this week in security — november 8 2026 edition

THIS WEEK, TL;DR

Here we go again: Mass-hacks hit European supermarket freezers and blood banks
The Guardian: I'm sorry… what? Again?! Yes, another wave of mass-hacks targeted freezers and refrigeration units across at least a dozen European countries this week, after an earlier hacking wave in October clearly wasn't enough of an alarm to pull thousands of internet-connected fridges off the web. The latest cyberattacks cranked up the heat in refrigerated and freezer units at retail supermarkets and beyond, affecting the food supply as well as medical blood banks. It's unclear who's behind the attacks, but the chief suspect is Iran, after its hackers previously targeted medical tech giants and U.S. water providers earlier this year. French cyber officials, the U.S. government, and Health-ISAC have all urged customers to take action to pull affected refrigerators offline, given that these hacks will likely keep on happening.
More: CERT-FR | CISA | Associated Press | Reuters ($) | BBC News ($) | NPR | The Record | The Register | @BNODesk | @jennamclaughlin | @campuscodi | @matthew_d_green | @ret | @hacks4pancakes

Customers of cloud host Northflank urged to 'rotate all keys' after hack
Bleeping Computer: Northflank, a cloud hosting platform for databases, containers and AI tools, was breached and customers' environmental variables (think passwords and other credentials) stolen and decrypted. That means hackers now have access to reams of credentials that they can use to hack into other services. Northflank is the latest cloud app host to be hacked of late, after Railway was popped last week. Northflank says some customers are experiencing abuse of their AI and API tokens, so anyone reliant on the platform should check their logs and billing for unauthorized usage. Meanwhile: Trigger.dev, used for building AI agents, warned of its own breach of environmental variables across various customers, and also urged customers to rotate their keys.
More: Northflank | Qovery | Hacker News | /r/cybersecurity ($) | @GossiTheDog

Residential proxies detected on the White House network
Layer3Intel: Network security firm Layer3 Intel found evidence of a residential proxy on the White House's internal network, exposing other devices to potential cyberattacks. Resproxies, as they're known, allow anyone with a credit card to rent access to an internet connection, such as for scraping sites for training AI models or allowing hackers to hide their malicious traffic. Some botnets can hack other devices on the same network, so it's not great that someone opened up a backdoor to the White House… Per the firm: "Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight." I wonder who that might be! Also: Norway's Ingenioren reports on research by Harrison Sand, who uncovered how digital picture frames power some of these botnets.
More: The Register | The Verge ($) | PCMag | Krebs on Security | CSO Online | Riley Kilmer | ~this week in security~ 

Hundreds of exposed Artex AI hacking tools found exposed online
TechCrunch ($): Internet scanning firm Censys found hundreds of publicly accessible servers hosting Chinese-made open-source AI pentesting tool Artex, allowing anyone to look inside and see what they are targeting, hacking, and what exploits they're using. One of the exposed servers found by Censys was likely behind the hacks targeting the Korean finance industry in September and October. (Disclosure: I wrote this!) The maker of Artex has since made the tool closed-source to prevent further attacks. Microsoft says that Artex is being widely used in a number of global cyberattacks — and some inadvertent hacks. That includes enterprise authentication provider WorkOS, which disclosed this week that it was targeted by a researcher's Artex system, whose agents escaped containment. Wired ($) digs into how these open-source AI models are really good at hacking things. Also… check out The Verge chatting with Alex Stamos about how AI is upending cybersecurity. 
More: Chosun | Cybersecurity Dive | DataBreaches.net | Rami McCarthy

THE STUFF YOU MIGHT'VE MISSED

Google shuts down Android TV botnet of 1.3 million devices 
Google Threat Intelligence: Speaking of resproxies… Google shut down a botnet of more than a million backdoored Android TV set-top boxes, which the company says was operated by one of Google's own industry partners (*gasp!*), a tech company called Videostrong. Google accused the company of operating the backdoor, and called it an "unacceptable breach of trust."  

Binance explains how North Korean spies stole billions in crypto 
The New York Times ($): North Korean hackers stole $6+ billion in crypto during a 20-minute heist by spending months targeting the company's employees, according to the crypto giant's incident postmortem. The hackers used classic North Korean tactics, per Wired ($) and Reuters ($), such as impersonating recruiters and staging fake job interviews… which makes you wonder why Binance — arguably the biggest crypto target in the world — didn't spot the effort. The incident run-down shows Binance failed to implement security internal features, like preventing staff from downloading external software onto their work computers, including malware disguised as a job interview. (I still don't think this hack was the fault of the employees!) More via me at TechCrunch ($), and the Financial Times ($), too.

Fake nuclear warnings hit Ukraine, Russia emergency apps
The Record: Kyiv correspondent @darynant reports on duelling hacks of Ukraine and Russia's emergency alert apps, blasting fake alerts to millions of people claiming that chemical and nuclear attacks were on the way. Ukraine's president Volodymyr Zelenskyy told PBS that state hackers targeted Russia's app in the aftermath of its own app's hack. More from Kyiv Post, CNN, and BBC News ($).

Penlink's location snooping tech used by U.K. and European law enforcement
Bloomberg ($): Security agencies in the U.K. and across Europe, including the Netherlands, Germany, Austria, and Hungary, use a web and location surveillance system made by Penlink, which relies on the data broker ecosystem to track people in near real-time. Worse for those in the U.S., which is also a customer of this tech, cops and feds don't need warrants to obtain data that's commercially available for purchase. As a reminder, the U.S. still doesn't have any comprehensive data protection or privacy laws. Citizen Lab's @wchr has some words in a Bluesky thread. 

*sshole bug lets hackers SSH into some Linux systems
Ars Technica: Since 2016, several flavors of Linux, including Alpine and OpenWrt (and potentially other versions), have shipped with a vulnerable version of OpenSSH that allows remote logins with any password that's longer than 256 characters. (You can sense the frustration in the researcher's write-up.) GreyNoise says the bug, dubbed *sshole, is being exploited in the wild.

OTHER NEWSY NUGGETS

Dems win U.S. midterms: All change on the U.S. political spectrum, as the midterm elections flipped the U.S. House, Senate, and many state and local legislatures. First on the agenda, curbing data centers and holding tech and AI giants accountable, ramping up cybersecurity again after CISA attrition, and broadly scrutinizing the past two years of Republican run. (via Cybersecurity Dive, Tech Policy Press)

Germany sounds spyware siren: Germany confirmed hackers targeted government officials and members of parliament with spyware after lawmakers received a bunch of Apple threat notifications (via ZDFheute, @vaspanagiotopoulos). Meanwhile, similar alerts received by two prominent Thai opposition leaders sparked calls for an investigation (via Bloomberg ($) and Bangkok Post). And, Italy's foreign minister is also being targeted by hackers who are slowly releasing his personal information on the dark web, per the BBC ($), which prime minister Giorgia Meloni blamed on Russia… And, @lorenzofb had a great interview with former Wyden aide @christopher.soghoian about all things spyware. 

DigiCert breach exposed customer data and ID documents: HTTPS certificate authority DigiCert confirmed hackers stole customer information and their identity documents after the company left a migration server from early 2025 publicly exposed to the web, per an incident report and timeline. Customers are understandably pretty cross about this. (via Bleeping Computer)

U.K. reports drop in major cyber incidents: U.K.'s National Cyber Security Center said in its latest annual report [PDF] that there were 80 "nationally significant" cyber incidents this year so far, a drop from around 200 last year. Per the excellent @joetidy, NCSC said it's not exactly clear why the drop but suspects it's because high-profile hacks kicked a bunch of companies into cyber-defense mode.

DreamHost breach lasted months: Web host DreamHost confirmed its data breach dates back to at least August, but a spokesperson wouldn't say why the company didn't detect the breach sooner. The hackers stole login sessions and webmail, per a data breach notification filed with California. 

Apple Watches, now always-listening: Apple released a beta software update to Apple Watch users with always-on listening. The feature recaps conversations from the day and lets users rewind the past 15-seconds of audio as a transcript, while demolishing privacy for everyone else in the process since there's no way for people to proactively opt-out of this recording. (via Bloomberg, TechCrunch ($))

SageWorks, Chainalysis cyberattacks: Software giant Abrigo has confirmed a breach involving "irregular activity" affecting customers of the fintech software Sageworks. The incident led to a days-long outage, but no word yet on how much data was accessed or taken. And more… Crypto forensic firm Chainalysis said it lost "all" of its customers' live tokens in a breach, including those belonging to banks and law enforcement. (via American Banker ($), SecurityWeek, @dey)

Hackers flew off with airline booking data: Several airlines across Asia reported data thefts after a hack on Amadeus, a company that makes flight reservation and ticketing tech for airlines and hotels. Asiana Airlines and Korean Air, Cathay Pacific, Japan Airlines, Malaysia Airlines, and Singapore Airlines have all reported incidents. It looks like the breach happened over multiple years, spanning back to 2023. Woof. (via The Record, PhocusWire)

Marathon Health hack hits millions: Healthcare giant Marathon Health said 5.7 million patients had personal and medical data stolen during a breach in August, which allowed hackers to break in via social engineering. The breach will rank as one of the largest healthcare hacks this year. (via HIPAA Journal, BankInfoSecurity)

THE HAPPY CORNER

Just checking… y'all good? Take a minute to refresh and recharge in the happy corner.

I loved this long-read about how one hacker rooted his car just so he could fix the timezone on his 2014 Renault, which seemingly neglected to include a setting to change the time for daylight saving. The amount of work that went into this is genuinely impressive. (This seems to be a running theme of people trying to de-enshittify their tech.)

Moving on… That's actually Colonel Data Breach, thank you!

In case you didn't hear about encrypted tech provider Proton's CEO meltdown, 404 Media ($) has your back. The backlash to the CEO's remarks and AI-heavy culture at the company led some to cancel their subscriptions. Now, @parismarx reports that Proton employees are now pushing to unionize to ensure the CEO is "held to account." This is the way to do it! Union all the things!

The year is 2026 and for some inexplicable reason there's a remote code execution vulnerability in… *checks notes* Microsoft Paint?! Well, it's two for two after a similar bug hit Windows Notepad earlier this year, two of the most basic apps going. You almost have to laugh… What next, popping shells in Calc?! What are we even doing here… 

And this week's bonus cybercat, Robo-Millie. (You can almost hear her clanking around the house…)

Have good news to share? Get in touch! this@weekinsecurity.com.

CYBER CATS & FRIENDS

This week's adventure cyber-cat is Suzy, who can be seen here with her red-team go-bag, ready for the next cyber-adventure. Give her a target and a treat, and Suzy can break into any secure facility. Thanks so much to Erin for sending in!

SUGGESTION BOX

And that's it for this week's busy a.f. newsletter. Thanks so much for reading and joining in! As always, I love to hear from you — please reach out if you have anything for next week's newsletter, whether it's news, analysis, research, a fun story, something you're working on, or — of course — a cyber-cat (or friend). 

If you liked this week's newsletter, please share it! You can always tag me on ~the socials~. I'm on Bluesky and Mastodon for the most part, but always drop me a note if you want to say hello (or have feedback!)

Have a great rest of your week. I'll catch you next Sunday.

'til then,
@zackwhittaker