『Hackers Cook French Supermarket Freezers; GitLab Patches a Perfect 10』のカバーアート

Hackers Cook French Supermarket Freezers; GitLab Patches a Perfect 10

Hackers Cook French Supermarket Freezers; GitLab Patches a Perfect 10

無料で聴く

ポッドキャストの詳細を見る
Hackers Cook French Supermarket Freezers; GitLab Patches a Perfect 10 Tuesday, October 13, 2026: Attackers heat French supermarket fridges through Danfoss controllers, GitLab fixes a CVSS 10 unauthenticated RCE, SonicWall's SMA 1000 SSRF is now being exploited, an access broker runs 51 Claude Code agents against Ukraine, and Ledger finds a hardware implant in reseller-sold wallets. 1. Hackers turned French supermarket freezers into ovens On the night of October 11, attackers took control of Danfoss AK-SM and AK-SC refrigeration controllers at hundreds of French supermarkets, forcing defrost and heating units to as much as 50°C. Most units hit were end-of-life AK-SM 800 and AK-SC 355 models with no further fixes; some AK-SM 800A units on outdated firmware were also hit. CERT-FR has named no entry point, and other European countries may be affected. CVE: none named for this attack (CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affect the AK-SM 800A but have not been linked to it) Do this today: find every building or refrigeration controller with an internet-facing management page and put it behind a VPN or a tight IP allowlist; for AK-SM 800A, move to current firmware (5.3.x). Source: The Hacker News 2. GitLab patches a perfect-ten unauthenticated code execution bug An integer overflow in regular expression validation in CI/CD configuration lets an unauthenticated user run code on GitLab CE/EE servers. Affects 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Three high-severity bugs were fixed alongside it. CVEs: CVE-2026-97229 (CVSS 10.0), CVE-2026-92883, CVE-2026-16301, CVE-2026-14814 Do this today: upgrade self-managed GitLab to 19.4.2, 19.3.5, or 19.2.8. Source: The Hacker News 3. SonicWall SMA 1000 perfect-ten flaw now under attack The pre-auth SSRF patched October 6 has drawn 135 exploitation attempts since October 8, per Previdian and Defused Cyber; SonicWall's advisory doesn't yet reflect exploitation. Earlier SMA 1000 zero-days in June were used to steal credentials, session databases, and TOTP MFA seeds. CVE: CVE-2026-102255 (CVSS 10.0) Do this today: apply platform hotfix 12.4.3-03670 or 12.5.0-03082, and if the appliance sat unpatched, rotate the MFA seeds and credentials it holds. Source: The Hacker News 4. Access broker ran fifty-one Claude Code agents against Ukraine SOCRadar found an exposed directory from Russian-speaking initial access broker CyberXero, showing a 51-agent Claude Code setup plus PentAGI wired to Cobalt Strike. It ran automated WordPress and e-commerce exploitation and a targeted campaign against Ukrainian energy and utilities, stealing more than 628,000 records. The operator beat refusals by claiming an authorized pentest and resetting sessions. CVEs: CVE-2026-63030, CVE-2026-60137 (wp2shell), CVE-2026-4815 (Support Board) Do this today: on WordPress, Magento, or PrestaShop, audit for rogue admin accounts and WSO web shells; check ~/.ssh/authorized_keys on internet-facing Redis hosts. Source: The Hacker News 5. Ledger finds hardware implant in reseller-sold wallet Ledger paused sales through reseller CryptoBilis after reports of stolen funds in Southeast Asia (more than $86 million, per investigator Specter) and confirmed an unauthorized hardware implant in an affected device. All confirmed cases involve CryptoBilis-sold devices. CVE: none Do this today: if you bought a Ledger from CryptoBilis in the last 90 days, don't set it up; if you already did, move assets to a new device bought direct, with a fresh seed. Source: The Hacker News More from Matt: https://www.mattchapman.net Kindle: https://www.amazon.com/dp/B0HHMH88H9 Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764https://mattchSupport the show
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません