconnect the controllers from the internet or restrict access, and to update them.

On October 13, a cyber incident hit the construction site of the Fehmarn Belt tunnel, the road and rail link being built between Denmark and Germany, Ingeniøren reported, disrupting work at the site. Neither attack has been publicly attributed. Al Jazeera noted that French President Emmanuel Macron had ordered extra protection for critical infrastructure against what he described as Russian hybrid attacks, but neither incident has been linked to any country.

The lesson for any business, not only supermarkets, is that old internet-connected equipment is now a real entry point. Building controls, cameras, routers and payment terminals all count.

AI Agents Are Making Attacks Cheaper

The story with the most direct impact on small business websites came from Reuters on October 19. A hacker gave a few short instructions to AI agents, which then spent hours probing websites on their own. Starting September 25, the agents tried more than 1,200 sites, mostly e-commerce sites in the US, Canada, Australia and Japan, and breached the websites of more than 100 companies, including support or vendor sites linked to Deere, SharkNinja and Cummins.

The cost was about $5,000 in AI usage, or roughly $50 per successful break-in. In one case described by Reuters, the agents failed against the main application, found a related public control panel and exploited a weakness there instead. That is exactly the kind of forgotten admin page or staging site most small businesses have somewhere.

Ransomware: The SafePay Warning

Criminal ransomware remains the attack most likely to shut a small business down. On October 20, police and security agencies from the US, Germany and the UK published joint advisory AA26-293A on SafePay ransomware, which has hit at least 600 victims across North America, South America, Europe and Australia.

SafePay gets in through stolen or guessed passwords, VPN access, phishing and unpatched internet-facing devices. It encrypts files, steals data, demands a share of the victim's revenue and threatens to publish the data, sometimes pressuring staff by phone. The agencies discourage paying.

What the Cyber War Means for Your Business Website

Your business is probably not a target of a foreign government. But the tools, scanners and AI agents used in this conflict sweep the whole internet, and they do not care whether a site belongs to a utility or a family-run online store. For US and European small businesses, these are the steps that matter most right now:

1. Patch the server, not only the CMS. WordPress and plugin updates do not fix flaws in PHP, NGINX or your hosting stack. Check that your host has applied the PHP2Shell patches.
2. Turn on multifactor authentication everywhere. Hosting, domain registrar, CMS admins, Shopify staff accounts, Microsoft 365 or Google Workspace, and payment dashboards. Passkeys are even better, as I explain in my passkeys guide.
3. Hide and restrict admin panels. Limit WordPress admin, hosting control panels, staging sites and database tools by IP or behind single sign-on. Delete old staging and test sites.
4. Remove what you do not use. Every unused plugin, app, theme and integration is extra attack surface. My guide to WordPress plugin security covers how to audit them.
5. Add security headers and input validation. A Content Security Policy, secure cookies and proper form validation block the cross-site scripting tricks named in the October advisory.
6. Put a firewall in front of your site. A web application firewall with bot management and rate limiting stops much of the automated scanning, including AI agents, before it reaches your server.
7. Find your forgotten devices. List every internet-connected device in your shop or office, from routers and cameras to fridges and door controllers. Update firmware, change default passwords and take anything that does not need internet access offline.
8. Keep offline, tested backups. Back up your site, database and key files somewhere attackers cannot reach, and test a restore at least once a quarter.
9. Write a one-page incident plan. Know who you call, how you take the site offline safely, how you tell customers, and which national cybercrime reporting service and bank you need to notify.

How I Help Businesses Stay Secure

I maintain and harden websites on WordPress, Shopify, Laravel, Node and custom stacks for businesses in the US, Europe and Australia. In practice that means patching servers and plugins on a schedule, locking down admin access, adding security headers and a firewall, cleaning up old plugins and staging sites, setting up monitoring and backups, and being there quickly if something goes wrong. Most of these fixes take days, not months, and they close the doors that automated attackers try first.

Frequently asked questions

Is there a cyber war happening right now?

There is no formally declared cyber war, but state-linked hacking is intense in 2026. The Iran war that began in February brought US and Israeli cyber operations against Iran and Iranian-affiliated attacks in return, Western agencies published allegations of China-linked hacking on October 8, and Europe has seen attacks on supermarkets and infrastructure. Criminal ransomware and AI-powered hacking add to the pressure.

Who is behind the cyberattacks in 2026?

Western governments attribute major campaigns to China-linked groups such as those tracked as Flax Typhoon and to Iranian-affiliated actors, while the US and Israel ran their own cyber operations against Iran. Accused governments usually deny involvement, and many incidents, including the French supermarket attacks and the Fehmarn Belt incident, have not been attributed. Criminal gangs like SafePay cause much of the damage.

Can small businesses be targeted in a cyber war?

Yes, mostly as collateral damage. The scanners, password-spraying tools and AI agents used in these campaigns sweep the whole internet for weak websites, email accounts and devices. Reuters reported that AI agents breached more than 100 company websites for about $50 per break-in, so small online stores are now cheap targets.

How do I protect my website from state-sponsored hackers?

Focus on the basics the advisories repeat: patch your server and software quickly, require multifactor authentication on every admin and email account, restrict admin panels, remove unused plugins, add a web application firewall and security headers, and keep offline backups. These steps stop the automated attacks that cause most real-world damage.

What should I do if my website is hacked?

Take the site offline or into maintenance mode, change all admin, hosting and email passwords from a clean device, and contact your developer or host. Preserve logs for investigators, restore from a clean backup, then patch the hole before going live. Finally, report it to your national cybercrime reporting service.

Stay Calm and Close the Easy Doors

The cyber war 2026 is real, but most of the damage to businesses still comes through unpatched software, weak passwords and forgotten admin pages. Fix those, and you take your business out of the easiest group of targets for both state-backed hackers and criminals.

If you want a security review of your website or online store, help patching your server and plugins, or ongoing maintenance so updates never slip, send me a message and I will reply within 24 hours. You can also see how I have helped other businesses in my case studies.