Podcast Detail

SANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10164.mp3

previous
Podcast Logo
Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Today's episode covers attacks that switch supermarket and military commissary freezers into defrost mode, active exploitation of the Node-RED flaw in Siemens SIMATIC IoT2050 devices, the compromised cPGuard anti-malware update channel, and Calif's iPhone exploit that works despite Lockdown Mode.

Refrigerator Exploits: Hacked Freezers Switched to Defrost Mode
Attackers have hit refrigeration controllers at hundreds of supermarkets in France and several other European countries, and U.S. investigators are treating August freezer failures at U.S. military commissaries as a suspected cyberattack. The attackers switch freezers into defrost mode, heating them to about 50°C (122°F) and spoiling the food. How the systems were breached is still unclear, though weak default passwords on internet-exposed controllers have been reported.
To help build a honeypot that emulates these devices, please contact me at jullrich-at-sans.edu if you can provide access to one of these refrigeration controllers.
https://blog.claroty.com/blog/france-supermarket-hacks-expose-risks-of-internet-facing-refrigeration-systems
https://www.bbc.com/news/articles/cq1kd1nee80eo

Exploitation Targeting Node-RED on Siemens SIMATIC IoT2050 (CVE-2026-58115)
VulnCheck caught attackers exploiting CVE-2026-58115, a missing authentication flaw (CVSS 10.0) in the Node-RED admin interface of Siemens SIMATIC IoT2050 Advanced industrial devices, to deploy flows that use wget or curl to download a Linux bot. Siemens patched the flaw in August with version 4.3.4.1. Update, or uninstall or harden Node-RED, and keep industrial control systems (ICS) off the internet.
https://www.vulncheck.com/blog/exploitation-targeting-node-red
https://cert-portal.siemens.com/productcert/html/ssa-834709.html

cPGuard Security Advisory: Update Channel Compromise
OPSSHIELD says an attacker used stolen credentials to access the update servers for cPGuard, its anti-malware product for cPanel and shared hosting servers. On November 2, cPGuard versions 5.88.12 through 5.88.19 delivered a malicious script that collected /etc/shadow, MySQL configuration, root shell history, and SSH files. Update to 5.88.25 or later, check the install log for affected versions, rotate credentials, and review the indicators of compromise in the advisory.
https://opsshield.com/notice/cpguard-update-channel-compromise.html

iPhone 18 Pro Exploited via AirDrop with Lockdown Mode Enabled
Security firm Calif released a video showing an iPhone 18 Pro with Lockdown Mode enabled being fully compromised after the user accepted a malicious PDF sent via AirDrop. Calif has not published technical details, so users who rely on Lockdown Mode should not accept unexpected AirDrop files.
https://x.com/calif_io/status/2117720348322144733
https://www.macrumors.com/2026/11/03/iphone-jailbreak-lockdown-mode/

Vote in the SANS Difference Makers Awards
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Wednesday, November 4th, 2026
 edition of the SANS and Internet Storm Center's
 Stormcast. My name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. So I want to start today with a
 little bit of different story, something that I haven't
 covered so far and that's the breach of hundreds, maybe
 thousands of refrigerators across Europe. This has been
 sort of ongoing over the last couple of weeks. Last week
 there was also some news that the U.S. military bases
 outside Europe were also affected by some of these
 hacks. The way these hacks work is that they typically
 connect to exposed control panels and then switch these
 refrigerators or freezers into defrost mode which ups the
 temperature in the 120-130 Fahrenheit or 50 Celsius range
 and of course leads to the spoilage of a lot of food.
 Well this is all bad of course and yes something that should
 be avoided. There wasn't much of an actionable part of this
 story. It wasn't quite clear how these systems got hacked.
 Lots of talk about weak default passwords in this case
 which is a typical IoT thing of course. Some people talked
 about fairly old exploits being used against these
 particular refrigerators and freezers. Well I have a little
 bit of another spin on this and that's why I want to tune
 our honeypots to actually look for what's actually going on
 there but in order to do so I need access to one of these
 refrigerators or thermostats in order to clone them. So if
 you know someone that has access to them please let me
 know and well maybe can get in touch and then get some data
 that helps us emulate these devices. And sticking here
 with an industrial control system and honeypot story
 there is evidence as presented by VulnCheck that the recently
 patched vulnerability in SIMATIC equipment that's
 running Node-RED which is essentially their admin API is
 being exploited now. So again this was patched in August but
 now is actively being exploited. The exploit here is
 I would say almost not so terribly spectacular in that
 they just run some standard Linux scripts and wget to
 download additional malware to the system to gain persistent
 remote access to these controllers. So definitely
 something to look out for and yes make sure your industrial
 control systems are patched and properly locked down. And
 in case you're running cPGuard, cPGuard is an
 endpoint protection anti-malware product that's often
 used sort of in shared hosting environments like if you're
 using cPanel I think it integrates quite well with
 that. Well OPSSHIELD, the company behind cPGuard, did
 announce that their update channel was compromised. So
 essentially the hacker was able to gain access to the
 server they stored their updates on, was able to add a
 malicious script and yes that script does off the usual
 credential exfiltration and the like. So definitely if
 you're running this product make sure that you didn't get
 caught by the bad update and OPSSHIELD has published a blog
 post with additional details indicators of compromise and
 some other assistance in how to detect and remove the
 malware. Well, security company Calif who is recently
 making a name for itself in the iOS exploit space has
 published a video that shows the successful exploitation of
 an iPhone 18. So essentially the just released version and
 reasonably recent even though not the latest iOS version
 running on the phone. This exploitation was successful
 even though Lockdown Mode was enabled in order to trigger
 the unspecified a virus.
 So if you consider yourself at risk enough in order to enable
 Lockdown Mode you probably shouldn't accept random
 AirDrop messages that pop up on your system and well better be
 sure who actually did send you that particular file. The
 compromise appeared to be pretty complete as in rooted
 they were able to essentially have some little animation
 running within the full screen of the iPhone on top of other
 applications. Well and that's it for today. So thanks for
 listening. Thanks for liking. Thanks for subscribing. And I
 add a link to the Difference Maker Award vote to the show
 notes. So would appreciate your vote even though the
 competition is pretty stiff for this particular category.
 So don't mind if you find someone else more worthy here.
 So thanks and talk to you again tomorrow. Bye.