OpenAI says it won’t reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. […]
Source: BleepingComputer · 2026-10-29
Day: October 29, 2026
-
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI’s Codex and Microsoft’s VS Code remain unpatched, potentially putting developers who use affected configurations at risk. AI security startup Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic’s Claude Desktop, VS Code, and Codex, and disclosed four of the flaws to the affected vendors. GitHub independently fixed the Copilot vulnerability without receiving a report from Forever Security. All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers. Each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model – as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday report. Forever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot. Here’s what each of these looks like, starting with Cursor. Cursor: arbitrary code execution Typical web pages can’t run commands on the host computer because a web page’s JavaScript cannot talk to local apps. Cursor’s integrated browser, however, allows a page to call the agent’s composer. The agent reads this as instructions and follows them, but the instructions remain hidden from human users. This opens the coding agent up to prompt injection attacks that could allow an attacker to execute commands on the host machine. The researchers disclosed the vulnerability to Cursor on September 10, and the vendor silently patched the flaw on October 1. According to Forever, Cursor did not publish a security advisory about the issue or respond to the researchers’ disclosure. Cursor also did not reply to The Register’s request for comment. GitHub Copilot: address bar spoofing Under normal browser operations, a webpage cannot change the content of the address bar. “Copilot’s browser preview works differently,” Weizman wrote. “Some pages change their address without loading a new page, and the app cannot always see that. So Copilot let the page tell the app its own address.” The app checked only whether the text looked like a web address, starting with http, https or file, but it didn’t check where the tab really pointed to. This can be abused to trick the embedded browser into displaying a spoofed URL – such as github.com/login – in the address bar, while loading a fraudulent website – like a phishing page – underneath. The researchers found the address-bar spoofing flaw in GitHub Copilot 1.1.27 on September 26. GitHub independently fixed the flaw in a later Copilot build (1.1.29) on October 13 without receiving a vulnerability report from Forever. We reached out to GitHub and did not receive a response. Claude Desktop, Codex, and VS Code: arbitrary file read All three of these vendors’ coding assistants allow local HTML files opened in the built-in browser to escape its boundaries and access other files. Both Claude Desktop and VS Code allow local pages access to their respective project folders, but the researchers found that these restrictions did not apply to web workers – a browser feature that allows JavaScript to run in a background thread, separate from the page’s main thread. This means a local page can start a worker, and the worker can bypass restrictions to reach any file on the machine. Codex, however, didn’t have this same restriction, meaning a local page could read any file directly without a worker. Weizman said his team disclosed the issue to Anthropic on July 23, and the AI vendor declined the Claude Desktop bug report as invalid for a “workspace trust” gated security boundary. A day later, however, Noma Security reported the same flaw, according to Weizman, and Anthropic accepted the report as valid. Anthropic did not respond to The Register’s questions about either bug report or Forever’s timeline of events. Forever disclosed the Codex bug to OpenAI on July 27 and didn’t get a response. The flaw remains unpatched, but an OpenAI spokesperson told The Register that it’s aware of the issue and working to address it. On September 10, Forever disclosed the VS Code vulnerability to Microsoft and says the vendor also labeled it as an invalid workspace trust gated security boundary issue. The researchers claim it remains unpatched. Microsoft did not respond to our request for comment.®
Source: The Register Security · 2026-10-29
-
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI’s Codex and Microsoft’s VS Code remain unpatched, potentially putting developers who use affected configurations at risk. AI security startup Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic’s Claude Desktop, VS Code, and Codex, and disclosed four of the flaws to the affected vendors. GitHub independently fixed the Copilot vulnerability without receiving a report from Forever Security. All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers. Each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model – as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday report. Forever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot. Here’s what each of these looks like, starting with Cursor. Cursor: arbitrary code execution Typical web pages can’t run commands on the host computer because a web page’s JavaScript cannot talk to local apps. Cursor’s integrated browser, however, allows a page to call the agent’s composer. The agent reads this as instructions and follows them, but the instructions remain hidden from human users. This opens the coding agent up to prompt injection attacks that could allow an attacker to execute commands on the host machine. The researchers disclosed the vulnerability to Cursor on September 10, and the vendor silently patched the flaw on October 1. According to Forever, Cursor did not publish a security advisory about the issue or respond to the researchers’ disclosure. Cursor also did not reply to The Register’s request for comment. GitHub Copilot: address bar spoofing Under normal browser operations, a webpage cannot change the content of the address bar. “Copilot’s browser preview works differently,” Weizman wrote. “Some pages change their address without loading a new page, and the app cannot always see that. So Copilot let the page tell the app its own address.” The app checked only whether the text looked like a web address, starting with http, https or file, but it didn’t check where the tab really pointed to. This can be abused to trick the embedded browser into displaying a spoofed URL – such as github.com/login – in the address bar, while loading a fraudulent website – like a phishing page – underneath. The researchers found the address-bar spoofing flaw in GitHub Copilot 1.1.27 on September 26. GitHub independently fixed the flaw in a later Copilot build (1.1.29) on October 13 without receiving a vulnerability report from Forever. We reached out to GitHub and did not receive a response. Claude Desktop, Codex, and VS Code: arbitrary file read All three of these vendors’ coding assistants allow local HTML files opened in the built-in browser to escape its boundaries and access other files. Both Claude Desktop and VS Code allow local pages access to their respective project folders, but the researchers found that these restrictions did not apply to web workers – a browser feature that allows JavaScript to run in a background thread, separate from the page’s main thread. This means a local page can start a worker, and the worker can bypass restrictions to reach any file on the machine. Codex, however, didn’t have this same restriction, meaning a local page could read any file directly without a worker. Weizman said his team disclosed the issue to Anthropic on July 23, and the AI vendor declined the Claude Desktop bug report as invalid for a “workspace trust” gated security boundary. A day later, however, Noma Security reported the same flaw, according to Weizman, and Anthropic accepted the report as valid. Anthropic did not respond to The Register’s questions about either bug report or Forever’s timeline of events. Forever disclosed the Codex bug to OpenAI on July 27 and didn’t get a response. The flaw remains unpatched, but an OpenAI spokesperson told The Register that it’s aware of the issue and working to address it. On September 10, Forever disclosed the VS Code vulnerability to Microsoft and says the vendor also labeled it as an invalid workspace trust gated security boundary issue. The researchers claim it remains unpatched. Microsoft did not respond to our request for comment.®
Source: The Register — Security · 2026-10-29
-
Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion
Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity.
Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses.
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion.
These figures come from blockchain tracking and different estimates, so they don’t necessarily represent the amount stolen.
BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say. If confirmed, it would be the biggest crypto heist on record.
Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted “in… https://t.co/UzgOxw9jLE pic.twitter.com/9fBEaaZrWj
— International Cyber Digest (@IntCyberDigest) October 29, 2026
Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise.
“We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention.
Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important.
The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions.
Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself.
Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation.
One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.
The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Stay safe everyone.
— Paolo Ardoino
(@paoloardoino) October 29, 2026The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered.
The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation.
Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.
The company said its user funds were “completely safe.”
“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.
A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access.
For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages.
Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam.
The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed.
As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Binance)
Source: Security Affairs · 2026-10-29
-
Binance probes potential $5.8 billion crypto-theft hack
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. […]
Source: BleepingComputer · 2026-10-29
-
EU Satellite Imagery Delayed Over Gaza and Parts of West Bank by 24-hours
Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.
Imagery captured by the European Space Agency’s freely available Sentinel-2 and Sentinel-1 satellites appears to be delayed over Gaza and parts of the West Bank, a Bellingcat analysis has found.
While the delay remains relatively short at just 24 hours, this can still impact the speed at which analysts and researchers can observe what is happening in the region.
For example, the Israeli Defence Forces demolished homes in the West Bank Palestinian city of Hebron in recent days. New imagery captured on October 26, which included Hebron, would allow open source researchers to quickly confirm the demolitions, assess the impacted area and observe any unreported IDF activity. But imagery for the western half of Hebron was not available until October 27 due to the Sentinel-2 delay, inhibiting real-time fact-checking and reporting on this evolving situation.
A spokesperson for the European Union told Bellingcat that the delay was not related to events in Gaza but to “mitigate possible threats” due to the war in the Middle East “including Iran’s attacks on its neighbours and possible threats to European interests”. The delayed region of Sentinel tiles that cover Gaza as well as parts of Israel and the West Bank also extends over the Eastern Mediterranean Sea.
The European Union ordered a 24-hour delay on Sentinel satellite imagery over the Gulf of Oman earlier this year during US and Israeli strikes on Iran. However the delay impacting Gaza and parts of the West Bank has not been announced or previously reported.
“Such decisions are taken unanimously by all EU Member states and will stay in place as long as necessary,” the spokesperson said. They also said that while the Copernicus program, which includes the Sentinel satellites, operated a free and open data policy there were limitations to this for security.
When asked if the delay, which began in late March, was related to the presence of US vessels in the Eastern Mediterranean or if there were other areas of delay, the spokesperson said they had no further comment.
Sentinel Delays
The Sentinel-2 and Sentinel-1 satellites provide an invaluable source of imagery for open source researchers. This has been especially true this year, as commercial satellite imagery providers restricted access to imagery in the Middle East, including areas of active human rights concern, such as Gaza.
However, in July, the European Union published Council Decision 2026/1716, which ordered a 24-hour delay on Sentinel imagery over the Gulf of Oman, after a request from the US government which was involved in strikes on Iran at that time.
Just two weeks later, the European Union issued a corrigendum that unpublished decision 2026/1716 and removed it from the Council of the European Union record, although satellite data shows the delay has remained.
This decision, while it was available, was reportedly the first public notification of delayed Sentinel imagery. Yet it was not the first time that Sentinel imagery has been restricted, analysis shows. Bellingcat found four distinct regions of delayed satellite imagery during 2025 and 2026: the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea as well as the previously unreported delay in the Eastern Mediterranean Sea and parts of Israel, the West Bank and the entirety of Gaza.
Bellingcat’s analysis shows the regions where Sentinel-2 imagery is subject to a 24-hour delay, and when the delay was imposed. Only the July 15, 2026 delay over the Gulf of Oman was referenced by European Commission directives and the region referenced in 2026/1716 encompasses only a portion of the delayed tiles. Bellingcat’s analysis shows that these delays have been implemented in stages. Twenty-four hour delays of Sentinel-2 imagery were first observed by open source researchers in March and April 2025 after the US launched a naval and air strike campaign against Houthi targets in Yemen.
The previously unreported imagery delay in the Eastern Mediterranean began on March 28, 2026, the same month that commercial American space imaging company Planet Labs also restricted imagery across the Middle East. The Gulf of Oman delay began on July 15, 2026, two days after the publication of Council Decision 2026/1716.
Decision 2026/1716 also specified that the delay be implemented for both Sentinel-2 and Sentinel-1 radar imagery. Bellingcat’s analysis of Sentinel-1 image availability shows that this is the case for both the Gulf of Oman region and the unreported region over the Eastern Mediterranean Sea. However, the 2025 restrictions on Sentinel-2 imagery in the Red Sea and Gulf of Aden are not implemented in Sentinel-1.
Sentinel-1 imagery uses “synthetic aperture radar” to capture lower resolution radar images that can collect data at night and on cloudy days. This differs from Sentinel-2, which captures optical satellite imagery at higher resolution.
Bellingcat’s analysis shows the regions where Sentinel-1 satellite imagery is subject to a 24-hour delay and when that delay was imposed. A Tale of Two Tiles
Sentinel satellite imagery is most commonly accessed by open source researchers through Copernicus Browser, a free online platform, but it is also distributed as large tiled files in the Copernicus Data Space Ecosystem. These tiles are numbered using the Military Grid Reference System, and can be listed using APIs that provide information on each tile, including the capture and publication time. By comparing the capture and publication time, the publication delay can be computed.
For example, the catalog information for the tile T36RXV, which includes Gaza and portions of the West Bank, Negev and Egypt, provides the following metadata for the October 21, 2026 capture.
Metadata from tile T36RXV, which includes Gaza and portions of the West Bank, Negev and Egypt. This shows that while the image was captured at 08:20 UTC on October 21, it was not published until 10:09 UTC on October 22 — almost 26 hours later. This is in contrast to the neighboring tile T36RYV, which includes parts of the West Bank, Israel, and Jordan. API data for this tile shows that the image was published at 12:10 UTC on October 21, just under four hours after the capture time.
Metadata from tile T36RYV, which includes parts of the West Bank, Israel, and Jordan. This difference is not unique to this date either. Bellingcat’s analysis shows that this tile has been consistently delayed by one day since March 28, 2026.
Graphing the publication delay for two adjacent Sentinel-2 tiles shows a clear difference beginning March 28, 2026. This method can be extended further, and by analysing every tile with valid publication date timestamps, Bellingcat identified all global Sentinel-2 and Sentinel-1 delays since 2023. The only consistent delays visible were those identified in the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea and Eastern Mediterranean in 2025 and 2026.
Impact on open source investigations
While the 24-hour delay on certain Sentinel imagery is a less severe restriction than other satellite providers have imposed, it can still impact the open source research process in fast moving situations. This is especially so in recent months as the European Space Agency’s Sentinel satellite data has emerged as a refuge as other satellite data is censored.
The image below shows how imagery for the eastern half of Hebron was visible on October 26, but not the western half where demolitions took place earlier this week.
The city of Hebron, Palestine, seen in Copernicus Browser on October 26, 2026. While imagery is available for the eastern half of the city, there is no recent imagery of the western half. The shape of the missing tiles can be seen by zooming out within the Copernicus browser, demonstrating how imagery of Gaza and other parts of Israel and the West Bank are also delayed.
The missing tiles also include Gaza, parts of Israel, Egypt, and Cyprus, and the Eastern Mediterranean Sea. Sentinel imagery covering western Hebron after the demolitions took place was published on October 27. However, the delay prevented local reports from being verified with satellite imagery while the situation was still ongoing.
Some Sentinel-2 users have previously described the challenges of covering fast-moving issues in the Gulf of Oman when the Sentinel delay was announced in March.
Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.
Source: Bellingcat · 2026-10-29
-
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. […]
Source: BleepingComputer · 2026-10-29
-
Japan Airlines suffers third-party data breach exposing passenger info
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. […]
Source: BleepingComputer · 2026-10-29
-
Extent of Crime Stoppers data breach unknown: Sault Police chief
James Hopkin reports: The Sault’s police chief says it’s currently unclear how many anonymous tips received by Crime Stoppers locally were potentially exposed in a massive data breach. Both the Sault Ste. Marie Police Service and the Anishinabek Police Service have paused their relationship with the local Crime Stoppers chapter — causing the organization to…
Source: DataBreaches.net · 2026-10-29
-
US Probes Suspected Hack Behind Military Base Freezer Failures
The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack.
The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to Reuters. One official said US investigators are also in contact with French authorities about a similar attack on commercial freezers that disrupted supermarkets in France earlier this month. This is the first time Reuters has reported that the US incident is being treated as a suspected cyberattack.
“The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.” Reuters reports.
“One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.”
It is still unclear who is behind the attacks. Reuters could not determine how far the investigation has progressed or whether investigators have identified the cause or those responsible. The Pentagon said a unit of US Cyber Command is working closely with other government agencies and law enforcement. The Army’s Criminal Investigation Division confirmed that its Cyber Field Office is involved and is working with French law enforcement to investigate the freezer outages in Europe.
The incidents hit commissaries, the on-base stores where military personnel buy food. At least six were affected in late August, according to Reuters’ review of the bases’ Facebook posts and website updates. Stars and Stripes named Fort Irwin, F.E. Warren, Naval Station Newport, Columbus and Travis among the confirmed stores, and some outlets count up to 14 sites in 11 states, though not all are confirmed.
Source: Signal and Silence Blog In at least one case the freezers didn’t just stop. Their temperatures were cranked up overnight, which left mounds of wilted or melted food in the morning. Fort Huachuca in Arizona said on August 26 that its freezer went into defrost mode and heated up all the food, adding that trust us when we say it was spoiled.
The Pentagon wasn’t the first to speak. A recently created blog called Signal and Silence reported the freezer failures and the possibility of sabotage on August 28, while Stars and Stripes reported the involvement of military investigators and Britain’s Daily Telegraph reported the contacts with the French. The French Embassy in Washington had no comment. Frozen food is the one asset where damage takes hours and evidence takes the form of puddles.
The French attack is the clearest example. Hackers took control of the cooling units in more than 350 stores and raised the temperatures. Frozen food aisles were emptied, and some units got so hot they caught fire. One supermarket owner said the total cost could reach tens of millions of euros.
The same thing happened in Arizona: attackers made the units hotter instead of just turning them off.
Reuters could not tell which brand was used at the US bases, and Danfoss, which is the manufacturer targeted in French supermarket attacks, did not reply. A public research report on Danfoss controllers came out before the incidents, but nothing shows a link to the bases.
There is a history of attacks on refrigeration systems. Danfoss reports that hackers targeted supermarkets in Russia and Israel in 2022 by exploiting outdated cooling controllers. In December 2025, US prosecutors accused a Ukrainian woman of belonging to a hacking group that disrupted refrigeration at a meat plant in 2024, ruining more than 2,000 pounds of meat.
Earlier this year, the Global Food Safety Initiative urged food safety experts and IT leaders to work together to protect refrigeration systems.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Military Base Freezer)
Source: Security Affairs · 2026-10-29
