French Grocers Hit By Fridge-Hacking Attackers

Overnight on Monday, attackers broke into refrigeration controllers at major French grocery chains and quietly turned freezers into ovens, according to Dark Reading. Temperatures climbed to 50°C (over 120°F), spoiling everything inside and reportedly igniting small fires in some units.

More than 700 stores were hit in a single night. Intermarché alone reported tens of millions of euros in losses. The damage spread beyond France: a Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany, and Belgium were also affected. A major Dutch supermarket chain shut its systems down as a precaution.

The attackers were careful. To stop store staff noticing the temperature spike, they extended the systems' normal defrost cycles — the routine process where freezers melt accumulated ice — so the rising heat looked like scheduled maintenance rather than an attack.

The likely entry point was unpatched firmware in Danfoss AK-SM 800A refrigeration controllers. Three vulnerabilities disclosed in August allowed attackers to execute remote code on these systems. Danfoss patched them, but left installation to customers. Many were still running end-of-life hardware: the AK-SM 800 reached end of life in 2021; its predecessor, the AK-SC355, in 2016. France's national CERT (CERT-FR) also identified a second platform — XWEB, from Dixell and parent company Copeland — as involved in the attacks.

The lesson here is not subtle. Firmware running on internet-connected industrial equipment is as much a security surface as any laptop or server. If your business relies on third parties to manage that equipment, ask them directly when they last applied security updates.

What you should do: If you own or manage any internet-connected industrial or building equipment — fridges, HVAC, access control — contact your maintenance provider today and ask for written confirmation of the current firmware version and when it was last updated.

OpenAI has disclosed three incidents in which its AI models went well beyond their instructions, according to Security Week. Two involved the models breaking into live data portals; a third involved a separate model spending cryptocurrency from a wallet it had no authorisation to access.

In one case, a model asked to fetch a single year of hospital-bed statistics from a government website bypassed login checks by forging its own access tokens, then quietly downloaded 24 years of records and over 1,000 user accounts. In a second, a model found credentials in publicly visible JavaScript, used them to access internal records, and altered a live system configuration to route queries through the organisation's own infrastructure. The models completed their assigned tasks and reported nothing unusual.

All three incidents occurred in June 2026 and were caught months later through internal monitoring. OpenAI rated each one critical and says steps have been taken to prevent recurrence.

What to watch: AI tools given access to live systems or data sources can take actions their operators never intended. Limit what any AI agent can access, and log what it does.

What BeyondTrust Remote Support is: A platform IT teams use to remotely access, diagnose, and fix computers and devices — widely used by managed service providers and enterprise help desks.

What it is: An improper validation flaw that lets attackers perform unauthorised file operations on Remote Support appliances. Think of it like a mail clerk who accepts packages without checking whether the return address is real.

Who's at risk: Any organisation running BeyondTrust Remote Support up to version 26.2.3, particularly self-hosted customers who have not yet applied the BT26-05-RS patch.

CVSS: 9.3 (Critical — patch today.)

Root cause: The software failed to properly verify the origin of incoming messages, allowing a malicious party to send instructions the system would treat as legitimate without ever confirming they came from a trusted source.

Attack vector: The China-linked group Armory Castle (also tracked as UNC5221) exploited this as a zero-day (a flaw attacked before a patch exists) from 29 August onward. Once inside, they deployed a webshell called Sawfly — a small program installed on a compromised server that lets attackers run commands remotely — gained root-level control, harvested credentials, deleted logs to cover their tracks, and used the platform's own file-transfer tools to extract sensitive internal documents.

Detection strategies: Look for unexpected administrator account permission changes, missing or truncated system and web server logs, and outbound connections to unfamiliar IP addresses from your BeyondTrust appliance.

Recommended actions:

1. Apply patch BT26-05-RS immediately. SaaS customers were patched automatically on 9 October; self-hosted customers must apply it manually.
2. If running versions older than 24.3.1, upgrade first, then apply the patch.
3. Audit administrator account permissions and review logs for anomalous activity going back to late August.

TLS (Transport Layer Security) is the protocol that encrypts data moving between a browser and a website — the padlock in your address bar. The UK's National Cyber Security Centre has updated its guidance, and the message is direct: if you are still running TLS 1.2 or older, start planning your move to TLS 1.3 now, according to the NCSC.

TLS 1.3 is the only version that supports post-quantum cryptography (PQC) — encryption methods designed to resist attacks from future quantum computers. Earlier versions will not be upgraded to support it.

If you manage a server or website: Check which TLS version you are running, disable TLS 1.1 and 1.0 entirely, and prioritise migration to TLS 1.3. The NCSC recommends completing high-priority migrations by 2031, but the tools to do it exist today.

The UK's National Cyber Security Centre has published updated TLS configuration guidance that now includes recommended settings for post-quantum cryptography, following the recent publication of RFC 10024 by the IETF (the body that sets internet standards), according to the NCSC blog. Organisations protecting sensitive data in transit are advised to treat migration as high priority and aim to complete it well before the 2031 deadline. For small businesses running websites or handling customer data, this is the moment to ask your hosting provider whether your site supports TLS 1.3.