European Supermarkets Hit by Refrigeration Cyberattacks Exploiting Danfoss CVEs
Multiple European supermarket chains have been targeted in a series of cyberattacks that remotely raised refrigeration temperatures to 50°C, leading to mass spoilage of fresh and frozen goods. The incidents began on the night of October 11 when French retailers including Intermarché, Carrefour, and Monoprix reported simultaneous compromises affecting hundreds of stores. On November 2, similar attacks struck chains in Sweden, Ireland’s SuperValu, Belgium, Luxembourg, and Estonia.
Investigators traced the intrusions to vulnerabilities in Danfoss refrigeration controllers, specifically the AK-SM 800A model. Claroty Team82 had disclosed three issues in August: a hidden “code-of-the-day” authentication bypass (CVE-2025-41450), command injection enabling remote code execution (CVE-2025-41451), and arbitrary configuration injection into the Nginx web server. These flaws allowed attackers to change temperature setpoints without valid administrator credentials when devices ran outdated firmware and remained internet-exposed.
The attacks produced immediate physical consequences. Melted ice cream flowed onto Paris streets, entire batches of dairy and frozen products were discarded, and stores temporarily closed. Losses reached tens of millions of euros per day for affected chains. No ransom notes were left, complicating attribution. French authorities requested assistance from ANSSI, while Belgian prosecutors opened a criminal investigation.
Security researchers note that the AK-SM 800A units are typically managed remotely by maintenance contractors, often over flat networks shared with point-of-sale and Wi-Fi systems. Default passwords, unpatched firmware, and publicly reachable management interfaces remain common. The incidents underscore the growing risk to cyber-physical systems where digital compromise translates directly into spoilage, equipment damage, and fire hazards.
Recommended immediate actions include restricting public exposure via firewalls or zero-trust gateways, enforcing firmware updates, segmenting operational technology networks, and configuring high-severity alerts for any temperature setpoint changes outside normal operating ranges.
Related articles
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.
Negative Specifications: How Bug History Strengthens AI Agent Code for Ginux Kernel
The article explores how incomplete positive specifications lead to vulnerabilities and compatibility gaps when AI agents develop complex systems like the Ginux kernel. Author sgordey describes discovering memory limit bypasses, domain controller takeover via infinite loops, and ineffective SO_REUSEADDR flags during security audits of the Rust-written Linux-compatible kernel created by Gregory Kurtzer using HDAE methodology. It argues for building negative specifications drawn from historical vulnerabilities such as SACK Panic and SACK Slowness to define what must never happen and how to test it. The piece details practical integration of past bug data into frameworks including BMAD, OpenSpec, Kiro, and Superpowers, recommending dedicated steps like failure-history and challenge-spec tasks before coding begins. Tools rust-in-peace and reproof already apply similar multi-angle searches combining threat modeling, unaided discovery, and CVE history. The author stresses that requirements derived from real failures must enter both specifications and test plans to prevent agents from repeating known mistakes.
Proving Vulnerability Management Works: MTTR Metrics, Maturity Models, and Real-World Testing
This article explains how organizations can measure the effectiveness of their vulnerability management programs using key metrics like MTTR, coverage, and maturity levels. It emphasizes that without proper measurement, even advanced scanners and skilled teams cannot confirm whether the process is functioning or stalling. The piece highlights MTTR as the primary metric for executive discussions because it directly correlates with real-world exploit timelines. Industry benchmarks from Verizon DBIR 2026, Edgescan 2025, Bitsight 2024, and Qualys show that remediation often takes months, far exceeding regulatory requirements such as FSTEC Order 117. A five-level maturity ladder is presented, ranging from chaos to continuous CTEM, to help teams assess progress. The article concludes that simulated attacks and red team exercises provide the most honest validation of VM effectiveness beyond dashboard numbers.