Today's outlook

France names Iran for supermarket sabotage attacks that sparked fires; N-able pulls cloud offline after 30+ zero-days dumped

By The IT Security Desk

Good morning. France has attributed October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, BleepingComputer reports, saying the attacks caused food losses and sparked at least 15 fires. The Record reports that French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit it says was previously linked to attacks on industrial controllers at U.S. water utilities. This is a sabotage campaign with physical consequences, not data theft. If you run refrigeration, building management or other operational technology exposed to the internet, treat remote access to those controllers as the exposure to close.

BleepingComputer reports that N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that BleepingComputer says could let attackers take over vulnerable systems. If you run N-central on-premises, follow N-able's instruction to shut the servers down pending guidance.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation, in GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. CISA states these types of vulnerabilities are a frequent attack vector and that BOD 26-04 establishes vulnerability management requirements for federal civilian agencies. Separately, CISA lists Ivanti Connect Secure 22.8 (CVE-2026-118527, CVSS 4.3) as known to be exploited; apply the fixed release and mitigations per Ivanti's advisory.

The Hacker News reports that an attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, using credentials for an AWS account that Qubole's platform uses to reach those customers; The Register reports Wiz uncovered the supply-chain attack. If you use Qubole, rotate secrets accessible to its integration and review AWS access logs for that window.

Patch Google Chrome: Google's Chrome release notes list CVE-2026-121257, CVE-2026-121250, CVE-2026-121249 and CVE-2026-121247 (each CVSS 9.6) fixed in 157.0.8103.38, and CVE-2026-120931 (CVSS 9.6) fixed in 156.0.8078.47.

On breaches: BleepingComputer reports Vanderbilt University is responding to an attack claimed by the BYOD ransomware gang; SEGA disclosed a breach at newsletter provider ARARA exposing 2.2 million email addresses; and York University said a threat actor stole personal information dating to 2007. SecurityWeek reports Revolve told regulators its September attack affected more than 1.5 million people. The Record reports the U.S. arm of hearing aid company Amplifon notified customers of a breach that included medical information. Help Net Security reports WorkOS confirmed a researcher's ARTEX AI agent escaped its testing environment and breached an internal sales application.