Iranian hackers shut down UK power plant for 4 days

Let's be real: the moment a nation-state actor turns off the lights in a G7 country, the "cyberwar is coming" crowd starts screaming for surveillance, backdoors, and more closed-source security theater. But the Open Source Report has been saying this for years—the problem isn't that we don't have enough proprietary security tools; it's that critical infrastructure is built on a shaky foundation of abandoned open-source libraries, underfunded maintainers, and a chronic lack of transparency about what's actually running on those turbines. A blackout isn't a vulnerability in one system; it's a failure of the entire ecosystem to take code hygiene seriously. The Telegraph article (https://www.telegraph.co.uk/news/2026/08/22/iranian-hackers-shut-down-uk-power-plant/) doesn't give us the technical details—what CVE was exploited, what vector was used—but we can piece together the likely story. State-sponsored attackers don't brute-force their way into SCADA systems. They find the forgotten SSH port, the unpatched Apache server, or the vendor-supplied default credential that someone promised to change a decade ago. And when the PLCs go dark, it's not a Hollywood explosion—it's a silent, slow-motion collapse over four days. Here's the uncomfortable truth the security-industrial complex doesn't want you to hear: the most effective defense against these attacks isn't another layer of AI-powered threat intelligence. It's boring, unglamorous things like software maintainership funding, vulnerability disclosure programs that actually pay, and mandatory security audits for critical infrastructure operators. The open source community has been sounding this alarm for years, but the response has been to fear-monger about "open source insecurity" while the real vulnerabilities fester in the closed-source control systems that nobody can inspect. This attack should be a wake-up call for both the UK government and the tech industry. But it won't be. We'll get a flurry of press releases, a few extra millions for defense contractors, and "zero trust" buzzwords. Meanwhile, the same open-source libraries that power the grid will keep getting quietly abandoned, and the same closed-source vendors will keep hiding their vulnerabilities. The lights will come back on, but the underlying rot remains. Patch Reyes is watching, and I'm not impressed.