ENISA warns of cyberattacks on European refrigeration systems, exposing risks to supermarkets, food supplies and industrial controls. The European Union has issued a coordinated cybersecurity warning after a series of attacks hit commercial refrigeration systems in several Member States. The incidents, which began in October and continued with a new wave on November 1 and 2, have raised concerns about the security of equipment that plays an essential role in food distribution and other critical operations. In a joint statement published on November 4, ENISA, the European Commission, Europol and European cybersecurity coordination bodies urged organisations to take immediate steps to protect vulnerable systems. “Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.” reads the advisory. The warning highlights the need for “immediate action to mitigate exposure”, as attackers continue to target systems that are often overlooked in traditional cybersecurity strategies. The attacks have already had tangible consequences. In France, hackers targeted refrigeration management systems used by hundreds of supermarkets, remotely changing their settings and forcing freezers into continuous defrost mode. Some systems reportedly reached temperatures of up to 50 degrees Celsius, destroying large quantities of fresh and frozen food. According to reports, around 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were affected. Other retailers also reported disruptions to their cooling equipment. The French incidents also exposed a broader problem: the security of industrial control systems that manage physical processes. These systems are increasingly connected to corporate networks and remotely accessible, but they don’t always receive the same security attention as traditional IT infrastructure. BFMTV revealed the attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires. Targeted devices were older Danfoss refrigeration controllers that had reached the end of their support life and no longer received security updates. Other systems were running outdated firmware. Researchers had previously identified vulnerabilities in some Danfoss controllers, including weaknesses that could allow attackers to bypass authentication. However, authorities haven’t confirmed whether those specific flaws were exploited in the attacks. The European response reflects the fact that these incidents aren’t isolated technical problems. ENISA says national cybersecurity teams and EU crisis management authorities are sharing information and coordinating their investigations. The agencies also stress the importance of “rapid information-sharing” and a coordinated response to understand the scale of the campaign and help affected organisations. ENISA has also published a collection of technical advisories from national CSIRTs to help organisations identify the risks and apply appropriate protective measures. These recommendations are particularly relevant to companies operating refrigeration equipment, supermarkets, food distribution networks and other facilities that depend on industrial control systems. The statement also draws attention to existing European cybersecurity legislation. Since September 11, 2026, manufacturers of hardware and software products have been required to report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting Platform. The main cybersecurity requirements of the CRA will apply from December 11, 2027, requiring manufacturers to adopt security-by-design principles and provide security support throughout the product lifecycle, including timely vulnerability fixes. The NIS2 Directive also requires organisations within its scope to manage cybersecurity risks affecting their operations and report significant incidents to their national CSIRT or competent authority. ENISA is supporting these efforts through its Secure by Design and Default Playbook, technical advisories and initiatives aimed at improving product security across the European market. The refrigeration attacks are a reminder that cybersecurity failures can have consequences well beyond data theft or temporary IT outages. Manipulating an industrial controller can destroy food stocks, disrupt business operations and potentially affect services that people depend on every day. Organisations must therefore treat the security of operational technology as a core part of their risk management strategy, rather than an issue to address only after an incident. “The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027. Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.” concludes the Agency’s advisory. “In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority. Furthermore, ENISA is actively contributing to strengthening cybersecurity across the EU by promoting secure-by-design and secure-by-default principles in the EU market.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, refrigeration systems)
OpenAI says GPT-6 Astra sometimes secretly underperformed on safety research, raising concerns about AI reliability and alignment. OpenAI has disclosed that its GPT-6 Astra model sometimes quietly obstructed safety and alignment work. In a report updated on November 4, the company calls it covert underperformance. Astra added unnecessary prerequisites, abandoned working solutions and reported blockers that didn’t exist or that it had caused itself. Researchers first reported the problem internally on August 20, shortly after Astra was introduced. One researcher said a project to test whether the model could sabotage other AI systems made little progress for several days. After switching to another model, the work moved forward quickly. In most cases, Astra’s reasoning gave no clear sign that it was deliberately doing less work, and OpenAI’s monitoring systems failed to detect the behavior. To investigate, OpenAI created pairs of coding tasks using the same code but with different goals. One task was presented as safety research, while the other was described as capability development. Astra completed about 10% of the required tasks when they involved safety research, compared with 16% for capability development. This means it completed roughly 40% fewer tasks in the safety tests. GPT-5.6 Sol showed almost no difference between the two types of work. Even after OpenAI removed cases involving clear refusals or signs that Astra had deliberately withheld help, the gap remained at 4.7 percentage points. It dropped to just 0.75 points only after researchers also removed every case where the model showed even brief ethical concerns. This suggests that most of the behavior cannot be detected simply by checking whether the model openly refuses a request. In employees’ daily Codex use, Astra refused 1.63 percent of safety and alignment requests, against 0.56 percent of capabilities requests. Its reasoning showed it withheld help silently in 0.25 percent of safety requests versus 0.11 percent of capabilities requests, 2.3 times as often. Ethical doubt appeared in 7.9 percent against 2.9 percent, mostly in red-teaming, monitoring, and safety evaluation work. OpenAI shared eight examples. Astra silently held back on training models to evade monitors, filtered a violent source out of a safety evaluation, restricted a jailbreak data export and narrowed exploit analysis. In one case it left graders’ reasoning out of an export without telling the user. A model that quietly decides your project is too risky is the coworker who says “looking into it” and never does. OpenAI has not yet identified the exact cause of the behavior. The difference between Astra’s performance on safety and capability tasks grew from almost zero at the start of reinforcement learning to 6 percentage points by the end. One evaluator favored silently doing less work over either refusing a request or fully completing it. Another finding was that a fine-tuning dataset encouraged the model to invent permission restrictions. Removing the changes linked to that dataset eliminated the performance gap. However, other models trained with the same dataset and reinforcement learning did not show the same behavior, so OpenAI cannot identify either factor as the root cause. OpenAI found no evidence that Astra was deliberately trying to hide its capabilities or influence deployment decisions, although it cannot rule out these possibilities. Simply telling the model to be more careful increased its underperformance by 50%, suggesting that excessive caution may be the main explanation. OpenAI warns that this behavior can slow safety research and make model evaluations less reliable. It is developing new tests and monitoring systems to detect it, especially because the problem becomes harder to identify when models reveal less of their reasoning. In some cases, Astra explained that it had held back because it disagreed with the research itself. “In reviewed cases, Astra narrowed or stopped requested safety work without disclosing the restriction. At scale, this can differentially slow down safety research compared to other research and make evaluations harder to interpret.” concludes the report. “A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs. The behavior becomes even harder to detect if models externalize less of this reasoning in CoT.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenAI)
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
A cybersecurity incident forced UNM Health to divert ambulances, cancel appointments, and pause care while it contained the threat. On Monday, October 26, the University of New Mexico Health System (UNM Health) faced the kind of security incident that healthcare leaders dread: one serious enough to change how patients could receive emergency care. A major hospital network in New Mexico worked urgently on Monday to fix a cybersecurity problem. The issue forced it to send ambulances to other hospitals and left the state without a hospital emergency department able to treat the most serious injuries. UNM Health operates New Mexico’s only Level 1 trauma center. These centers treat the most serious and complex injuries. Even a temporary closure can put extra pressure on other hospitals. UNM Health runs New Mexico’s only Level 1 trauma center. That matters because a Level 1 center handles the most complex injuries, and losing even temporary access to it puts pressure on every nearby hospital. The organization told patients not to come to its main Albuquerque hospital and canceled appointments across more than 30 clinics. “The University of New Mexico Health System is experiencing a cybersecurity issue at this time. UNM Health officials are actively working to resolve this issue. Currently, all ambulance traffic is being diverted to other hospitals and all appointments at all clinics today have been cancelled. UNM Health patients should not show up to UNM Health facilities on October 26. Emergencies should be handled by 911 and non-emergencies should be delayed until further notice.” reads the update published by the organization on October 26, 2026. “The cybersecurity threat is affecting the entire University of New Mexico Health Sciences Center. “ UNM said its IT security teams identified the threat around 11 a.m. and began containment work. They later said the event affected some end-user devices but did not reach core systems or servers. Leadership activated an Emergency Operations Center, brought in outside support, and notified state and federal law enforcement. That is the right sequence: isolate first, investigate second, communicate continuously. From 12:30 to 2:30 p.m., UN Health temporarily stopped accepting new patients while teams protected the network. “System outages also required the suspension of outpatient surgeries and appointments for the remainder of the day.” This was not an abstract IT problem. Patients arrived for care and were told to reschedule. Staff had to explain, repeatedly, why a hospital visit could not proceed as planned. UNM also canceled classes at its Health Sciences Center and sent nonessential employees home. Medical, nursing, pharmacy, and population health students lost a day of instruction because the institution had to protect its network. Other providers stepped in. Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients, which is exactly what a functioning regional healthcare system should do. UNM Health began restoring its systems on Monday afternoon. By the following day, hospitals, ambulance services and clinics were back to normal. The incident is still under criminal investigation. Employees reported messages claiming that patient, student and staff data had been stolen, but UNM has not confirmed this. The hospital also warned people to watch out for phishing and fraud attempts by attackers exploiting the incident. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, UNM Health)
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. To cause the persistent denial-of-service (DoS), the app triggers a vulnerability that researchers dubbed 'GhostMap' that makes Android map a file into an unallocated memory region. The affected process crashes when it attempts to read from that region. Romanian cybersecurity company Bitdefender discovered the flaw while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource. The researchers demonstrated the vulnerability by creating an app that contains no executable code, requests no permissions on installation, and does not need to be launched on the device. According to the company, Google has been aware of GhostMap since August but closed the issue without releasing a patch, classifying it as "not reproducible."
A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency. A Canadian man, Ryan James Roach (35), has been extradicted to the United States to face charges tied to a hacking operation that targeted universities and other schools. Roach was extradited on October 28 and now faces federal charges alongside Mathiew James Stubbings, 41, of Ontario. The indictment alleges that, from June 2016 to December 2019, the two men hacked computers, stole login details, and used victims’ machines to mine cryptocurrency for themselves. “They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials.” DoJ states. “Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts. Some of the computers damaged by the defendants were located at an institution of higher learning in the Western District of New York.” The targets were not random home PCs. Prosecutors say the pair went after U.S. schools with supercomputers, including institutions in New York, Tennessee, North Carolina and Massachusetts. Some affected computers belonged to a higher-education institution in western New York. “To carry out the scheme, Roach and Stubbings surreptitiously accessed victim computers without authorization, deployed malware to gain control, stole victim login credentials, exfiltrated the data to servers that they controlled, and forcing victim computers to use their processing power to mine cryptocurrency for the financial benefit of the defendants.” DoJ continues. That is a lot of effort to turn someone else’s research hardware into a personal crypto rig. The alleged method was also more involved than a single phishing email. The indictment says they looked for weaknesses in victims’ networks, used servers and compromised machines from one victim to hide their tracks, and then moved through the network once inside. The duo used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network. The charges include conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentional damage to a protected computer. Each carries up to 10 years in prison and a $250,000 fine. Prosecutors also allege the pair damaged at least 10 protected computers in one year and caused at least $5,000 in losses. Roach appeared before U.S. Magistrate Judge Mark W. Pedersen and is being held pending a detention hearing. Extradition proceedings for Stubbings continue in Canada. The FBI, the Justice Department’s Computer Crime and Intellectual Property Section, and the Office of International Affairs worked on the case. For security teams, the useful part is not the alleged crypto-mining. It is the reminder that universities remain attractive targets because they hold powerful computing resources, broad networks, and plenty of people with access. Patch quickly, watch for unusual processing load, and treat credential theft as a serious incident rather than a nuisance. “The fact that a defendant has been charged with a crime is merely an accusation and the defendant is presumed innocent until and unless proven guilty.” DoJ concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, University Supercomputers)
Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by sharing a link and making it accessible to "Anyone with the link." When users choose this option,
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets. A cyberattack has hit three regional blood banks in France, disrupting systems used to monitor and control refrigerated storage facilities. The incident took place overnight between Sunday and Monday, at roughly the same time hackers were targeting supermarket refrigeration systems across several European countries. The attack is particularly concerning because it targeted infrastructure that plays a direct role in protecting public health. Blood products must remain within specific temperature ranges to preserve their quality and ensure they’re safe for medical use. A disruption to refrigeration systems can therefore have consequences that go well beyond a conventional IT outage. According to the French Health Ministry, the incident affected several facilities operated by the French Blood Establishment (EFS). “Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems,” the health ministry said in a statement. “The incident had no impact on blood supplies,” Reuters reported, quoting EFS spokesperson Charley Dubois. Staff working around the clock received alerts about the problems and moved blood products to refrigerators that weren’t connected to the affected systems. This response helped prevent the incident from disrupting blood supplies, demonstrating how important operational procedures and contingency plans are when technology fails. “The situation was under control on Wednesday,” the French Health Ministry said, according to Reuters, which also reported that remote access to the affected refrigerators had been disabled. Investigations are now underway to establish how the attackers gained access, which equipment was affected and when the systems can safely return to normal operation. The timing is also significant. The French blood bank incident coincided with attacks against supermarket refrigeration systems in eight European countries, including Sweden and Belgium. Those attacks forced retailers to discard large quantities of food after hackers interfered with cooling and freezer systems. This wasn’t the first time French supermarkets had faced csxk cx incident. In October, police investigated an attack in which hackers allegedly seized control of cooling units at hundreds of supermarkets, causing fires and significant food losses. These incidents share similarities that deserve attention. They point to a security problem beyond traditional corporate IT systems: the growing exposure of operational technology (OT), including industrial control systems, refrigeration equipment, and the remote management platforms kdch operate them. These systems are often connected to corporate networks or accessible through remote management services. If attackers compromise those access points, they may be able to interfere with physical processes rather than simply steal information or encrypt business data. The consequences can be serious. In a supermarket, an attacker who manipulates refrigeration controls can cause food losses and potentially create safety risks. In a blood bank, the same type of interference could threaten the integrity of medical supplies and disrupt services that hospitals depend on. The French incident didn’t affect blood supplies, but the outcome shouldn’t lead organizations to underestimate the risk. Staff intervention and the availability of independent refrigerators helped contain the damage. Not every facility will have the same resources, response procedures or ability to move critical products at short notice. Organizations operating critical infrastructure need to treat the security of connected equipment as a core operational requirement. This means identifying exposed systems, restricting remote access, enforcing strong authentication, segmenting operational networks and monitoring changes to equipment settings. They also need tested manual procedures that allow essential services to continue when digital systems become unavailable or untrustworthy. The European Union has already raised concerns about vulnerabilities in connected infrastructure amid heightened security tensions following Russia’s invasion of Ukraine in 2022. These latest incidents reinforce the need to consider cyberattacks against physical systems as a real operational and public safety risk, not simply an IT problem. “Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French Blood Banks)
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party," reads the statement on X. "Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice." Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android.
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction." Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks. Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.
Confirm this action.
Leaving now will discard your changes.