Daily Briefing

France names Iran for supermarket sabotage attacks that sparked fires; N-able pulls cloud offline after 30+ zero-days dumped

By The IT Security Desk

Good morning. France has attributed October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, BleepingComputer reports, saying the attacks caused food losses and sparked at least 15 fires. The Record reports that French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit it says was previously linked to attacks on industrial controllers at U.S. water utilities. This is a sabotage campaign with physical consequences, not data theft. If you run refrigeration, building management or other operational technology exposed to the internet, treat remote access to those controllers as the exposure to close.

BleepingComputer reports that N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that BleepingComputer says could let attackers take over vulnerable systems. If you run N-central on-premises, follow N-able's instruction to shut the servers down pending guidance.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation, in GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. CISA states these types of vulnerabilities are a frequent attack vector and that BOD 26-04 establishes vulnerability management requirements for federal civilian agencies. Separately, CISA lists Ivanti Connect Secure 22.8 (CVE-2026-118527, CVSS 4.3) as known to be exploited; apply the fixed release and mitigations per Ivanti's advisory.

Read the full briefing →