Four of this week’s most-shared Iran cyber stories are between two weeks and six months old

The Washington Post reported on 1 August that several US states had recorded cyberattacks on water systems, with agencies suspecting Iranian targeting. The Record’s tally of 12 states, adding South Dakota and Georgia, is roughly two weeks old. The underlying CISA/FBI/EPA joint advisory AA26-097A on Iran-affiliated actors exploiting programmable logic controllers is about a month old and is itself an update to an earlier warning. Coverage has also repeatedly collapsed the distinction between internet-exposed PLC access and confirmed manipulation of an industrial process; no operator or CISA statement in the brief establishes the latter. The Iranian internet blackout material is older still: Human Rights Watch’s statement is dated 6 March, the Freedom Online Coalition joint statement 4 February, and the most recent NetBlocks connectivity figure locatable — 86 percent — reached IranWire on 27 May.

Two research documents are doing similar work. Citizen Lab’s “Bad Connection” study of global telecom exploitation by covert surveillance actors was published on 8 May and is recirculating via advocacy accounts that frame it as a new finding; Amnesty’s Pegasus architecture study, 17 July, is being cited as context for the Apple wave, which is legitimate but not new. The least reliable category is the undated vendor page. Trellix’s Iranian capability assessment, Halcyon’s destructive-attack update and SOCRadar’s Iran–Israel cyber conflict dashboard all present as current; the SOCRadar page carried a 17-hour-old crawl timestamp, which records a dashboard refresh, not a finding. Palo Alto Unit 42’s Iran escalation brief is stamped 17 April. The most recent Israeli official attribution — the cyber chief’s claim of surged Iranian attacks — is from Times of Israel on 29 June.

Two of these threads have live tests attached, and both sit in court rather than in a vendor blog. A US federal court found NSO Group liable under anti-hacking law in the WhatsApp case, with a jury awarding approximately $167 million in May 2025, and the permanent injunction took effect on 28 January 2026. Meta filed a contempt motion in June 2026 alleging NSO ran new campaigns against WhatsApp users within days of the injunction taking effect. That is an allegation by a litigant, not a judicial finding, and no ruling has been reported.

Assessment: Recency laundering is now a structural feature of the cyber beat, not an accident. A dashboard that re-crawls hourly, a vendor landing page with no date, and an advisory that is technically an update to an update all read as today’s news to an algorithm and to a reader. The incentive runs one way: vendors and advocacy accounts both gain from a threat that appears to be accelerating this week. The discipline is boring and it holds — a story needs a new state, a new advisory revision, a named utility, or a ruling. On Iran connectivity specifically, do not publish a number without checking netblocks.org the same day.