View Ridge Security
Back to Cyber Hose

Hackers disrupt supermarket refrigeration across Europe

European supermarket refrigeration attacks hit 115+ stores, Florida breach exposes 4.9M records, and critical Langflow RCE flaws get Metasploit modules.

🚨 ACTIVE EXPLOITATION

  • Hackers disrupt supermarket refrigeration across Europe, month after French fridge attacks
    Hackers remotely changed refrigeration settings at over 115 supermarkets across six European countries, causing freezers to warm up and food losses.

    • Affects supermarkets in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia — including ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu, and Selver stores
    • Hackers remotely shut down refrigerators or activated defrost mode, in one case setting temperatures to +50°C and forcing stores to discard frozen food
    • The attack exploited the same vulnerability as the October attacks in France that hit hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers
    • Impacted freezer management interfaces were exposed to the internet; many units are end-of-life with no patch available
    • Refrigeration vendor Sabcobel said a software update alone is insufficient — units also require physical modifications or secure connection management
    Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, @GossiTheDog@cyberplace.social (+1)

  • Florida student financial aid website breach may expose data of 4.9 million people
    Hackers breached Florida's student financial aid website, potentially exposing personal data of roughly 4.9 million people.

    • Affects anyone who has applied for Florida state financial aid; ~4.9 million individuals may be impacted.
    • Potentially exposed data includes names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, and gender codes.
    • The breach affected the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org), the hub for state scholarships and grants; discovered October 19 and since contained.
    • FLDOE has not disclosed how attackers got in or who is responsible; Florida Digital Service and FDLE are assisting the response.
    • Student aid disbursements, tuition payments, and scholarship eligibility are not affected.
    Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

🕵️ RESEARCH & DEEP DIVES

  • DarkBlinders Iran-Nexus Hackers Hit Israeli Individual and Iraqi Kurdish Government Cloud
    An Iran-aligned espionage group called DarkBlinders compromised a high-profile individual in Israel and a government cloud environment in Iraq's Kurdistan Region between August and October 2026.

    • Targets include a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq, per Dream Research Labs; the group has also hit aviation and telecom targets in the U.A.E. and Iraq since at least September 2024.
    • Attacks begin with spear-phishing delivering trojanized utilities or luring victims to attacker-controlled download sites, plus credential phishing via government, webmail, and cloud-service lookalike domains.
    • Malware chain deploys SHELBYLOADER (HOTAIR) via DLL sideloading to launch the SHELBYC2 (AEROSTAT) backdoor, which uses GitHub for C2, exfiltration, and remote control.
    • A related 'Blinder Tunnel' campaign (CL-STA-1178) posed as Dubai Airports recruiters, using a fake coding assessment with AppDomainManager injection and a Blackwood tunneling utility to bypass ETW monitoring.
    • Fake videoconferencing app StarkMeet (stark-meet[.]com, stark-meet[.]online, stark-meet[.]website) also delivers ShelbyLoader V2 and SHELBYC2; Dream links the cluster to UNC5795 and Dust Specter with possible APT34 ties.
    Sources 📎 Coverage: thehackernews.com · 👁 via The Hacker News

  • Bitter APT Deploys Rust-Rewritten PapRAT in South Asian Cyber-Espionage Campaign
    The India-linked Bitter group is targeting South Asian organizations with PapRAT malware delivered via three attack chains abusing native Windows tools.

    • Targets are South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea; Bitter (TA397) has historically hit government, energy, and engineering sectors.
    • PapRAT is a custom remote access trojan giving attackers remote shell, file manipulation, screenshot capture, and payload download capabilities on Windows systems.
    • PapRAT has been rewritten from C++ to Rust, expanding from 8 to 11 commands including PowerShell execution, and switching from plaintext HTTP to HTTPS beaconing.
    • Chain 1 uses a malicious LNK file abusing ftp.exe and scheduled tasks with curl to fetch commands with no malware binary; chain 2 hides an MSI installer in a VHDX disk image with a decoy spreadsheet; chain 3 fetches an LNK via WebDAV from a URL shortcut in a RAR archive, deploying PapRAT and WmRAT.
    • Lure filenames referenced a bilateral meeting request, a Belt and Road Summit ambassador's letter, and a 2026 gala dinner invitation.
    Sources 📄 Source: fortinet.com · 📎 Coverage: infosecurity-magazine.com · 👁 via Dark Reading

  • iPhone BootROM flaws (checkm8, usbliter8) threaten offline crypto seed phrase storage
    Researchers warn that older iPhones used to store crypto seed phrases remain vulnerable to physical BootROM attacks even when offline.

    • Affects people storing cryptocurrency seed phrases on older iPhones, believing airplane mode or wiping makes them secure cold wallets.
    • BootROM flaws let attackers run code before iOS loads; BootROM is immutable chip code Apple cannot patch via iOS updates.
    • checkm8 affects iPhones through the iPhone X; the newer usbliter8 exploit (disclosed June 2026) extends attacks to A12/A13 chips: iPhone XS, XR, iPhone 11, and 2nd-gen iPhone SE.
    • Attack requires physical access: device is put in DFU mode, connected to cheap USB hardware (e.g. Raspberry Pi Pico 2), and crafted USB traffic causes memory corruption to load unsigned boot code.
    • usbliter8 does not directly compromise the Secure Enclave, so encrypted wallet secrets remain behind additional barriers; OneKey founder Yishi issued the warning.
    Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

  • Critical Langflow Flaws Let Unauthenticated Attackers Bypass Auth or Run Code; Fix Is 1.13.0
    IBM disclosed four Langflow vulnerabilities, including two critical unauthenticated flaws, affecting versions 1.0.0 through 1.12.8 and fixed only in 1.13.0.

    • Applies to organizations running Langflow, the open-source AI agent/workflow builder; every release 1.0.0 through 1.12.8 is affected, with 1.13.0 (released October 22) the only fix.
    • CVE-2026-93680 (CVSS 9.8) allows unauthenticated bypass of security restrictions via improper authentication; CVE-2026-110186 (CVSS 9.8) allows unauthenticated arbitrary code execution via improper control of code generation.
    • CVE-2026-110193 (CVSS 8.8, low-privileged account required) lets the agentic assistant generate component code that runs OS commands; CVE-2026-110192 (CVSS 6.5) exposes insufficiently protected credentials.
    • The RCE flaw is exploitable through Model Context Protocol tool enumeration; a public Metasploit module already targets CVE-2026-93680 by connecting to the MCP endpoint without credentials and listing server tools.
    • IBM also published CVE records for 29 additional Langflow flaws fixed in 1.12.4/1.12.5, including CVE-2026-104339 (CVSS 9.8, unauthenticated RCE); none of the flaws is yet in CISA's KEV catalog.
    Sources 📄 Source: ibm.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

  • CERT/CC: INFINITT PACS System Manager flaws allow code execution (CVE-2026-16305, CVE-2026-16306)
    CERT/CC disclosed two code execution vulnerabilities in INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5.

    • Affects INFINITT PACS installations running System Manager 3.0.11.3 and 3.0.11.5; fixed in versions 3.0.12.3 and 3.0.12.5.
    • CVE-2026-16305: insecure permissions on execlist.txt let a local low-privileged attacker inject commands that SmartExecute.exe runs with administrative privileges via UAC after an update.
    • CVE-2026-16306: IModular.exe executes commands from crafted imodular:// links without validation, enabling remote code execution with user privileges and unauthorized outbound connections to attacker-controlled SignalR endpoints.
    • No indications of exploitation; vulnerabilities reported by Piotr Berlinski of CyberArms.io and remediated by INFINITT Healthcare.
    • INFINITT PACS is a web-based medical imaging platform used by hospitals and clinics worldwide for storing and displaying patient scans.
    Sources 📎 Coverage: kb.cert.org · 👁 via CERT/CC Vulnerability Notes

  • 📄 Source for CISA: Max-severity GitLab CI/CD regex RCE flaw CVE-2026-97229 now exploited in the wild — cisa.gov

🔓 CVEs & KEV

  • CVE-2026-98432 — Linux — CVSS 9.8 — Mutipath TCP: Use and Detection, (Mon, Nov 2nd)

  • CVE-2026-73697 — Control Web Panel — CVSS 9.3 — Control Web Panel (CWP) before 1.16 File Write and Command InjectionControl Web Pa...

  • CVE-2026-73696 — Control Web Panel — CVSS 9.3 — Control Web Panel (CWP) before 1.12 Authentication Bypass via Execution After Redi...

  • CVE-2026-120459 — mpdavis python-jose — CVSS 9.1 — python-jose through 3.5.0 Authentication Bypass via Empty HMAC Keypython-jose...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check