My Next Class

Today's episode covers attacks that switch supermarket and military commissary freezers into defrost mode, active exploitation of the Node-RED flaw in Siemens SIMATIC IoT2050 devices, the compromised cPGuard anti-malware update channel, and Calif's iPhone exploit that works despite Lockdown Mode.

Refrigerator Exploits: Hacked Freezers Switched to Defrost Mode
Attackers have hit refrigeration controllers at hundreds of supermarkets in France and several other European countries, and U.S. investigators are treating August freezer failures at U.S. military commissaries as a suspected cyberattack. The attackers switch freezers into defrost mode, heating them to about 50°C (122°F) and spoiling the food. How the systems were breached is still unclear, though weak default passwords on internet-exposed controllers have been reported.
To help build a honeypot that emulates these devices, please contact me at jullrich-at-sans.edu if you can provide access to one of these refrigeration controllers.
https://blog.claroty.com/blog/france-supermarket-hacks-expose-risks-of-internet-facing-refrigeration-systems
https://www.bbc.com/news/articles/cq1kd1nee80eo

Exploitation Targeting Node-RED on Siemens SIMATIC IoT2050 (CVE-2026-58115)
VulnCheck caught attackers exploiting CVE-2026-58115, a missing authentication flaw (CVSS 10.0) in the Node-RED admin interface of Siemens SIMATIC IoT2050 Advanced industrial devices, to deploy flows that use wget or curl to download a Linux bot. Siemens patched the flaw in August with version 4.3.4.1. Update, or uninstall or harden Node-RED, and keep industrial control systems (ICS) off the internet.
https://www.vulncheck.com/blog/exploitation-targeting-node-red
https://cert-portal.siemens.com/productcert/html/ssa-834709.html

cPGuard Security Advisory: Update Channel Compromise
OPSSHIELD says an attacker used stolen credentials to access the update servers for cPGuard, its anti-malware product for cPanel and shared hosting servers. On November 2, cPGuard versions 5.88.12 through 5.88.19 delivered a malicious script that collected /etc/shadow, MySQL configuration, root shell history, and SSH files. Update to 5.88.25 or later, check the install log for affected versions, rotate credentials, and review the indicators of compromise in the advisory.
https://opsshield.com/notice/cpguard-update-channel-compromise.html

iPhone 18 Pro Exploited via AirDrop with Lockdown Mode Enabled
Security firm Calif released a video showing an iPhone 18 Pro with Lockdown Mode enabled being fully compromised after the user accepted a malicious PDF sent via AirDrop. Calif has not published technical details, so users who rely on Lockdown Mode should not accept unexpected AirDrop files.
https://x.com/calif_io/status/2117720348322144733
https://www.macrumors.com/2026/11/03/iphone-jailbreak-lockdown-mode/

Vote in the SANS Difference Makers Awards
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.