View Ridge Security
Back to Cyber Hose

Copeland XWEB Pro flaws give attackers root control of refrigeration

Claroty found 23 vulnerabilities in Copeland XWEB Pro controllers enabling root RCE, plus SAP patches and a DDoS surge report.

🕵️ RESEARCH & DEEP DIVES

  • 23 Copeland XWEB Pro flaws could give attackers root control of refrigeration systems Claroty found 23 vulnerabilities in Copeland XWEB Pro refrigeration controllers.

    • The flaws affect commercial refrigeration, air-conditioning and food-retail operators, including supermarkets, warehouses and hospitals.
    • The XWEB Pro platform contains 23 vulnerabilities, including 21 high-severity issues.
    • An unauthenticated network attacker can bypass security controls and achieve root-level remote code execution.
    • Compromised controllers can influence connected compressors, evaporators and environmental sensors, potentially spoiling temperature-sensitive goods without immediate detection. 📎 Coverage: itwire.com · 👁 via Cyber Security News

  • Malicious SIMs can hijack phones and cellular IoT devices via modem commands Researchers found malicious SIMs can hijack some phones and cellular IoT devices.

    • The risk affects smartphones, EV chargers, connected cars, industrial equipment, and routers.
    • Researchers tested 26 devices: 18 smartphones and eight cellular IoT modems; nine exposed SIM-accessible AT commands, including seven IoT modems.
    • Proactive SIM functionality lets a SIM invoke RUN AT and issue modem AT commands through the SIM interface.
    • CATANA-enabled attacks achieved code execution, arbitrary file reads, device shutdowns, cellular denial of service, and 4G-to-2G downgrades.
    • The Android locked-phone browser flaw is tracked as CVE-2025-48618; the broader findings include CVE-2026-57550 and CVD-2026-0122. 📄 Source: usenix.org · 📎 Coverage: theregister.com · 👁 via The Hacker News

  • Researchers Hire Three Suspected North Korean Operatives at Fake Crypto Startup Researchers hired three suspected North Korean IT workers through a fake crypto startup.

    • The operation targeted remote developer roles at a fabricated DeFi startup called Ballena Azul.
    • Three suspected Famous Chollima operatives obtained employee accounts and access to source code and internal systems.
    • Recruiters found inconsistent U.S. identities, mismatched state documents, proxy bank accounts and AI-processed identification images.
    • The operatives profiled issued virtual machines with dxdiag, systeminfo and wmic before checking their apparent connection countries.
    • Observed tooling included Chrome Remote Desktop, 2fa.cn, AIApply, Final Round AI, Simplify Copilot, Vultr, Gorilla Servers and AstrillVPN exit nodes. 📄 Source: any.run · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, @zackwhittaker@mastodon.social

  • Cloudflare reports 519% surge in DDoS attacks above 1 Tbps Cloudflare reported a 519% quarter-over-quarter increase in DDoS attacks above 1 Tbps.

    • Cloudflare customers worldwide were targeted, with Media, Production, and Publishing receiving 14.2% of mitigated HTTP DDoS requests in H1 2026.
    • Cloudflare mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests in H1 2026.
    • Attacks exceeding 1 Tbps rose from 130 in Q1 to 805 in Q2 2026.
    • DNS floods accounted for 40% of network-layer attacks in Q2, while CLDAP floods increased 881.9% quarter over quarter.
    • Attackers used DNS reflection and amplification techniques, including spoofed queries against open resolvers and CLDAP traffic over UDP port 389. 📄 Source: blog.cloudflare.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, Cloudflare Blog

  • US Water Utilities Get New Cybersecurity Bill and Water Watch Center US lawmakers and cybersecurity groups launched initiatives to protect water utilities from cyberattacks.

    • The effort covers US water and wastewater utilities, especially systems serving fewer than 10,000 people.
    • The Water Cyber Shield Act would expand EPA cybersecurity authority and authorize $300 million annually for water infrastructure funds.
    • The Water Watch Center was launched by DEF CON Franklin and the National Rural Water Association.
    • Five cybersecurity firms will provide managed detection and response services through the center.
    • Attackers targeted internet-facing Rockwell/Allen-Bradley MicroLogix 1100 and 1400 PLCs, changing IP addresses and passwords to disrupt monitoring and control. 📎 Coverage: securityweek.com · 👁 via SecurityWeek

📋 ADVISORIES

🔓 CVEs & KEV

  • CVE-2026-58115 — CVSS 10.0 — A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA0...
  • CVE-2026-18972 — CVSS 9.6 — Velociraptor authenticated identity-spoofing vulnerabilityAn authenticated at...
  • CVE-2026-72785 — CVSS 9.3 — Craft CMS before 5.10.6 Authorization Bypass via structures/move-elementCraft...
  • CVE-2026-69109 — CVSS 8.7 — A vulnerability has been identified in Siemens License Server (SLS) (All vers...
  • CVE-2026-69108 — CVSS 8.3 — A vulnerability has been identified in Siemens License Server (SLS) (All vers...
  • CVE-2026-50064 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50063 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50062 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50061 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50060 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50059 — CVSS 7.3 — A vulnerability has been identified in Solid Edge SE2025 (All versions before V225...
  • CVE-2026-50058 — CV

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check