European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed: Software security
French investigators have tied October’s sabotage of supermarket refrigeration to Shahid Kaveh, an offensive hacking unit in the cyber arm of Iran’s Islamic Revolutionary Guard Corps. An official report and the Paris prosecutor’s office said on November 9, 2026, that intruders reset defrost settings on controllers at about 700 sites from October 11 to 12, ruining stock and starting at least 15 fires.
Carrefour, Leclerc, Intermarché, and other chains were hit, along with small butchers and a slaughterhouse. Prosecutors say the attackers entered through the controllers’ web interfaces and muted the temperature alarms. Investigators found Farsi in the attack infrastructure and IP addresses traced to Iran, and linked the same operation to tampering, with moderate effects, at small hydroelectric plants.
Paris prosecutors are seeking international arrest warrants for the unit’s leader and two deputies. France summoned Iran’s ambassador on November 10 and will push for European sanctions, and Iran has not responded. No official has yet tied the later fridge attacks in Belgium, Luxembourg, and Sweden, or the one on French blood banks, to the same group.
Source: CBS News
French investigators have tied October’s sabotage of supermarket refrigeration to Shahid Kaveh, an offensive hacking unit in the cyber arm of Iran’s Islamic Revolutionary Guard Corps. An official report and the Paris prosecutor’s office said on November 9, 2026, that intruders reset defrost settings on controllers at about 700 sites from October 11 to 12, ruining stock and starting at least 15 fires.
Carrefour, Leclerc, Intermarché, and other chains were hit, along with small butchers and a slaughterhouse. Prosecutors say the attackers entered through the controllers’ web interfaces and muted the temperature alarms. Investigators found Farsi in the attack infrastructure and IP addresses traced to Iran, and linked the same operation to tampering, with moderate effects, at small hydroelectric plants.
Paris prosecutors are seeking international arrest warrants for the unit’s leader and two deputies. France summoned Iran’s ambassador on November 10 and will push for European sanctions, and Iran has not responded. No official has yet tied the later fridge attacks in Belgium, Luxembourg, and Sweden, or the one on French blood banks, to the same group.
Source: CBS News
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Hackers remotely raised fridge and freezer temperatures, in some cases to 50°C, at supermarkets in seven EU countries overnight on November 1 to 2, 2026, three weeks after a similar attack hit about 700 stores in France. Affected chains include Carrefour, Intermarché, Delhaize, Ikea, ICA, Coop, Kesko, and SuperValu, which pulled chilled and frozen food from 13 stores.
EU Agriculture Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain.” No group has claimed responsibility, and it isn’t established whether the incidents are connected. Sophos threat intelligence director Rafe Pilling sees state-backed signaling or a lone hacker as the likeliest explanations.
The attack needed no malware, leaving investigators little to trace. ICA says its systems came from Danfoss, whose end-of-life controllers were hit in France, and Coop says some fridges ran over a more exposed 4G link. Belgian refrigeration firm Sabcobel says patching since the French attack kept the damage from being worse.
Source: The Guardian
Hackers remotely raised fridge and freezer temperatures, in some cases to 50°C, at supermarkets in seven EU countries overnight on November 1 to 2, 2026, three weeks after a similar attack hit about 700 stores in France. Affected chains include Carrefour, Intermarché, Delhaize, Ikea, ICA, Coop, Kesko, and SuperValu, which pulled chilled and frozen food from 13 stores.
EU Agriculture Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain.” No group has claimed responsibility, and it isn’t established whether the incidents are connected. Sophos threat intelligence director Rafe Pilling sees state-backed signaling or a lone hacker as the likeliest explanations.
The attack needed no malware, leaving investigators little to trace. ICA says its systems came from Danfoss, whose end-of-life controllers were hit in France, and Coop says some fridges ran over a more exposed 4G link. Belgian refrigeration firm Sabcobel says patching since the French attack kept the damage from being worse.
Source: The Guardian
Binance has replaced 90% of the $6.3 billion stolen on October 29, 2026, in what’s believed to be crypto’s largest hack, ahead of the $1.5 billion Bybit theft in 2025. Using more than $6.34 billion in company funds, it has fully covered bitcoin, Ethereum, and Tether holdings. The last 10%, in less-liquid tokens, will take longer to buy.
The FBI has blamed North Korea, naming the state-backed group it tracks as TraderTraitor, part of the Lazarus Group. It says the hackers are converting the stolen assets into Ethereum ahead of further laundering. Binance has frozen about $3 billion of those assets with law enforcement and industry partners.
Binance’s early investigation pointed to a compromised engineer’s laptop, though it has since found “additional points of breach.” Co-CEO Richard Teng says more than one attacker took part, using a “self-destruct mechanism” to cover the intrusion. Withdrawals began resuming on several networks on November 1.
Source: BBC News
Binance has replaced 90% of the $6.3 billion stolen on October 29, 2026, in what’s believed to be crypto’s largest hack, ahead of the $1.5 billion Bybit theft in 2025. Using more than $6.34 billion in company funds, it has fully covered bitcoin, Ethereum, and Tether holdings. The last 10%, in less-liquid tokens, will take longer to buy.
The FBI has blamed North Korea, naming the state-backed group it tracks as TraderTraitor, part of the Lazarus Group. It says the hackers are converting the stolen assets into Ethereum ahead of further laundering. Binance has frozen about $3 billion of those assets with law enforcement and industry partners.
Binance’s early investigation pointed to a compromised engineer’s laptop, though it has since found “additional points of breach.” Co-CEO Richard Teng says more than one attacker took part, using a “self-destruct mechanism” to cover the intrusion. Withdrawals began resuming on several networks on November 1.
Source: BBC News
Polymarket’s international platform halted trading on October 29, 2026, after a supply chain attack drained user funds. The company hasn’t disclosed losses, but the wallet believed to belong to the attacker held about $2.65 million, according to Arkham data. Researchers trace the malicious JavaScript to DebugBear, a UK firm that monitors website performance, through its real user monitoring script.
The code targeted logged-in users, selling positions or transferring tokens directly to an attacker-controlled wallet. DebugBear confirmed it was dealing with a security incident and told customers to remove its script. Polymarket, which hasn’t named the vendor, referred the breach to law enforcement and pledged to make every affected trader whole. Trading restarted roughly an hour later.
Polymarket’s US exchange appears to have been untouched. This is the company’s second third-party breach in months — a similar attack in June 2026 cost traders a reported $3 million.
Source: SecurityWeek
Polymarket’s international platform halted trading on October 29, 2026, after a supply chain attack drained user funds. The company hasn’t disclosed losses, but the wallet believed to belong to the attacker held about $2.65 million, according to Arkham data. Researchers trace the malicious JavaScript to DebugBear, a UK firm that monitors website performance, through its real user monitoring script.
The code targeted logged-in users, selling positions or transferring tokens directly to an attacker-controlled wallet. DebugBear confirmed it was dealing with a security incident and told customers to remove its script. Polymarket, which hasn’t named the vendor, referred the breach to law enforcement and pledged to make every affected trader whole. Trading restarted roughly an hour later.
Polymarket’s US exchange appears to have been untouched. This is the company’s second third-party breach in months — a similar attack in June 2026 cost traders a reported $3 million.
Source: SecurityWeek
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
Denver Health Medical Plan (DHMP) is notifying 238 083 current and former members that their personal and health data may have been exposed after an access key belonging to its analytics vendor, SquareML, was accidentally leaked on a public website.
The key went online on June 27, 2025, and stayed live until it was revoked on August 18, 2026 — a 14-month exposure window. SquareML told DHMP about the leak on August 14.
The key gave read-only access to a SquareML database holding names, birth dates, ZIP codes, plan eligibility, hospital admission and discharge data, and health metrics such as BMI, HbA1c, and eGFR values. It couldn’t be used to download, export, or change records, and no Social Security numbers or financial data were stored there.
DHMP says it has no evidence the information was viewed or misused, only that it may have been, and has reset passwords on all accounts with database access.
Source: SecurityWeek
Denver Health Medical Plan (DHMP) is notifying 238 083 current and former members that their personal and health data may have been exposed after an access key belonging to its analytics vendor, SquareML, was accidentally leaked on a public website.
The key went online on June 27, 2025, and stayed live until it was revoked on August 18, 2026 — a 14-month exposure window. SquareML told DHMP about the leak on August 14.
The key gave read-only access to a SquareML database holding names, birth dates, ZIP codes, plan eligibility, hospital admission and discharge data, and health metrics such as BMI, HbA1c, and eGFR values. It couldn’t be used to download, export, or change records, and no Social Security numbers or financial data were stored there.
DHMP says it has no evidence the information was viewed or misused, only that it may have been, and has reset passwords on all accounts with database access.
Source: SecurityWeek
