An anonymous reader quotes a report from Reuters: The refrigerators at three regional blood banks in France were hit by a cyberattack overnight between Sunday and Monday, at the same time hackers struck supermarkets from Sweden to Belgium. "Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems," the health ministry said in a statement. The incident had no impact on blood supplies, EFS spokesperson Charley Dubois said. "We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected," she said. [...] Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service. The attack followed a similar incident in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses.

Read more of this story at Slashdot.

You won’t see the ‘suspended’ sign because it’s not meant for you.

You won’t see the ‘suspended’ sign because it’s not meant for you.

An anonymous reader quotes a report from The Guardian: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden's Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was "aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems". The Dutch retailer Ahold Delhaize, which last month reported a cybersecurity incident to police in the Netherlands, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. A company spokesperson, Sarah De Meester, said the supermarket chain had established that temperatures in the cooling systems had increased, adding that the incident was being investigated. Belgium's Le Soir newspaper reported that dozens of stores and supermarkets were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. "We started mobilizing technicians at 1am," Stephan Moelans, the chief executive of Sabcobel, which specialises in refrigeration system installations, told the paper. "We spent all night and morning disconnecting the affected installations from the grid."

Read more of this story at Slashdot.

The Washington Post reports: Tens of thousands of South Koreans had their financial data exposed online in recent weeks after at least nine major banks there suffered cyberattacks that suggested a dark future for online security. One man, a 26-year-old living in southern China, was allegedly behind the attacks, according to an investigation by cybersecurity company CrowdStrike. Traces left online and failure to secure his own systems allowed investigators to piece together the man's name, age, location and what he allegedly did. The clues revealed that the devastating assault on some of Asia's most sophisticated financial institutions was the work of an amateur. The attacks were launched with help from a few artificial intelligence chatbots, CrowdStrike found, before asking one to help sell the stolen data online and draft a fake résumé touting cybersecurity skills... The hacker who broke into the South Korean banks had access to Anthropic's Claude, but because the U.S. firm's tools generally refuse to take illegal actions, free Chinese models were also used, including DeepSeek, CrowdStrike found. "The models are interchangeable," said Meyers, the CrowdStrike executive. The Post calls it "part of a wave of AI-enabled hacking that is advancing across the world, triggering alarm inside national governments as well as multinational companies." "Basically any pedestrian, non-hacker can take these frameworks and start leveraging them to go after different targets," said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. The company has tracked an increase in the speed with which cyberattacks can move once inside a target's networks, as seasoned hackers and rank amateurs alike get a boost from AI tools. "Anyone can be a super-hacker now," Meyers said... Many cyber experts still expect the security reckoning to intensify as AI tools that can find and exploit software bugs become more widely distributed and understood. [Last] Monday, The Post reported that cybersecurity researchers from the start-up Cathedral who set out to test Anthropic's security found that they could access internal messages and meeting transcripts. Cathedral reported its findings to Anthropic, which said it resolved the newly discovered problems... Security experts say it's unlikely that any hacker is forgoing the use of AI tools right now. Even in America, critical infrastructure like energy and water companies need to be "immediately and comprehensively" tested for exploitable bugs, according to Snehal Antani, chief executive of cybersecurity company Horizon3. He tells the Post the government might need to fund that remediation, and even form "a public and private partnership to accelerate incident response."

Read more of this story at Slashdot.

A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device.

A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device.

An anonymous reader quotes a report from Wired: Trading has resumed on Polymarket's flagship international platform after a hack that drained money from the wallets of some traders. A third-party vendor based in the United Kingdom was breached, not the prediction market's website itself. Law enforcement in the UK have been notified of the incident, the company said. Trading was initially paused while the company investigated for several hours. On X, prominent traders complained that they had lost money; Blockchain analytics firm Bubblemaps reported that around 700 users appear affected, with approximately $2.7 million stolen. Polymarket declined to comment when WIRED asked how many traders were impacted by the breach and how much money was lost, but said it will refund impacted traders. The hack did not impact users on Polymarket US, the company's newer platform for people within the United States. Polymarket runs two separate prediction markets; Polymarket US operates as a federally regulated financial exchange within the country, while the flagship Polymarket is a cryptocurrency-based platform that is banned in the United States and a number of other countries. This is not the first time that Polymarket traders have experienced losses like this. "A nearly identical vendor-compromise attack hit the platform in June, draining close to $3 million from at least 11 user wallets through the same kind of injected frontend script," reports StartupFortune. Hours before Polymarket halted trading, more than $2 billion in cryptocurrency was drained from Binance wallets in just 40 minutes.

Read more of this story at Slashdot.

The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.

The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.

Ars Technica's Dan Goodin reports: Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world's server vendors and data centers. The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called (PDF) EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well. The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence -- meaning they run only once -- they can give attackers a wide opening to install other payloads that also run each time early in the boot process. The parties that discovered CVE-2026-97631 -- Alex Matrosov of Anthropic and Dan Holmes of Google -- had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week. With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.

Read more of this story at Slashdot.

An anonymous reader quotes a report from ProPublica: A Florida man who was the subject of a 2019 investigation by ProPublica was indicted last month on federal charges that he defrauded clients of his ransomware data recovery firm. According to the Justice Department, the man, Zohar Pinhasi, told customers he could recover their encrypted files without having to pay hackers, when, in reality, he paid the ransom and charged victims a hefty fee on top. The indictment mirrors the findings from ProPublica's 2019 article "The Trade Secret," which centered on Pinhasi and his scheme. The outlet found that the ransomware victims were being harmed twice: once by the hackers, who locked their targets' files and demanded ransom, and a second time by MonsterCloud, Pinhasi's Florida-based data recovery firm, which misled its clients about not paying ransoms. "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," U.S. Attorney Joseph Nocella said in an Oct. 7 press release. "Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity." [...] Pinhasi, who went by the alias Zack Green, told ProPublica in 2019 that MonsterCloud never promised clients that their data will be recovered by any particular method. "How we do it, it's our problem," he told ProPublica. "You will get your data back. Sit back, relax and enjoy the ride." He called MonsterCloud's data recovery methods a "trade secret." [...] Federal investigators found that, over the course of the scheme, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, Pinhasi made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. [...] In 2019, Pinhasi touted MonsterCloud's ties to law enforcement as evidence of its integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud's website as the only member of its "Cyber Security Advisory Council."

Read more of this story at Slashdot.

Blocked phishing attempts rose 83% in six months, according to Surfshark, largely due to one TikTok shop. Here’s how to spot the red flags.

Blocked phishing attempts rose 83% in six months, according to Surfshark, largely due to one TikTok shop. Here’s how to spot the red flags.

"As of 2026, the company has issued more than 60 million digital certificates," notes Wikipedia. But now, InfoWorld reports: A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements... [In a press note the company added] that data sovereignty and compliance requirements had increased the business's complexity and cost... The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced... Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. "The last thing organisations need is to migrate twice," Kadakia said. But there's another concern, the article points out. "Analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services." Replacing a website's certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. "The harder finding for many organizations will be that they can't answer these questions at all," Grover said, referring to where certificate trust decisions are made outside browsers and operating systems... Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Read more of this story at Slashdot.

The New York Knicks reportedly sent employees a fake offer of complimentary NBA championship rings as part of an internal phishing test, requiring anyone who clicked the link to attend mandatory cybersecurity training. "Congratulations, your Employee Championship Ring is here," the email said. According to The New York Times, Madison Square Garden employees who clicked that link "were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan's growing cybersecurity concerns." Ars Technica reports: The offer wasn't implausible, either. "Typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive," wrote Joe Vardon, senior NBA writer for The Athletic, which was bought by The New York Times in 2022 and then merged into the parent news organization. Vardon's article was primarily about how Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. The assistant coaches were handed boxes without rings inside, though they are expected to receive rings later on. "Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night... The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks' business operations, will not receive rings at all, team sources told The Athletic," Vardon wrote. MSG employee hopes were raised "at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings," Vardon wrote. The email included "a graphic of two differently styled rings" that the lucky employees could supposedly choose from, the article said. "(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you," the email said. "There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below." Vardon wrote that "multiple team sources" confirmed the email was a phishing test. It's not clear how many employees clicked the link or whether any of the employees who received the email will eventually get some type of championship ring. We contacted the Madison Square Garden Sports organization with these questions and will update this article if we get a response.

Read more of this story at Slashdot.

The PHP Project provides instructions to stop further RCE exploits in limited settings.

The PHP Project provides instructions to stop further RCE exploits in limited settings.

joshuark shares a report from BleepingComputer: Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP). "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," it said. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'" After releasing the October 2026 Patch Tuesday Windows 11 cumulative updates, Microsoft marked the bug as resolved, but in a Tuesday update it said the issues weren't actually addressed and that a fix would ship later. "This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated," it said in a service alert sent to IT admins. "A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion." While Microsoft continues working on a permanent solution, it shared a temporary fix that requires affected customers to choose one of two VPN tunneling protocols to work around the issue.

Read more of this story at Slashdot.

Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline. ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability. ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon. ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation. ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure. ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

Read more of this story at Slashdot.