|
🧊 Hackers heat French supermarket fridges
LINK
|
- Hackers remotely raised the temperature of refrigerators and freezers at hundreds of French supermarkets overnight, spoiling food and sparking fires, with Les Mousquetaires estimating damage of several million euros, Paris prosecutors said they opened an investigation yesterday.
- Attackers abused two internet-exposed refrigeration management product series by Danish company Danfoss, AK-SC and AK-SM, forcing continuous defrost cycles that set temperatures to 50°C and in some cases stretching a one-hour defrost to eight hours to delay alarms; Danfoss said the units ran outdated firmware.
- Around 180 Intermarche and Netto stores were hit, along with dozens of Cooperative U, Carrefour, Monoprix and several E.Leclerc outlets, with France's ANSSI advising that remote administration interfaces be restricted to trusted IP addresses rather than exposed to the internet.
|
🔓 Google DevSite flaw let attackers run code
LINK
|
- A critical flaw in Google's shared DevSite platform let an unauthenticated attacker forge Flask session cookies and run code on several Google developer sites, including developers.google.com, firebase.google.com, and developer.android.com, researcher Simon Koeck found.
- The session cookie held an OAuth client secret that was reused as the Flask signing key, so anyone grabbing a cookie could recover the key, forge a trusted session, and plant a crafted pickle object that the OAuth callback unpickled into attacker-chosen code.
- Google fixed it on October 7, 2026, after an August report and a $90,000 reward, by rotating the exposed secrets, separating the signing key from OAuth credentials, and moving flow objects to server-side storage; the proof of concept used only a harmless time-delay payload.
|
💾 Hidden spy chips betray Ledger wallet owners
LINK
|
- Ledger said today that hardware implants hidden inside some of its crypto wallets, sold by Southeast Asian reseller CryptoBilis, secretly read owners' recovery phrases and sent them to an attacker over a cellular network.
- When a user set up the signer and the device screen showed the 24-word recovery phrase, the master key that lets anyone recreate the wallet and move funds elsewhere, a hidden microcontroller decoded the words and transmitted them over LTE using an eSIM.
- Ledger called it a physical supply chain attack, not a software breach: the implant did not touch the secure Element that protects private keys, the operating system, or any transactions or signatures, so the theft came entirely from the planted chip.
|
🐛 GitLab flaw lets attackers run server code
LINK
|
- A maximum-severity integer overflow flaw in GitLab Community Edition and Enterprise Edition (CVE-2026-97229, CVSS 10/10) lets an unauthenticated attacker run arbitrary code on the GitLab server by submitting a specially crafted regular expression inside a CI/CD configuration file.
- The bug stems from insufficient regular expression validation in GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, no login or user interaction is required, meaning any internet-facing instance is exposed.
- GitLab has released patches in versions 19.4.2, 19.3.5, and 19.2.8; no exploitation in the wild is mentioned, though a separate maximum-severity GitLab flaw disclosed last month drew active probes within hours of public disclosure.
|
📦 npm flaw exposed 1,500 packages
LINK
|
- A flaw in npm's Trusted Publishing feature, named SlugFest, exposed more than 1,500 packages, together topping 10 million total downloads, to takeover by attackers who reclaimed abandoned GitHub repository names, without stealing any token or account.
- For configurations that had never completed a first publish, npm stored the human-readable GitHub repository path instead of its permanent numeric ID, so an attacker could claim the freed name, add a workflow with the expected filename, request an OIDC token, and receive a valid publishing credential.
- Bloom Security found no active campaign and withheld the package list; GitHub fixed it on October 2 after more than 120 days, now expiring unvalidated configurations after 48 hours and blocking tokens triggered by issue_comment events, with maintainers advised to recreate bindings after any repository rename or transfer.
|
|
