💥 BREACHES & INCIDENTS
OPSSHIELD breach pushed malicious script through cPGuard update channel (versions 5.88.12–5.88.19)
An attacker compromised OPSSHIELD's update infrastructure and distributed a data-stealing script through the cPGuard update channel.- Affects cPGuard customers on Linux web hosting servers (cPanel/WHM, DirectAdmin, Plesk, standalone) who installed versions 5.88.12 through 5.88.19 on 2 November 2026
- An attacker used compromised credentials to access OPSSHIELD's update distribution CDN and pushed a malicious script via the cPGuard update channel
- The script collected /etc/shadow, /etc/passwd, root MariaDB/MySQL my.cnf, root shell history, and root SSH authorization/known-hosts files, uploading them to OPSSHIELD's licensing server under a compromised account for the attacker to retrieve
- OPSSHIELD detected the attack within 12 hours, secured the account, cleared infrastructure credentials, and released cPGuard 5.88.25 to remove the backdoor; the attacker is confirmed to have retrieved some collected data
Hackers force supermarket fridges to defrost across France and six other European countries
Hackers remotely triggered defrost cycles in supermarket refrigeration controllers across Europe, spoiling food worth millions of euros.- Supermarkets in France, Belgium, the Netherlands, Luxembourg, Sweden, Ireland, Estonia, Finland, and Romania were affected; up to 700 French stores hit, including Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc.
- Attack targeted Danfoss AK-SM800 and AK-SC355 refrigeration controllers (end-of-life since 2016/2021) and Copeland Dixell XWEB units, many exposed to the public internet.
- Controllers ran web servers reachable online, accessible with username 'admin' and a 'code of the day' bypass allowing the device's date as the password; vulnerabilities disclosed by Claroty in March 2025 and patched in Danfoss release 4.3.1 (August 2025).
- Fridges were forced into continuous defrost overnight, reaching 50°C (one store reported 80°C), triggering alarms-free spoilage, melted equipment, small fires, and sprinkler water damage.
- Estimated losses run into tens of millions of euros; Romania's DNSC reported six stores hit via GSM routers with fixed IPs running outdated software; France's ANSSI and Paris prosecutors are investigating.
🔓 CVEs & KEV
CVE-2026-86596 — clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions — CVSS 9.8 — s2Member through 260927 - Unauthenticated Remote Code Execution via 'item_name' IP...
CVE-2026-105606 — joomlaboat.com Custom Tables extension for Joomla — CVSS 9.5 — Custom Tables for Joomla: Unauthenticated File Upload Fixed in 3.7.8
CVE-2026-94290 — SUSE Rancher — CVSS 9.1 — SUSE Rancher Fleet clusters reference a kubeconfig secret...
CVE-2026-105476 — WebPros cPanel — CVSS 8.8 — Improper link resolution before file access in cPanel allows remote authentic...
CVE-2026-105475 — WebPros cPanel — CVSS 8.7 — Improper neutralization of a NUL byte in cPanel allows remote attackers to re...
🕵️ RESEARCH & DEEP DIVES
Unit 42 Threat Intelligence Highlights: Espionage, Extortion, and AI-Driven Attacks
Unit 42's Nov. 2, 2026 threat intelligence highlights detail cyberespionage, financial extortion, and rapid AI adoption across offensive threat workflows.- Applies broadly to organizations targeted by state-sponsored APTs and organized cybercrime syndicates, spanning all major industries.
- Cyberespionage campaigns focus on covertly acquiring strategic intelligence, intellectual property, and geopolitical data using living-off-the-land binaries, zero-day exploitation, spear phishing, and low-and-slow credential harvesting.
- Cybercrime activity centers on multi-extortion combining data exfiltration with ransomware or exposure threats, access via infostealer logs and unpatched perimeter assets, and BEC-driven payment diversion fraud.
- Threat actors across motivations are integrating generative AI and LLMs to craft tailored social engineering lures and synthetic personas at scale, assist rapid scripting and payload obfuscation, and support automated reconnaissance and deepfake executive impersonation.
Microsoft analysis: under 1% of published CVEs are ever exploited in real-world attacks
Microsoft published a data-driven analysis showing only about 0.5% of disclosed CVEs are exploited in the wild, concentrated in high-impact takeover flaws.- Applies to defenders prioritizing patching across Windows, Linux, mobile, network appliances, IoT/OT, and developer packages, based on Microsoft's catalog of CVEs through September 2026.
- Of roughly 383,000 CVEs disclosed since 1999, only about 2,000 (roughly 0.5%) have been linked to real-world exploitation.
- Exploited CVEs skew heavily toward server-side RCE (37% of exploited vs 20% of published), local privilege escalation (18% vs 11%), and client-side RCE (13% vs 4%); XSS and denial-of-service flaws are underrepresented.
- OS vulnerabilities rise from 23% of the overall CVE population to 41% of exploited ones, consistent with attackers favoring flaws that grant system control.
- Microsoft warns AI-assisted vulnerability discovery and exploit development could further shorten defenders' response windows, while patching critical systems can take weeks or months.
📋 ADVISORIES
📄 Source for CVE-2026-98432: Remote use-after-free in Linux kernel IPv4 TCP stack enables root RCE — aws.amazon.com
📄 Source for kaniko flaw CVE-2026-105769 leaks Azure AD tokens via malicious registry hostnames — github.com
📄 Source for Johnson Controls EasyIO Neo EC/CW Edge Controllers vulnerable to authentication bypass (CVE-2026-71450) — johnsoncontrols.com