France has turned up the heat on Iran over destructive cyberattacks targeting refrigeration controllers at more than 700 grocery stores in October, spoiling food and sparking fires. The country vowed to take action using “all available means of response.” The supermarket attacks, which affected Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros, according to a Monday report by France’s Cyber Crisis Coordination Centre (C4). The C4 includes the National Cybersecurity Agency of France, the Directorate General for External Security, the Directorate General for Internal Security, the Directorate General for Armament, and the Cyber Defence Command. “This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory,” France’s Ministry for Europe and Foreign Affairs said in a statement. All signs point to CyberAv3ngers Both the report and the statement attributed the refrigeration controller hacks to the Iranian Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit. The Shahid Kaveh unit, which French national security officials say is led by Reza Salarvand and Mahdi Lashgarian, is better known by its hacktivist personas, including CyberAv3ngers. This is the same crew suspected of involvement in the July attacks that targeted more than 100 internet-exposed water systems in America. While the US government hasn’t attributed the intrusions to any country or group, private-sector security analysts blamed Iran, and specifically CyberAv3ngers. The IRGC-affiliated hacking crew has been breaking into industrial controllers for years, and in 2023, American national security and law enforcement agencies attributed a series of cyberattacks against "multiple" US water facilities to CyberAv3ngers. “The Iranian cyber threat against French interests is not new,” according to the Ministry for Europe and Foreign Affairs. “Iran has already carried out several destabilizing acts against us, notably targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.” Since at least June 2024, the Shahid Kaveh unit has had the ability to scan, access, and control industrial control equipment from Schneider Electric, Siemens, and Rockwell, the French government said in its report. It pins the refrigeration controller hacks on this particular Iranian crew for a couple of reasons. Making the case for attribution First: the infrastructure used to carry out the October supermarket attacks was also used during this timeframe to conduct reconnaissance on Schneider Electric equipment, zeroing in on small- and medium-sized energy and water production units. “The techniques used during these actions are known to have been used by the Shahid Kaveh unit since at least April 2026,” the report says. It also notes that investigators found “traces of Farsi use” in the attack infrastructure. Plus, Iranian media outlet CyberbanNews, which is reportedly linked to the Shahid Kaveh unit, publicized the incidents that occurred late on October 11 and into October 12 extremely quickly: “as early as October 13.” In early November, similar cyberattacks on commercial refrigerators and freezers were reported across Europe, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden reporting widespread food losses after miscreants spiked temperatures to as high as 122°F (50°C). Last week, the US federal government urged owners and operators to take security measures to prevent these types of attacks from spreading to America. France fights back The French government, for its part, said that it would “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.” This includes proposing additional EU sanctions against Iranian entities and individuals involved. France also vowed to express “its strongest condemnation of these cyberattacks” to the Iranian ambassador. However, the country didn’t rule out responding with more than just harsh words: “France reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.” ®

AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]

Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...]

Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]

N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems. [...]

York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]

France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires. [...]

A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]

Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. [...]

Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]

AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy, agent governance, and communication. [...]

A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]

The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]

Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. [...]

How many AI tools are running across your environment right now? If you are guessing at this number, and that worries you, you are in good company.

ON SECURITY By Susan Bradley Recently, we were looking for something to solve a problem at the office.  Rather than spin my wheels looking for the best way to get software A (an Excel spreadsheet) to talk to software B (a line-of-business app that has a SQL backend), I reached out to someone on the […]

Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets. Qubole is a cloud data processing platform that uses cross-account IAM roles to manage compute and access storage in customers' AWS environments without requiring customers to provide long-lived AWS access keys. The supply-chain attack abused this third-party, cross-account trust relationship. Google’s cloud-security shop Wiz declined to tell us how many organizations were affected, but called it a “broad, opportunistic supply chain campaign” that hit “multiple” customer environments. “Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data,” the researchers told The Register in an emailed response to questions. Neither AWS nor Qubole responded to The Register's inquiries. Wiz, working with Google's Mandiant incident responders after AI data security company Sentra flagged suspicious activity, traced the malicious activity back to October 14, when credentials associated with Qubole's AWS account were used to call the sts:AssumeRole API to obtain temporary credentials for customer-managed integration roles. The calls originated from Qubole AWS account 805246085872, and used IAM user ID AIDA3W7DIFLYOLTK63SFS, Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read said in a Monday blog about the supply chain attack. “Across the affected environments, Wiz CIRT has not observed this IAM user in any activity other than that associated with this threat actor,” the trio wrote. This activity continued on October 15, and on October 18, the digital intruders began using a second IAM user from the same account. Once inside customers’ environments, the crooks began probing a ton of AWS services and stealing credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store. The miscreants also used TruffleHog to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials also uncovered while snooping around the AWS environments. Abusing the integration roles also allowed the criminals to steal data from customers’ S3 storage, although it seems they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data. The threat hunters haven’t attributed the supply chain attack to any particular group, and say they don’t have any insight into how the miscreants are using the stolen data. While investigating this incident, Wiz spotted a separate campaign between October 8 and October 11 that also used customer-owned AWS access keys for Qubole integrations. While a “small number” of these also resulted in the intruders compromising victim organizations’ AWS environments, Wiz said it can’t definitively connect the two sets of malicious activity. Organizations that have integrated with Qubole should rotate credentials - although rotating a credential does not end temporary sessions that were already issued. Customers should also review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses. “For every role session you find, review all subsequent activity from that session, especially Secrets Manager, SSM Parameter Store, Lambda and S3,” the researchers wrote. “If the threat actor assumed an integration role, rotate every secret, parameter and Lambda environment variable the role could read, and revoke active sessions for the role.”®

Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns. Shubham Shah, co-founder at Assetnote, and researcher Sam Curry worked together on the exploits earlier this year. By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US. The pair published separate blogs covering different aspects of the research; Shah said the US attack "required a lot more work" because the automaker "spent much more time securing the US, Canadian, and European OpenIDM environments." Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers, the identities of which were kept anonymous by the researchers, who have previously highlighted flaws in the likes of Hyundai, Kia, Subaru, and many others. In the Australian version of the app, the researchers first found a vehicle identification number (VIN) using public licence plate checkers, and used those in queries to internal APIs, which provided personal information and owner email addresses. They also found hardcoded admin credentials for the ForgeRock OpenIDM that were meant for the staging environment but also worked in production. After bypassing the heavy WAF filtering by exploiting path traversal flaws, they were able to invoke the internal admin APIs and take over target accounts using only their email addresses. This let them mint authentication tokens, which they could issue to send arbitrary commands to affected vehicles through the mobile app. Issuing commands on the US version also required bypassing WAF filtering through a path traversal, though with a more involved technique: exploiting path confusion to reach the Apache Felix admin console. The researchers used factory default credentials in Felix’s OSGi Web Console to gain admin privileges. They then used Felix configuration manager to schedule a task that executed an inline Groovy script, giving them shell access to the identity servers. The researchers then queried local admin API endpoints, allowing them to view or modify user account data. From there, they logged into car owners’ accounts, and gained the ability to issue the same commands as demonstrated in the Australian version. According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026," and the exploits were patched within two hours of receiving the report. Although the automakers wished to remain anonymous, it didn’t take long for some petrolheads to speculate that the partially blurred car in Shah’s demo video was a Toyota, citing the shape of the wing mirror and the unlock sound it made. Onlookers claimed that the two automakers in question were likely Toyota and its luxury brand Lexus. Asked wether the claims were accurate, a spokesperson for Toyota Motor Corporation neither confirmed nor denied them. Curry said he and Shah chose to uphold the manufacturers’ requests to remain anonymous out of concern for infoseccers’ current workloads. He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure." ®

Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on. Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release. The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments. The generic Linux kernel has been updated to version 6.6.161.1. There's also been some housekeeping following the eMudhra certificate incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, while adding checks in Python and Go to reject the affected certificates. It has also preserved SSL.com TLS trust where required, presumably to avoid fixing one certificate headache by creating another. Container infrastructure gets plenty of attention, too, with fixes spanning KubeVirt, containerd, Docker Compose, and other components used to keep cloud workloads running. Several CVEs crop up repeatedly across these packages, helping explain the eye-watering number of entries in the changelog. The release includes less security-focused changes too, including new Dockerfiles, an OpenVMM patch for confidential computing support, fixes for systemd hangs, and adjustments to GRUB Secure Boot metadata. The hefty release comes amid an AI-fueled surge in vulnerability discovery that has left developers struggling to keep up with the resulting patch workload. As The Register reported earlier today, Linux creator Linus Torvalds reckons there may finally be signs that the flood is easing, at least in some corners of the kernel. Torvalds said fixes are now arriving faster than new bug reports in the kernel's eBPF subsystem, although he noted that most other areas haven't reached that point. Whether the wider software industry is anywhere close to catching up is another matter, and Microsoft hasn't said if AI-assisted research contributed to the vulnerabilities addressed in this release. Azure Linux, formerly known as CBL-Mariner, is Microsoft's own Linux distribution, developed primarily for its cloud infrastructure and services. That makes keeping its many components patched rather more important than the modest version-number bump might suggest. And judging by the size of this latest changelog, Microsoft's patching teams aren't likely to be putting their feet up anytime soon. ®

Toilet paper purveyor Who Gives A Crap has found itself in a bit of a mess after an intruder accessed customer information through a third-party software provider, leaving the company scrambling to clean up a breach affecting shoppers in the UK, US, and Australia. In an email sent to affected customers over the weekend, seen by The Register, the loo roll seller warns that personal information was accessed without authorization after a security incident at an unnamed US-based marketing software provider. The email explains that the intruder gained access to the supplier's systems on October 30. The provider spotted the intrusion the following day and says it secured its systems by November 1, although Who Gives A Crap wasn't told until November 6. It's unclear why the supplier sat on the bad news for another five days before passing it on. The exposed information includes customers' names, email addresses, phone numbers, mailing addresses, and total spending with the company. In other words, someone may now know not only where you live, but just how much of your hard-earned cash you've flushed down the crapper. Payment information, order details, and passwords were not involved, and customers' accounts were not directly accessed. That's something of a relief, although whether the intruder actually made off with the data remains a pressing question. "We don't yet know whether the information was copied or downloaded," the company told customers, adding that it had found no evidence of misuse. In a separate public statement, Who Gives A Crap co-founder and CEO Simon Griffiths confirmed that the incident affected customers across the company's Australian, UK, and US stores. Canadian customers, meanwhile, appear to have escaped this particular toilet emergency, with the supplier reporting that no personal information belonging to shoppers in the country was accessed. Who Gives A Crap says it has since disconnected the provider from its systems, changed access credentials, and begun warning affected customers to watch out for suspicious emails, texts, calls, and other unsolicited communications. "The main concern is scam or phishing messages that use your real details to look convincing," the company warned in its customer email. While Who Gives A Crap has been busy cleaning up, the supplier at the center of this particular stink remains a mystery. The company hasn't identified the software provider or disclosed how many customers were affected, including those in the UK, and didn’t respond to our questions. Griffiths said the company is "engaging with the relevant regulatory authorities, as required." In the UK, the ICO told The Register: "We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided." Who Gives A Crap has plenty of toilet paper to hand, although cleaning up this particular situation might require more than a few rolls. ®