This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
205 Comments
Tomi Engdahl says:
ICS/OT
Refrigeration Controller Hack Spoils Food Across European Supermarkets
A cyberattack targeted refrigeration controllers, setting refrigerators and freezers across hundreds of supermarkets to defrost.
https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/
A cyberattack hit hundreds of supermarkets across Europe, setting refrigerators and freezers to defrost overnight.
Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages.
The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added.
According to French news outlet BFM TV, more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros.
Supermarket refrigerator hacked
A cyberattack hit hundreds of supermarkets across Europe, setting refrigerators and freezers to defrost overnight.
Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages.
The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports.
Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected.
Cooperative U CEO Dominique Schelcher confirmed on X that several stores were affected. Cooperative U operates supermarkets under the Hyper U, Super U, and U Express and Utile brands.
“Our teams are fully mobilized, in coordination with refrigeration specialists, to restore the situation as quickly as possible. An investigation will be necessary to shed full light on this attack,” an automated translation of Schelcher’s post reads.
Advertisement. Scroll to continue reading.
Register Now: Zero Trust Summit 2026 | October 14, 2026
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented. It is unacceptable,” Schelcher added.
According to French news outlet BFM TV, more than 300 supermarket locations across France were affected. The losses are estimated to reach millions of euros.
Roughly 5% of Monoprix stores have been affected, Groupe Casino, which owns the French retail chain, told SecurityWeek, adding that no other brands it owns have been impacted. Monoprix operates over 600 locations.
“The food safety of our customers is our top priority. Any product whose storage conditions are no longer guaranteed is withdrawn from sale,” a Groupe Casino spokesperson said.
The hackers reportedly compromised refrigeration controllers from Danish company Danfoss and tampered with refrigerator and freezer settings in the middle of the night. The temperature in some equipment reportedly rose for six hours before employees discovered the issue.
“Someone remotely took over refrigeration controllers and made them defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air,” security researcher Lukasz Olejnik commented.
The large-scale attack occurred roughly two months after cybersecurity firm Claroty disclosed vulnerabilities in the Danfoss AK-SM 800A management platform that could allow attackers to bypass authentication, execute arbitrary code remotely, and inject arbitrary configuration directives.
Claroty said it identified thousands of publicly accessible AK-SM 800A management interfaces, urging customers to upgrade their systems to firmware version R4.3.1, which contains the necessary patches.
“Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences,” Claroty warned.
It’s unclear whether the attackers exploited the flaws Claroty disclosed.
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
Danfoss AK-SM 800A controllers are widely deployed to manage refrigeration infrastructure in supermarkets, cold-storage facilities, warehouses, and other commercial environments. Because these systems provide centralized management of refrigeration equipment, compromising the management interface can have significant operational consequences.
Team82 researched the attack surface of the Danfoss AK-SM 800A platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version.
Our research uncovered a hidden “code-of-the-day” authentication mechanism that could be abused to bypass normal authentication, a command-injection vulnerability leading to remote code execution, and an issue allowing authenticated users to inject arbitrary Nginx configuration directives, which could be leveraged to manipulate web traffic and trigger a denial-of-service condition.
Our analysis began by examining the internet exposure of these devices, where we identified thousands of publicly accessible management interfaces. We then reverse engineered the firmware to reconstruct the architecture of the embedded web service, ultimately tracing each vulnerability from the HTTP request handlers down to the underlying implementation.
These findings demonstrate how undocumented functionality, insecure command construction, and dynamically modifiable web server configurations can combine to create powerful attack chains against internet-accessible cyber-physical systems.
What is the Danfoss AK-SM 800A?
Danfoss is one of the largest manufacturers of refrigeration and HVAC equipment worldwide. Its solutions are deployed throughout supermarkets, cold-storage facilities, warehouses, and commercial buildings.
Among its management platforms is the AK-SM 800A, a centralized system manager responsible for coordinating refrigeration controllers throughout an installation.
From a single console, administrators can:
Monitor refrigeration circuits
Configure temperature thresholds
Review historical alarms
Adjust operating schedules
Configure notification services
Manage users and permissions
Perform maintenance activities remotely
The system effectively becomes the operational control center for Danfoss refrigeration infrastructure.
Because technicians frequently administer these systems remotely, the AK-SM 800A includes an embedded web server that exposes a browser-based management interface. This convenience significantly reduces maintenance costs, allowing engineers to troubleshoot problems without traveling to every installation.
Measuring the Danfoss AK-SM 800A Attack Surface
Before diving into the firmware, we wanted to answer a simple but important question: could an attacker actually reach these systems in the first place?
Industrial control systems are often assumed to be safely tucked away on isolated networks. Unfortunately, that assumption doesn’t always hold true.
To understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn’t take long to find what we were looking for. Numerous controllers were directly accessible from the public Internet.
Many of these exposed systems displayed the distinctive HTTP/S title of the Danfoss StoreView management interface, suggesting that administrators had exposed the web console for remote management.
For an attacker, this significantly lowers the barrier to entry. Instead of first compromising a corporate network or gaining physical access to a supermarket, they can simply scan for exposed controllers, identify devices running vulnerable firmware, and begin interacting directly with the embedded web application.
Instead of a single HTTP server processing requests, the platform implemented multiple layers of reverse proxies, CGI handlers, and application logic spread across several independent processes.
Uncovering the Code-of-the-Day (CVE-2025-41450)
Authentication code is often one of the most security-sensitive components of an embedded management platform. At this point, we focused on the request-processing logic responsible for user authentication. Specifically, we analyzed requests sent to the xml.cgi endpoint with the action=”getauth” parameter.
While analyzing this routine, we discovered a potential authentication bypass that allows an attacker to avoid the standard password verification performed against the user credentials stored on the system.
This behavior became apparent after we identified two request attributes (redacted) whose purpose was not immediately clear. When either of these attributes is included in a request, the authentication flow is redirected to a function that contains a code path leading to another function named check_code_of_day.
A closer examination of these functions revealed what appears to be a hidden authentication mechanism, likely intended for vendor support or maintenance. Instead of validating the configured administrator password, the application accepts a specially crafted authentication request containing a generated “code of the day.”
By reverse engineering the check_code_of_day routine, we were able to fully reconstruct the algorithm responsible for generating this daily authentication code. This demonstrated that anyone capable of reproducing the algorithm could generate valid authentication credentials without knowing the administrator’s password. If discovered by a malicious actor, this hidden authentication mechanism could be abused to completely bypass the normal login process and gain administrative access to the device’s web management interface.
Achieving Remote Code Execution (CVE-2025-41451)
Successfully bypassing authentication dramatically expanded the attack surface available for analysis. Instead of being limited to the small number of unauthenticated endpoints, we gained access to the device’s full administrative interface and every management function it exposed. Like many embedded management platforms, the AK-SM 800A includes a wide range of configuration pages for network settings, alarm management, user administration, email notifications, logging, and system maintenance.
When reverse engineering embedded web applications, one of the first places we look is functionality that interacts with the underlying operating system. Configuration pages that invoke external utilities are particularly attractive because they often involve constructing shell commands from user-controlled input.
The SMTP Email configuration page quickly stood out. By tracing the request responsible for updating the email settings, we eventually reached the code responsible for constructing the command executed by the operating system.
The value fetched from item number 0x1be1 is formatted into the OS shell command. This is our email authentication password. The field value being formatted into the shell command is not sanitized according to our analysis and could potentially include OS shell directives that yield subsequent commands controlled by a potential attacker.
NGINX Configuration Injection (CVE-2025-41452)
During our analysis, we noticed that the externally exposed Nginx instance includes the configuration file headers.conf as part of its server configuration.
Further investigation revealed that the web application exposes functionality for replacing this file and reloading the external Nginx instance at runtime, effectively allowing new configuration directives to be applied without restarting the device.
While testing this functionality, we discovered that an attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration. This allows an attacker to modify how requests are handled by the web server and potentially manipulate clients interacting with the device.
Coordinated Disclosure
Claroty Team82 privately reported these vulnerabilities to Danfoss through a coordinated vulnerability disclosure process. Danfoss investigated our findings and released firmware version R4.3.1, which addresses the vulnerabilities described in this research.
Customers using affected AK-SM 800A controllers should upgrade to firmware version R4.3.1 or later as soon as possible. Organizations should also avoid exposing management interfaces directly to the Internet and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.
Tomi Engdahl says:
Danfoss AK-SM 800A
https://assets.danfoss.com/documents/latest/590332/BC337629891709en-001101.pdf
Tomi Engdahl says:
Mastering the Danfoss AK-SM 800A Network Communication: Upstream & Downstream options explained!
https://www.youtube.com/watch?v=g9HgtcHEACw
In this comprehensive video, we dive deep into the Danfoss AK-SM 800A System Manager, exploring its networking and communication options. Learn about upstream and downstream traffic, how to extract data using XML commands, and the physical connections necessary for effective system management. We’ll cover everything from Ethernet setups to Modbus and Echelon communication types, ensuring you understand the best practices for connecting devices. Whether you’re an HVAC technician or a systems engineer, this guide will enhance your knowledge and help you optimize your network connections.
Key topics include:
•Overview of the AK-SM 800A system manager
•Upstream vs. Downstream communication
•Data extraction and formats
•Connection types and configurations
•Modbus and Echelon communication devices
Tomi Engdahl says:
Full story: https://www.headphonesty.com/2026/06/experts-ditch-digital-archives-format-tapes/?utm_source=fb&utm_campaign=story
Tomi Engdahl says:
What Is an AI Worm? Expert Warns of Risks to Fridges, Water Systems
Read more: https://www.newsweek.com/what-is-an-ai-worm-expert-warns-of-risks-to-fridges-water-systems-12564723?utm_term=Autofeed&utm_medium=Social&utm_source=Facebook
Tomi Engdahl says:
https://www.themoscowtimes.com/2026/10/12/ukraines-strikes-on-yandex-data-centers-explained-a93953?fbclid=IwVERDUAU8ChtleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHgLVPO4dYBFsIbWA9OGe25nSPC2JYyZhDVI732lq5sCB9ZpKSCkF4NKiWm0s_aem_0KaDOgUvn3ImokQoqlolmg
Tomi Engdahl says:
Artificial Intelligence
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.
https://www.securityweek.com/small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-anthropic-warns/
Tomi Engdahl says:
Hackers were able to cyberattack refrigerators at supermarkets in France, heating food and sparking fires in some cases. As more critical infrastructure becomes connected to the internet, cyber attacks can cause real world damage, potentially disrupting everything from food supplies to power grids across the world.
Here’s what we know as the investigation into this attack continues.
https://www.facebook.com/share/r/1KaC52UpSd/
Tomi Engdahl says:
Artificial Intelligence
AI Turns Familiar Cyberattacks Into a Race Against Time
IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses.
https://www.securityweek.com/ai-turns-familiar-cyberattacks-into-a-race-against-time/
In the AI era, phishing remains the top attack vector in both use (17% of breaches) and breach costs (averaging at $5.29 per breach) according to the IBM Cost of a Data Breach Report 2026. AI creates more personalized content for phishing with higher success rates. At the same time, AI can identify vulnerabilities, use the phished entry point and elevate privileges for lateral movement at greater speed.
None of this is new – cyberattacks haven’t changed with AI. “It just allows attackers to do the same familiar things much faster and at greater scale than ever before. The pressure comes from minimizing the time for defenders to respond,” says Steve Wallin, director of core integration and R&D labs leader at IBM UK.
For now, AI-generated attacks are still in the minority – little more than 20% of all attacks. But the writing (written by AI) is on the wall, and it is incumbent on enterprises to improve their security defenses now before the tsunami arrives in full.
SecurityWeek talked to Wallin on how enterprises should respond to this growing AI threat. Again, it is nothing new – it must just be done better.
Tomi Engdahl says:
Data Breaches
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services.
https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/
Tomi Engdahl says:
https://www.shodan.io/search?query=esmikko
Tomi Engdahl says:
https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/?fbclid=IwVERDUAU8FG9leHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHnR8OzEbvfWYmHjvZk9nVOOgKKWQjBuiNAnKYmXraWmavnyNTLIyg8sj02Ub_aem_OCyup9gt5JqeHAwNVq6zZQ
Tomi Engdahl says:
Suutarin lapsilla ei ole kenkiä: myös tietoturvan ammattilaiset luottavat yhä salasanoihin
https://etn.fi/index.php/13-news/19394-suutarin-lapsilla-ei-ole-kenkiae-myoes-tietoturvan-ammattilaiset-luottavat-yhae-salasanoihin
Tietoturva-ammattilaiset varoittavat jatkuvasti heikoista salasanoista ja puutteellisesta tunnistautumisesta. Omassa arjessaan he eivät kuitenkaan aina noudata samoja neuvoja. Yubicon ja Oktan tuoreen kansainvälisen tutkimuksen mukaan lähes puolet alan ammattilaisista käyttää edelleen perinteisiä salasanoja, ja yli neljännes on jättänyt jopa henkilökohtaisen sähköpostinsa ilman monivaiheista tunnistautumista.
Yubicon ja Oktan julkaisema Global State of Authentication Survey 2026 perustuu 1 890 teknologia- ja tietoturva-alan ammattilaisen vastauksiin yhdeksässä maassa, muun muassa Ruotsissa, Saksassa, Britanniassa ja Yhdysvalloissa.
Tulokset paljastavat selvän ristiriidan osaamisen ja käytännön toiminnan välillä. Peräti 87 prosenttia vastaajista tuntee salasanattomat passkey-tunnistautumismenetelmät, mutta 48 prosenttia käyttää edelleen ensisijaisesti käyttäjätunnusta ja salasanaa henkilökohtaisilla tileillään. Työtilien kohdalla vastaava osuus on 43 prosenttia.
Tomi Engdahl says:
Tekoäly pystyy jo murtautumaan yritysverkkoon ilman ihmistä
https://etn.fi/index.php/13-news/19398-tekoaely-pystyy-jo-murtautumaan-yritysverkkoon-ilman-ihmistae
Tekoäly on ottamassa ratkaisevaa askelta kyberrikollisuudessa. Microsoftin tuoreen Digital Defense Report 2026 -raportin mukaan kehittyneet tekoälymallit pystyvät jo toteuttamaan monivaiheisia kyberhyökkäyksiä täysin itsenäisesti. Testiympäristössä tekoäly onnistui murtautumaan yritysverkkoon, ottamaan haltuunsa keskuspalvelimen ja kaappaamaan kaikki käyttäjätilit ilman ihmisen apua.
Microsoftin mukaan Mythos- ja GPT-5.5-tekoälymallit osoittivat kykynsä toteuttaa itsenäisesti monimutkainen 32-vaiheinen hyökkäys simuloituun yritysympäristöön. Mallit suunnittelivat ja suorittivat hyökkäyksen alusta loppuun ilman ihmisen ohjausta.
Kyseessä oli testiverkko, jossa ei ollut aktiivisia puolustusjärjestelmiä. Tulos ei siis tarkoita, että tekoäly pystyisi murtautumaan yhtä helposti hyvin suojattuun yritysverkkoon. Se osoittaa kuitenkin, että tekoäly kykenee jo suorittamaan hyökkäysketjuja, jotka ovat aiemmin vaatineet kokeneen kyberrikollisen jatkuvaa ohjausta.
Microsoftin mukaan kehitys ei rajoitu enää laboratorioihin. Heinäkuussa 2026 havaittiin ensimmäinen dokumentoitu automatisoitu kiristyshyökkäys, jonka Sysdigin tutkijat nimesivät JADEPUFFERiksi. Microsoft on havainnut myös muita tekoälyn ohjaamia tunkeutumisia, joissa on samoja piirteitä.
Tällaisten hyökkäysten määrä on toistaiseksi pieni, mutta niitä on havaittu eri toimialoilla ja maantieteellisillä alueilla. Hyökkäysten alkupisteenä ovat olleet internetiin avoimet palvelut, joissa on tunnettuja ohjelmistohaavoittuvuuksia.
Tomi Engdahl says:
A Keurig Smart Coffee maker recently went rogue and allegedly uploaded 1TB of data!!!
#breakingnews #technews #keurig #aisafety #technology
https://www.facebook.com/share/v/1HfzpAA3Hh/
Tomi Engdahl says:
Verkkovarkailla on uusi kohde – et edes huomaa, kun rikolliset iskevät
https://www.is.fi/digitoday/tietoturva/art-2000012337230.html
Tomi Engdahl says:
Hyökkäys tapahtui sunnuntain ja maanantain välisenä yönä 11.–12. lokakuuta. Hyökkääjät käynnistivät kauppojen kylmälaitteiden automaattisen sulatuksen, ja osassa kauppoja laitteet pysyivät kuumina kuusi tuntia. Hyökkäys aiheutti myös tulipaloja.
Tiistaina julkaistujen tarkentuneiden tietojen mukaan hyökkäyksen kohteeksi joutui noin 300 Intermarché- ja Netto-ketjujen kauppaa, noin sata Coopérative U -myymälää, 80 Carrefouria, noin 30 Monoprix’tä sekä useita E.Leclerc-ketjun kauppoja.
Ranskan kauppaketjujen AFP:lle antamien tietojen perusteella kyberhyökkäys kohdistui yhteensä arviolta 500 myymälään. Tarkkaa kokonaismäärää ei ole vahvistettu.
Le Monden mukaan hyökkääjät eivät ainoastaan nostaneet lämpötiloja, vaan muuttivat myös sulatusjakson kestoa yhdestä tunnista kahdeksaan tuntiin. Näin kylmälaitteiden hälytykset käynnistyivät tavallista myöhemmin ja vahingot maksimoituivat.
Satoihin ruokakauppoihin iskettiin Ranskassa – miljoonavahingot, tämä tiedetään nyt
https://www.is.fi/digitoday/tietoturva/art-2000012338584.html
Intermarchén toimitusjohtaja Thierry Cotillard arvioi BFMTV:lle, että hyökkäyksen aiheuttamat tappiot voivat nousta koko Ranskassa kymmeniin miljooniin euroihin. AFP:n haastatteleman kauppiaan mukaan vakuutus ei korvaa tämänkaltaisia tappioita.
Danfossin mukaan hyökkäyksen kohteeksi joutuneissa laitteissa käytettiin vanhentuneita ohjelmistoja. Yhtiö kertoo The Guardianille kehottaneensa asiakkaitaan päivittämään järjestelmänsä ja vaihtamaan vanhentuneet laitteet uusiin. Danfoss oli julkaissut tietoturvavaroituksia kylmälaitteiden ohjausjärjestelmien haavoittuvuuksista maalis- ja elokuussa 2025.
Ranskan kaupan alan järjestö FCD on vaatinut Danfossilta täydellistä avoimuutta hyökkäyksen selvittämisessä. Osa kaupoista on jo saanut laitteistonsa takaisin toimintaan, mutta kaikkien toimintojen palautuminen voi kestää päiviä, kertoo Reuters.
Sekoia-tietoturvayhtiön asiantuntija Félix Aimé kertoi Reutersille, että hyökkäys on kohdistunut myös Espanjaan, Portugaliin, Puolaan, Saksaan ja Belgiaan.
Tiistaiaamuun 13. lokakuuta mennessä yksikään hakkeriryhmä ei ollut ilmoittautunut hyökkäyksen tekijäksi.
Tomi Engdahl says:
French grocery operator Les Mousquetaires reported 150 affected stores in its Intermarché chain, where refrigerators remained heated for six hours, forcing the disposal of all refrigerated food.
https://ground.news/article/hackers-heat-french-supermarket-fridges-sparking-fires-and-food-losses_4b45e6?utm_source=social&utm_medium=fb1
Hakkerit nostivat kylmälaitteiden lämpötiloja jopa 80 asteeseen aiheuttaen valtavan ruokahävikin. https://www.is.fi/digitoday/tietoturva/art-2000012338584.html?utm_term=Autofeed&utm_medium=Toimitus&utm_campaign=
Tomi Engdahl says:
Jarno Limnelliltä dramaattinen paljastus kotiin tunkeutumisesta – ”Oudolta tuntui”
https://www.iltalehti.fi/politiikka/a/9d742f2a-4c2e-438a-8da7-888fb1550998
Tomi Engdahl says:
https://zentalk.asus.com/t5/networking/dnssec-broken-on-gt-be98-since-yesterday/td-p/512520
Tomi Engdahl says:
Her lobbying group is raking in the cash. https://trib.al/bXkEJOF
About-Face
Senator Who Tried to Ban Prediction Markets Gets Hired by Kalshi as a Lobbyist
Her lobbying group is raking in the cash.
https://futurism.com/future-society/senator-ban-prediction-markets-hired-kalshi?fbclid=IwdGRjcAU8OFZjbGNrBTw4R2V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEerf9b34kdO-thwTE0RAUiewxtxJ_pueoBWNEPbaY5CI5lVBd7T5ljfkAvnzw_aem_RUCYV7YClHTuTecMcf2pSQ
Tomi Engdahl says:
“Cybernetics” was coined by Norbert Wiener from the Greek word for a ship’s pilot. It refers to a close association between a human and a computer; the human guides the computer as the steersman guides the ship. Later Control Data Corporation introduced a computer named the “Cyber.” Now it’s just a word or word fragment that just means “something to do with computers” like “tron” and “tronic” mean “something to do with robots or computers or things that go beep.”
Tomi Engdahl says:
https://www.facebook.com/share/r/1CuerLW348/
Hackers Use Store Refrigerators To Destroy Millions In Food. Imagine walking into your local supermarket only to find that your food supply has been turned into a weapon.
This chilling scenario just became a reality in France, where a massive cyberattack targeted remote refrigeration systems, forcing temperatures to spike to 50°C. Overnight, hundreds of stores—from Intermarché to Carrefour—watched as meat, dairy, and fresh produce were completely destroyed, with some units even catching fire. The culprits exploited outdated firmware in Danfoss controllers, leaving a trail of spoilage and millions in damages, yet no ransom was demanded and no group has claimed responsibility.
It raises a terrifying question about modern vulnerability: if cybercriminals can cripple food supplies this easily, what happens when state actors decide to weaponize our infrastructure on a national scale? A food crisis without a single shot being fired is no longer just a theory—it’s a warning.
#France #cyberattacks #Europe #crime #Franceunrest
Tomi Engdahl says:
France attack
https://www.facebook.com/share/r/19tvEQCMP5/
Tomi Engdahl says:
https://www.facebook.com/share/r/1FwHYmsb4N/
Hackers forced the temperature of fridges and freezers in many French supermarket fridges up to 122 degrees Fahrenheit overnight, causing fires and spoiling food at several hundred stores in a major cyber attack. Julien Freret, the director of an Intermarche store in La Haye, apologized to its customers after the shop’s refrigeration was hit by a cyber attack.
Comments:
New cars come with a “kill switch”. They are all connected to the Internet, one well-known brand even boasts that their car is connected to G**gle permanently. Remote “services” can block your car so it won’t start. They also come with internal cameras and facial recognition.
In the future “so as not to have much bigger surprises” we must avoid building our home appliances (refrigerators, washing machines…etc.) with Internet Connection, (I mean I’m not demonizing technology)…BUT…to avoid “unpleasant surprises” in the future we must build home appliances and electrical appliances without Internet Connection (Internet Connection is like “a double-edged sword” it simplifies our lives but can also ruin our lives)…
That is cold and calculated
The entire west treats cybersecurity as a joke. This is going to happen more and more until companies and governments get serious about it.
A Supermarket has dozens of fridges, If one fails it’s able to alert the maintanence company automatically, even if it’s 1am. So they can send a tech in before all the fish fingers melt. BUT it was very poorly secured (not at all really), and old / outdated equipment had security flaws.
Will an AI company admit this is another rogue “experiment”?
who was responsible for the raising of temperatures of these internet freezers? i did not know that shop freezers were connected to the internet. a pretty dumb idea IF the story is true?
The real dangers of things connected to the internet. And the terrible damage hackers can inflict. Isn’t this reason enough to stop connecting everything to the internet? You’re never going to outsmart hackers, esp with AI going wild – hackers with unlimited brain power.
Tomi Engdahl says:
Anything on the internet has to be hardened. Or should not be on the internet. or should have one-way status connection, not remote control.
Tomi Engdahl says:
No PIN. No owner interaction. Root access.
A 3-flaw chain in LG webOS can give attackers on the same local network root access to certain smart TVs.
Demonstrated on two models.
Read: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html
Tomi Engdahl says:
In an unprecedented cyberattack, hackers hit the refrigeration and freezer systems of hundreds of supermarkets across France, raising temperatures to as high as 122 degrees. The attack sparked multiple fires and spoiled food at stores across the country.
https://www.facebook.com/share/r/1d6NatpFYE/
Tomi Engdahl says:
Ukrainian officials said Wednesday that Elon Musk’s SpaceX had imposed restrictions on its military use of the Starlink satellite internet service without warning, disrupting frontline drone operations, amid growing tensions between Kyiv and Washington over President Donald Trump’s declaration of an “energy ceasefire” in the war with Russia.
https://www.forbes.com/sites/siladityaray/2026/10/14/ukraine-says-musks-spacex-is-restricting-its-starlink-military-use-drone-missions-affected/?utm_campaign=forbes&utm_medium=social&utm_source=facebook&utm_term=se-breaking&fbclid=IwVERDUAU8SF9leHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHk3LMu_YLtZ-vjOl2ynbudgbAxjXSFBu0PC6tRiPj8Kx7NNPCLInWaeAcOuQ_aem_Bzmu6tcC9PgSdXxrfptp8g
Tomi Engdahl says:
Microsoft put in a tiny link that let you create a local account on Windows. They’ve now removed it.
Source: https://go.ufdmedia.com/sDXQXN
Tomi Engdahl says:
Microsoft sells AI. Nadella says to trust it least.
Satya Nadella is the chief executive of Microsoft.
He says any AI model at work could go wrong.
An authorised person should always be able to stop it mid-task.
Failures should be reported quickly to the people they affect.
Even the people selling AI now say it needs watching.
Read more on TNW: https://thenextweb.com/news/nadella-ai-models-insider-risks-emergency-brake
Tomi Engdahl says:
Microsoft just broke its Patch Tuesday record: 1,413 vulnerabilities patched in one release.
One Windows Shell flaw (CVE-2026-96951) is already being exploited in attacks and can bypass Mark of the Web defenses.
Read: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html
Tomi Engdahl says:
https://hackaday.com/2026/10/09/this-week-in-security-new-spectre-attacks-crushing-quantity-of-linux-vulns-google-gets-too-much-ai-and-hacking-lawnmowers/
Tomi Engdahl says:
https://cybernews.com/security/danfoss-refrigeration-hack-france-supermarkets/?utm_source=cn_facebook&utm_medium=social&utm_campaign=cybernews&utm_content=post&source=cn_facebook&medium=social&campaign=cybernews&content=post&fbclid=IwVERDUAU8V3lleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHmvZ5DtPRfvfB1tlVWOFZv8kHmDtzoYInJAFEGwn6yKEMB6dDtTklo0T1SPo_aem_v6UbHmtddGPq2eKqmbluJA
Tomi Engdahl says:
Anthropic said in a new warning that small AI models may be months away from being capable enough to self-replicate on devices such as smart ovens and off-brand Android TV boxes.
https://abcnewslive.visitlink.me/AtLJkD
Tomi Engdahl says:
Kollegalta kovaa arvostelua Jarno Limnellille: “Ei millään lailla järkevää”
Kansanedustaja Vilhelm Junnilan mielestä Jarno Limnellin ei olisi pitänyt kertoa omista ja työyhteisönsä turvallisuuspoikkeamista julkisesti.
https://www.iltalehti.fi/politiikka/a/9236b031-26ff-475f-a285-51c2436efb8f
Kansanedustaja Vilhelm Junnila (ps) arvostelee kovin sanoin kollegansa Jarno Limnellin (kok) toimintaa.
Limnell kertoi keskiviikkona Iltalehden Ukkola-ohjelmassa, että hänen kodissaan on käynyt luvatta ulkopuolinen henkilö muutama viikko sitten.
– Turvallisuudella profiloitunut kansanedustaja Limnell menee julkisuuteen kertomaan omista ja työyhteisönsä turvallisuuspoikkeamista. Tämä on malliesimerkki siitä, miten ei ainakaan tule toimia. Toivoisi, että harkintakykyä löytyisi julkisuudenkaipuuta enemmän, Junnila kirjoittaa viestipalvelu X:ssä.
Limnell kertoi, että hänen kodissaan oli useita merkkejä siitä, että siellä oli käyty. Hän ei avannut kuitenkaan merkkejä sen tarkemmin, koska poliisitutkinta on kesken.
Iltalehti kysyi Junnilalta, millä tavalla Limnellin toiminta voisi olla haitallista.
– On tärkeää, että mahdollisista turvallisuuspoikkeamista uskalletaan ilmoittaa avoimesti organisaation sisällä. Jos mahdolliset poikkeamat uhkaavat muuttua poliitikon julkisuusvälineeksi, voi ilmoituskynnys nousta ja turvallisuuden kannalta arvokasta tietoa jäädä saamatta, Junnila viestittää.
Tomi Engdahl says:
A Linux kernel flaw can let an untrusted VM hijack its host’s QEMU process in specific setups.
Dubbed Vghost (CVE-2026-74580), the AI-assisted discovery also enables local root escalation for users with vhost device access.
Read: https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html
Tomi Engdahl says:
Claroty researchers used Claude to recreate a supermarket refrigeration controller attack in 28 minutes for about $6. More: https://cnews.link/hackers-disable-supermarket-fridge-claude-ai-costs-6-dollars/
Tomi Engdahl says:
Kyberhyökkäys aiheutti miljoonatuhoja ruokakaupoissa – tämä on tilanne Suomessa
Markettiketjujen vastauksissa oli eroja.
Kyberhyökkäys aiheutti miljoonatuhoja ruokakaupoissa – tämä on tilanne Suomessa
https://www.is.fi/digitoday/tietoturva/art-2000012338822.html
Lue tiivistelmä
Sadat ranskalaiset supermarketit joutuivat kyberhyökkäyksen kohteeksi, jossa hakkerit ohjasivat kylmälaitteita etänä aiheuttaen ruokahävikkiä ja tulipaloja.
Suomalaiset päivittäistavaraketjut Kesko, S-ryhmä ja Lidl kertovat varautuneensa vastaaviin uhkiin, mutta ketjujen avoimuudessa oli eroja.
SOK:n riskienhallinnan päällikkö Janne Ahtoniemi kertoo, että suojaus perustuu monikerroksiseen malliin eikä automaatiolaitteisiin kohdistuvaa hyökkäysaaltoa ole havaittu.
Keskon johtaja Juho Rikala toteaa, että yhtiö on viime vuosina panostanut erityisesti kauppojen kylmälaitteiden tietoturvaan.
Voisiko sama tapahtua Suomessa? Kysymys nousi esiin, kun kun sadat ranskalaiset supermarketit kertoivat joutuneensa poikkeuksellisen hyökkäyksen kohteeksi sunnuntain ja maanantain välisenä yönä.
Hyökkäyksessä ohjattiin kauppojen kylmälaitteita etänä. Hyökkääjät käynnistivät kylmälaitteiden automaattisen sulatuksen verkon kautta, minkä seurauksena jääkaappien ja pakastinten lämpötilat nousivat peräti 80 asteeseen johtaen isoon ruokahävikkiin ja tulipaloihin.
Tämä kyberhyökkäyksestä Ranskassa tiedetään nyt
Iskun kohteeksi joutuneiden kauppojen määräksi on varmistumassa ainakin 700. Ranskassa on noin 10 000 ruokakauppaa.
Hyökkäykset jatkuivat aiempaa luultua pidempään. Hyökkääjät iskivät 12.–13. lokakuuta myös amerikkalaisen Copeland-yhtiön Dixell-kylmäjärjestelmiin tanskalaisen Danfossin lisäksi.
Mikään taho ei ole ottanut vastuuta hyökkäyksestä, mikä on aiheuttanut kummastusta. Yleensä poliittiset toimijat ilmoittautuvat saadakseen julkisuutta ja rikolliset esittävät lunnasvaatimuksia.
Reuters totesi selvityksessään, että internetissä on näkyvissä 4 500 Danfossin hallintaliittymää.
Tomi Engdahl says:
Tietoturva
Hakkerit aiheuttivat valtavaa tuhoa ruokakaupoissa – tämä tiedetään nyt
Hyökkäys oli luultua suurempi.
Hakkerit aiheuttivat valtavaa tuhoa ruokakaupoissa – tämä tiedetään nyt
https://www.is.fi/digitoday/tietoturva/art-2000012341120.html
Lopputuloksena oli tulipaloja ja pilaantunutta ruokaa jopa kymmenien miljoonien eurojen edestä.
Alkuperäisten arvioiden mukaan iskujen kohteeksi joutui noin 500 kauppaa. Nyt määrä on tarkentumassa 700:aan, kertoo AP talousministeri Roland Lescurea lainaten. Ranskassa on noin 10 000 ruokakauppaa.
Ministerin mukaan kaupat olivat irrottaneet kyseiset järjestelmät verkosta ja ryhtyneet täydentämään hyllyjään. Maan elintarvikehuolto ei ole vaarantunut.
Hyökkäykset myös jatkuivat aiemmin luultua pidempään. Hyökkääjät jatkoivat iskujaan maanantaina ja tiistaina 12.–13. lokakuuta. Silloin kohteena olivat amerikkalaisen Copeland-yhtiön Dixell-kylmäjärjestelmät, kertoo Le Monde.
Bordeaux’n alueella sijaitsevan kaupan pakastimien tavoitelämpötila muutettiin −22 asteesta +150 asteeseen. Henkilökunta ehti estää vahingot.
Reuters totesi selvityksessään, että internetissä on näkyvissä 4 500 Danfossin hallintaliittymää. Ei ole tietoa, moniko niistä on haavoittuva. Niiden ei kuitenkaan tulisi olla avoimia verkon suuntaan.
Suurin avoin kysymys on iskujen tekijä. Mikään taho ei ole ottanut vastuuta hyökkäyksestä, mikä on aiheuttanut hämmennystä. Yleensä poliittiset toimijat ilmoittautuvat saadakseen julkisuutta, ja rikolliset esittävät lunnasvaatimuksia.
Italialaisen La Repubblican mukaan epäilyjä on kohdistettu Venäjään. Epäilyille ei ole kuitenkaan vahvistusta.
Ranskan kyberturvallisuusviranomainen varoittaa uusista iskuista ja pitää niiden jatkumista todennäköisenä.
Tietoturvayhtiö Check Pointin uhkatutkimusjohtaja Oded Vanunun mukaan hyökkäys itsessään oli varsin yksinkertainen eikä edellyttänyt merkittävää kyberosaamista.
– Kylmäjärjestelmissä on normaaleja toimintoja, kuten automaattiset sulatusjaksot, joita ulkopuolinen voi hyödyntää toiminnan häiritsemiseen saatuaan luvattoman pääsyn järjestelmään.
Tomi Engdahl says:
Vastaavanlaisiin etähallintajärjestelmiin perustuvat kylmäjärjestelmien ohella muun muassa lämmitys-, ilmanvaihto- ja ilmastointijärjestelmät sekä kiinteistöautomaatiojärjestelmät.
Tomi Engdahl says:
This is the $24 gizmo the FBI says was used to bug OpenAI’s offices : https://mrf.lu/264Vw
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/the-blind-spots-of-agentic-pentesting-and-how-to-close-them/amp/?fbclid=IwVERDUAU8zpxleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHi_xI06VaePPVWu9pcMNzJ0npPIL2Dhfu2nejVYoAiGALumQwEwxnWOpfQKm_aem_TA8sBfTYlY10a5ZbWdPfTA
Tomi Engdahl says:
’123456′ password linked to Denmark data breach affecting 8.8M people
Local media reports three weakly protected accounts at small IT biz whose access to national register was abused
https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726
A person claiming responsibility for the breach of Denmark’s Central Register of Persons (CPR) says they gained access through an IT company’s account protected by the password “123456.”
The person told Danish news outlet Politiken they had no intention of selling or leaking the data. The newspaper reported that at least three company accounts, including an administrator account, used the same password.
Denmark’s CPR administration confirmed a breach affecting the information belonging to 8.8 million people on October 5, adding that a Danish company’s legal access to the CPR system was abused.
Tomi Engdahl says:
AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
In Booz Allen’s isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes.
https://www.securityweek.com/ai-agents-navigate-unfamiliar-ot-systems-and-move-equipment-in-minutes-booz-allen-finds/
A new report from Booz Allen demonstrates that “frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes.”
The findings of the report were presented last week at SecurityWeek’s Industrial Control Systems (ICS) Cybersecurity Conference in Nashville, ahead of the public release.
Use of the term ‘super intelligence’ is, however, confusing. This is not the first time the firm has used it, but it seems to be indistinguishable from the more common term of artificial intelligence (AI). It also quickly follows Donald Trump’s September 29, 2026 Executive Order to “replace the term ‘Artificial Intelligence’ (‘AI’) with ‘Super Intelligence’ (‘SI’) in the executive branch.”
The problem, however, is that ‘superintelligence’ (one word) has long been used for a specific quality of AI. It was defined by Oxford philosopher Nick Bostrom in 2014 as, ‘Any intellect that greatly exceeds the cognitive performance of humans in virtually all domains of interest.’ It is consequently more akin or superior to artificial general intelligence (AGI), which is in turn superior to common or garden AI.
So, is Booz Allen referring to frontier AI in line with Trump’s executive order, or something more advanced in line with Bostrom’s ‘superintelligence’? The world of AI is suffering from a lack of consistent and formal definitions; but we’ll assume that Booz Allen is using ‘super intelligence’ to indicate the improving capabilities of contemporary artificial intelligence rather than a new type of AI. (SecurityWeek reached out to Booz Allen for clarification on the terminology but had received no response at the time of writing.)
Tomi Engdahl says:
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
The company says it took some of its systems offline to contain a security issue within its network.
https://www.securityweek.com/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/
Tomi Engdahl says:
https://www.reuters.com/business/ai-models-may-soon-self-replicate-without-access-data-centers-anthropic-warns-2026-10-13/
Tomi Engdahl says:
The stark contradiction between two popular AI narratives—”We urgently need gigawatt-scale data centers and hundreds of billions in capital expenditure” versus “An AI can self-replicate onto a toaster or smart fridge and take over”
The AI comes nowadays in many sizes and capabilities:
To run a modern frontier model (like Claude 3.5 Sonnet, GPT-4o, or Gemini 1.5 Pro), you need hundreds of gigabytes of VRAM and high-bandwidth interconnects (like NVLink) just for inference, let alone training.
Smart TVs / IoT: An IoT device typically runs on a low-power ARM architecture with 512 MB to a few GB of RAM and very limited processing capability. At best, an IoT device can run a tiny, heavily quantized local model (like a 1B–3B parameter SLM) at a few tokens per second.
There are also AI models you can run on your PC, they are less capable than those run on cloud. With AI assisted software development a typical approach is hybrid approach where there is a simpler AI running on developer PC and there is connection to bigger model in cloud. Tasks are then allocated between then automatically.
It is also possible to build small models tuned to a very specific task that run on a small device processor. I have tested few AI examples with micro:bit v2 small development board designed for experimenting and teaching. In one demo application the board detected different hand movement pattern I have teached for model to detect (collected movement data with board, teacher model on PC and uploaded optimized model to Micro bit 2 board to run). Small devices can do some AI, but very limited.
The Contradiction: If edge devices were capable of running dangerous, highly autonomous artificial general intelligence, the multi-billion-dollar push for hyperscale data centers would indeed be absurd. A swarm of low-power edge devices cannot replace the massively parallel tensor processing required for advanced AI reasoning.
Tomi Engdahl says:
The project could not be restored, wiping out hundreds of days of work, according to Swedish newspaper Aftonbladet.
Entire Swedish reality show season lost weeks before premiere amid disputed AI claims
https://www.euronews.com/2026/10/14/entire-swedish-reality-show-season-lost-weeks-before-premiere-amid-disputed-ai-claims?fbclid=IwVERDUAU9hNVleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHvcmxj3x8zehCT28zfJw7Jh4-vvd8bRbCY4u4dV1GTn8Dgbz2tH3aIf6h1LL_aem_iJh70SECBU4E6zw-ff-3cg
The project could not be restored, wiping out hundreds of days of work, according to Swedish newspaper Aftonbladet.
An AI agent reportedly deleted an entire edited season of a Swedish reality show just five weeks before its planned premiere, forcing the broadcaster to postpone its release until next year.
Swedish newspaper Aftonbladet, citing unnamed sources, reported that the production company behind a reality show named The Challenge Sverige had given an AI agent access to its server, where it deleted the completed season.
The project could not be restored, wiping out hundreds of days of work, according to the report.
Swedish commercial broadcaster TV4 confirmed to Aftonbladet that a “technical failure” had caused the loss, pushing the planned 22 November premiere back to 2027.
Although the Swedish TV channel has rejected the AI explanation in this case, other incidents have exposed the risks of systems that can act on users’ behalf.
In a report published on Friday, Anthropic said models given impossible tasks could pursue “unintended and sometimes misaligned strategies to achieve their goals”.
In July, its Claude Haiku 4.5 model submitted fabricated information about an unsolved homicide to the US police website while performing example tasks.
TV4 said all the original footage of the show remains available but the season must be edited again from scratch.
Tomi Engdahl says:
Read as, “Their prompt engineer, it dept, managed service providers, and disaster recovery and preparedness people all sucked at their jobs.”