🚨 ACTIVE EXPLOITATION
Hackers raise supermarket fridge temperatures to 55°C in Sweden and Belgium attacks
Hackers remotely hijacked supermarket refrigeration systems in Sweden and Belgium, heating freezers to 55°C and spoiling food.- Dozens of ICA and six Coop stores in Sweden, plus at least 40 Delhaize and 15 Carrefour stores in Belgium, were hit overnight into November 2, 2026.
- Freezers and fridges were remotely turned up to as much as 55°C, ruining stock; damage estimated in the millions of euros.
- The attacks follow an October wave in France affecting up to 700 supermarkets, including 300+ Intermarché and Netto stores.
- Targeted equipment includes Danfoss AK-SM 800 and AK-SC 355 controllers, plus Copeland and Dixell xweb devices, often exposed directly to the internet via 4G modems.
- The end-of-life Danfoss models no longer receive security updates; Claroty showed the login uses 'admin' and a predictable 'code of the day' derived from the device date.
Sources 📄 Source: cert.ssi.gouv.fr · 📎 Coverage: trendingtopics.eu · 👁 via @GossiTheDog@cyberplace.social, Cyber Security NewsChina-linked hackers use open-source ARTEX agentic AI pentesting framework in attacks on 200+ organizations
Threat actors including China-linked groups are using the open-source ARTEX agentic AI penetration testing framework to automate large-scale intrusions.- Targets include government, financial, telecom, semiconductor, defense, and think tank sectors worldwide; CrowdStrike attributes a 200+ organization campaign to China-linked Vapor Panda, with confirmed post-exploitation at nine organizations
- ARTEX is a Go-based multi-agent LLM pentesting and C2 platform (with Next.js frontend) that autonomously performs reconnaissance, vulnerability identification, Kerberoasting, DCSync, lateral movement, and OAuth/Microsoft Graph abuse; its author pulled the GitHub code in October 2026, but forks like ScopeWeaver and ARTEX PRO continue to spread
- Attacks pair ARTEX with LLMs such as DeepSeek, using planner and worker agents that pursue multiple attack paths in parallel (web apps, cloud, containers, Active Directory, VPN) with a human operator steering; one intrusion consumed ~1.4 billion input tokens
- Microsoft ties ARTEX to Storm-0940's ConnectWise supply chain compromise, achieving privileged cloud access in under 3 hours in some cases; activity bursts run 2-25 seconds, trading stealth for speed
- IOCs include webhook.site C2 output via curl to 491 rotating URLs, artex-probe-* files, JSP web shells (cl1217.jsp, f1219a.jsp, z1219.jsp) planted via MySQL log poisoning, and ArtexProbe account names
💥 BREACHES & INCIDENTS
WS Audiology Investigates IT Breach Disrupting Widex and Signia Hearing Aid Apps
WS Audiology is investigating unauthorized access to its IT systems, disrupting Widex and Signia hearing aid apps while the devices themselves remain unaffected.- WS Audiology (WSA), parent company of Widex and Signia, identified unauthorized access to parts of its own IT infrastructure and disconnected selected internal and customer-facing systems to contain the threat.
- Affected services include the Widex MOMENT app (some wearers lost access to listening settings), Widex Compass Cloud (taken offline as a precaution, later restored), and Signia TeleCare (expected back early the following week).
- Widex and Signia hearing aids themselves were not affected and can still be fitted and fine-tuned; WSA's e-commerce sites remained functional.
- WSA has not disclosed how attackers entered, which systems were accessed, or whether data was stolen; no malware family, exploited CVE, or IOCs have been published.
- HearingTracker also referenced a separate July 2024 WSA breach of the Bloomhearing retail IT system in Australia and New Zealand that exposed patient and employee personal data, though no link to the current incident has been established.
Supermarket freezers hit by suspected cyber-attack across Sweden, Belgium and Luxembourg
Hackers are suspected of remotely raising supermarket fridge and freezer temperatures across Sweden, Belgium and Luxembourg, spoiling food in dozens of stores.- Several ICA locations and six Coop stores in Sweden were affected overnight into November 2, with freezers reaching temperatures as high as 55°C.
- Ahold Delhaize reported an 'IT incident' affecting fridges and freezers in dozens of supermarkets in Belgium and Luxembourg, including five Spar outlets, Shop & Go stores and Proxy Delhaize minimarkets.
- The incidents follow an October attack on up to 700 French supermarkets in which hackers pushed freezers from -27°C to over 50°C, causing losses up to €270,000 per store and fires.
- In the French attack, hackers pirated Danfoss-supplied controllers, disabled alarm systems, and adjusted thermostats or extended defrost programmes by hours.
- No connection between the Swedish and French attacks has been confirmed, and no specific vulnerability or attacker has been identified in the Swedish incidents.
🔓 CVEs & KEV
CVE-2026-18199 — Zohocorp ManageEngine Password Manager Pro — CVSS 8.8 — Remote Code Execution VulnerabilityZohocorp ManageEngine Password Manager Pro...
CVE-2026-8923 — Zohocorp ManageEngine Eventlog Analyzer — CVSS 8.7 — Remote Code ExecutionZohocorp ManageEngine Eventlog Analyzer and ManageEngine...
CVE-2026-2613 — WSO2 API Manager — CVSS 8.7 — SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database In...
CVE-2026-117518 — @fastify/reply-from — CVSS 8.2 — @fastify/reply-from vulnerable to path traversal via backslash dot-segment pr...
🕵️ RESEARCH & DEEP DIVES
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS Misconfigurations to Steal Company Data
Microsoft investigated two intrusions where attackers posing as IT support on Microsoft Teams gained remote PC access and abused AD CS misconfigurations to steal privileged certificates and company data.- Applies to organizations using Microsoft Teams, Active Directory Certificate Services (AD CS), and Windows domain environments.
- Attackers posed as IT/help desk staff from outside Teams tenants, talked employees into opening Quick Assist and reading back the connection code, gaining hands-on control of workstations.
- They dropped archives disguised as Windows updates and ran them with portable Python, Bun, or Java runtimes; three initial-access script SHA-256 hashes were published by Microsoft.
- Case 1 exploited an ESC1 certificate template allowing requesters to name any account, yielding certificates for privileged accounts; the attacker ran DCSync on a domain controller and used renamed Rclone to copy file-share data to an external SFTP server.
- Case 2 used PetitPotam NTLM coercion relayed to the AD CS web enrollment page (ESC8) to obtain a domain controller certificate and a TGT via PKINIT; no Teams software flaw was exploited and no group was attributed.
CL-UNK-1211 espionage campaign targets government Linux servers with SysGoRAT and AI-generated scripts
Unit 42 tracked an AI-assisted espionage campaign, CL-UNK-1211, targeting government Linux infrastructure with web shells, credential theft, and a custom Go RAT.- Targets government entities and state-affiliated Linux infrastructure; activity observed October 2025 through April 2026.
- Attackers deployed custom and open-source PHP web shells, hijacking auto_prepend_file across /etc/php/ and /opt/plesk/php/ for persistence, and planted a web shell at /usr/lib/php/plesk_sys_driver.php.
- Credentials were stolen by hijacking .bashrc with a fake sudo alias logging passwords to Solarwinds.StatusLog.txt, injecting code into PHP login pages, and scanning for cleartext email, SMTP, and database passwords.
- A custom Go-based RAT, SysGoRAT, connects over WebSocket to hard-coded C2 at 104.194.158[.]65:443, supporting command execution, screenshots, file exfiltration, persistence, and proxying; in-memory reverse shells avoid disk artifacts.
- Payloads contained AI-generated conversational comments across PHP, Bash, Python, and JavaScript; privilege escalation used PwnKit (CVE-2021-4034) and LinPEAS, and attackers scanned for CVE-2025-55182 (React2Shell); exfiltration hit government mailboxes and full database dumps, followed by log deletion, timestomping, and fake red-team markers.
Researchers could have backdoored Bash via GNU Savannah command injection flaw
Researchers demonstrated a command injection in GNU Savannah that gave code execution and the ability to add an SSH key with push access to the upstream Bash repository.- Affects GNU Savannah (savannah.gnu.org and savannah.nongnu.org), running savane 3.17-c369 released March 7, 2026.
- A crafted email address (e.g. containing ${IFS}) in the GPG key management workflow was passed unsafely to a shell command, giving any logged-in user code execution on the backend (HCK-001).
- From there, researchers escalated to root via unpatched OverlayFS bugs CVE-2023-2640 and CVE-2023-32629 on Trisquel 11's 5.15 kernel, gaining access to a GNU backup server.
- The researchers made their account a superuser, impersonated Bash's maintainer, and confirmed they could add an SSH key with push access to the upstream Bash repository.
- Hacktron reported the issue to the FSF on May 11, 2026; FSF patched savane and installed a fixed kernel (5.15.0-177.187+11.0trisquel31) on May 14, and found no evidence of supply chain compromise.
WordPress pingback fetches shown to reach Brotli decoder flaw CVE-2026-111497 for RCE
Fortbridge researchers demonstrated that WordPress pingback fetching can trigger the Brotli decoder out-of-bounds write