Help Net Security weekly roundup: second wave of refrigeration attacks on European retailers, Ivanti and OpenSSH flaws exploited, $6.34B Binance heist pinned on North Korea
The Help Net Security week-in-review for the week ending 8 November 2026 aggregates a dense run of operational security news rather than a single incident. Physical-process attacks dominate: a second wave of refrigeration cyberattacks hit supermarkets in several European countries three weeks after French stores saw refrigeration units driven into heating overnight, three French blood banks detected and reversed a destructive temperature spike after a cyberattack on a refrigeration supplier of the Établissement français du sang (EFS), and five US federal agencies issued a joint advisory warning that threat actors are targeting refrigeration controllers in grocery and cold-storage environments and may force continuous heating and defrost cycles. On the vulnerability side, CISA added two Ivanti Connect Secure flaws (CVE-2026-111357, CVE-2026-118527) to the KEV catalog, an OpenSSH flaw (CVE-2026-123158) allowing remote login to passwordless accounts on Alpine Linux and other musl-based systems was exploited within hours of disclosure, attackers are exploiting an authentication flaw in Node-RED (CVE-2026-58115) to drop a Linux bot and backdoors, and Binarly found patched Zyxel GS1900 switches still exposed because the fix addressed CVE-2026-7273 rather than the CVE-2026-107441 the in-the-wild exploit relies on. The roundup also covers supply-chain and breach events — a poisoned cPGuard update pushed to nearly 3,000 hosting servers by way of OPSShield's compromised update infrastructure, the Chainalysis breach attributed to "offensive agentic techniques", and the Norad Grants Portal exposure of 20,614 names and email addresses — alongside the FBI attribution of the $6.34 billion Binance theft to North Korea's TraderTraitor, enabled by a tampered installer and a fake job interview. Several items track adversarial use of AI: CrowdStrike reported a China-nexus group hitting more than 200 organisations in 11 days with AI agents, Sophos described the Aur0ra ransomware crew delegating lateral movement and credential collection to agents, Cisco Talos documented an infostealer that asks a model to rank stolen assets by monetisation value, and GTIG/Mandiant reported stolen cloud access being burned on AI inference at victims' expense.
Entenda a falha
A vulnerabilidade
This is a weekly roundup, so each flaw gets only a brief treatment. Two Ivanti Connect Secure flaws (CVE-2026-111357, CVE-2026-118527) went into CISA's KEV catalog after Ivanti updated an earlier advisory. An OpenSSH flaw (CVE-2026-123158) lets an attacker log in remotely to passwordless accounts on Alpine Linux and other musl-based systems, and was exploited within hours of disclosure. Node-RED has an authentication flaw (CVE-2026-58115) that attackers are using to drop a Linux bot and backdoors. On Zyxel GS1900 switches, the patch fixed CVE-2026-7273, but the in-the-wild exploit relies on CVE-2026-107441, so patched devices remain exposed. GhostMap is an Android bug that crash-loops a Pixel 10 through a malformed APK. The articles give no affected or fixed version numbers.
Como funciona
For GhostMap, Android reads the ZIP structure inside an APK when the app is installed. If that structure is malformed, the parsing goes wrong and the Pixel 10 falls into a crash loop that can need a factory reset. The app has no executable code and requests no permissions. For the Zyxel switches, the exploit targets the weakness tracked as CVE-2026-107441, a different one from what the vendor's fix touched, so the vulnerable path still works after patching. The articles do not describe the internal flow of the other flaws.
Por que é vulnerável
For the Zyxel GS1900, the cause is an incomplete fix: the vendor patched CVE-2026-7273, a different bug from the CVE-2026-107441 that the exploit uses, so the real weakness stayed in place. For GhostMap, the cause is how Android handles the ZIP structure inside an APK. The articles do not give root causes for the Ivanti, OpenSSH or Node-RED flaws beyond the symptoms: accepted logins to passwordless accounts on musl-based systems, and an authentication flaw in Node-RED.
Como foi descoberta
Binarly found that patched Zyxel GS1900 switches were still exposed because the fix addressed the wrong CVE. The flaw had earlier been reported as exploited in the wild. Bitdefender Labs found GhostMap while studying a banking malware sample. CISA added the Ivanti flaws to KEV after Ivanti updated its advisory with details. The OpenSSH flaw was exploited within hours of disclosure, and the Node-RED flaw is being exploited in the wild. The articles do not say who found those flaws.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Working exploits are in use in the wild for several of these flaws: the Zyxel GS1900 exploit relying on CVE-2026-107441, the OpenSSH flaw exploited within hours of disclosure, the Node-RED flaw used to drop a bot and backdoors, and the Ivanti flaws listed in KEV. The articles do not say any of these exploits was published. Bitdefender built a demonstration app for GhostMap, but no release is mentioned. Treat patching as urgent. For Zyxel, the existing patch does not protect against CVE-2026-107441.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 07:16.
Detalhes técnicos
- Refrigeration: the attacks manipulate refrigeration controllers to raise temperatures and spoil stock; the US joint advisory warns of forced continuous heating and defrost cycles.
- Zyxel GS1900: the vendor patch closed CVE-2026-7273, leaving the distinct CVE-2026-107441 used by the live exploit unaddressed (per Binarly, as reported).
- GhostMap: Bitdefender Labs built a permission-less, code-less Android app whose malformed APK ZIP structure leaves a Pixel 10 in a crash loop that can require a factory reset.
- XCPE: Google disrupted a backdoor embedded in Android TV set-top box firmware enrolling more than 1.3 million devices, attributed with high confidence by GTIG to Videostrong Technology.
- APT29: Sekoia reports compromised sites, lookalike domains and a hijacked web analytics service delivering n-day exploits to iOS and Android users to steal cookies, messages and Wi-Fi passwords.
- Gorbag: ESET tracks a Russia-aligned group targeting Ukrainian courts and city councils since at least February 2025 using spearphishing attachments and a self-deleting stealer.
Remediação
- Apply the Ivanti Connect Secure fixes for CVE-2026-111357 and CVE-2026-118527 under the KEV remediation deadline.
- Patch OpenSSH on musl-based distributions and audit for passwordless accounts.
- Restrict and authenticate exposed Node-RED instances.
- Treat Zyxel GS1900 switches as still exposed to CVE-2026-107441 despite the earlier patch, and limit management-plane exposure.
- Isolate and monitor refrigeration and building-control networks, alarm on temperature set-point changes, and review the joint US federal advisory.
- Audit cPGuard installations for the malicious update and rotate credentials held with OPSShield.
- Prepare for the November 2026 Patch Tuesday while completing October's deployment, including the actively exploited CVE-2026-96951 and the PHP2Shell emergency patches (CVE-2026-109618, CVE-2026-109619).
Linha do tempo
-
Help Net Security weekly roundup: second wave of refrigeration attacks on European retailers, Ivanti and OpenSSH flaws exploited, $6.34B Binance heist pinned on North Korea
ler a análise desta fonte ocultar
The Help Net Security week-in-review for the week ending 8 November 2026 aggregates a dense run of operational security news rather than a single incident. Physical-process attacks dominate: a second wave of refrigeration cyberattacks hit supermarkets in several European countries three weeks after French stores saw refrigeration units driven into heating overnight, three French blood banks detected and reversed a destructive temperature spike after a cyberattack on a refrigeration supplier of the Établissement français du sang (EFS), and five US federal agencies issued a joint advisory warning that threat actors are targeting refrigeration controllers in grocery and cold-storage environments and may force continuous heating and defrost cycles. On the vulnerability side, CISA added two Ivanti Connect Secure flaws (CVE-2026-111357, CVE-2026-118527) to the KEV catalog, an OpenSSH flaw (CVE-2026-123158) allowing remote login to passwordless accounts on Alpine Linux and other musl-based systems was exploited within hours of disclosure, attackers are exploiting an authentication flaw in Node-RED (CVE-2026-58115) to drop a Linux bot and backdoors, and Binarly found patched Zyxel GS1900 switches still exposed because the fix addressed CVE-2026-7273 rather than the CVE-2026-107441 the in-the-wild exploit relies on. The roundup also covers supply-chain and breach events — a poisoned cPGuard update pushed to nearly 3,000 hosting servers by way of OPSShield's compromised update infrastructure, the Chainalysis breach attributed to "offensive agentic techniques", and the Norad Grants Portal exposure of 20,614 names and email addresses — alongside the FBI attribution of the $6.34 billion Binance theft to North Korea's TraderTraitor, enabled by a tampered installer and a fake job interview. Several items track adversarial use of AI: CrowdStrike reported a China-nexus group hitting more than 200 organisations in 11 days with AI agents, Sophos described the Aur0ra ransomware crew delegating lateral movement and credential collection to agents, Cisco Talos documented an infostealer that asks a model to rank stolen assets by monetisation value, and GTIG/Mandiant reported stolen cloud access being burned on AI inference at victims' expense.
Technical Details
- Refrigeration: the attacks manipulate refrigeration controllers to raise temperatures and spoil stock; the US joint advisory warns of forced continuous heating and defrost cycles.
- Zyxel GS1900: the vendor patch closed CVE-2026-7273, leaving the distinct CVE-2026-107441 used by the live exploit unaddressed (per Binarly, as reported).
- GhostMap: Bitdefender Labs built a permission-less, code-less Android app whose malformed APK ZIP structure leaves a Pixel 10 in a crash loop that can require a factory reset.
- XCPE: Google disrupted a backdoor embedded in Android TV set-top box firmware enrolling more than 1.3 million devices, attributed with high confidence by GTIG to Videostrong Technology.
- APT29: Sekoia reports compromised sites, lookalike domains and a hijacked web analytics service delivering n-day exploits to iOS and Android users to steal cookies, messages and Wi-Fi passwords.
- Gorbag: ESET tracks a Russia-aligned group targeting Ukrainian courts and city councils since at least February 2025 using spearphishing attachments and a self-deleting stealer.
Remediation
- Apply the Ivanti Connect Secure fixes for CVE-2026-111357 and CVE-2026-118527 under the KEV remediation deadline.
- Patch OpenSSH on musl-based distributions and audit for passwordless accounts.
- Restrict and authenticate exposed Node-RED instances.
- Treat Zyxel GS1900 switches as still exposed to CVE-2026-107441 despite the earlier patch, and limit management-plane exposure.
- Isolate and monitor refrigeration and building-control networks, alarm on temperature set-point changes, and review the joint US federal advisory.
- Audit cPGuard installations for the malicious update and rotate credentials held with OPSShield.
- Prepare for the November 2026 Patch Tuesday while completing October's deployment, including the actively exploited CVE-2026-96951 and the PHP2Shell emergency patches (CVE-2026-109618, CVE-2026-109619).