Exposed refrigerator controls spoil food across European supermarkets

A breach affecting hundreds, potentially thousands, of refrigerators across Europe has been discussed in the SANS Internet Storm Center’s Stormcast for 4 November 2026. The episode attributes the intrusion to devices that connect to exposed control panels and are subsequently switched into defrost mode, driving temperatures up to around 50°C (120–130°F) and causing food spoilage.

The podcast notes that the attackers are often blamed on weak default passwords—an IoT pattern—but emphasizes there was limited clarity on the exact intrusion method. The host, Johannes Ullrich, also hints at an ongoing interest in gathering data to better emulate these devices for honeypot research, requesting contact from individuals with access to affected refrigerators or thermostats.

The episode also covers several separate security items. VulnCheck is cited as indicating active exploitation of a patch for SIMATIC equipment running Node-RED, specifically the admin API, despite the fix having been applied in August; the attack reportedly downloads additional malware via standard Linux scripts and wget to gain persistent remote access to controllers.

OPSSHIELD’s cPGuard update channel is described as compromised, with attackers inserting a malicious script into the update flow to exfiltrate credentials. Additionally, the podcast references Calif, a security firm, publishing a video showing successful exploitation of an iPhone 18 even with Lockdown Mode enabled, resulting in a full-screen animation and rooted access. The host cautions listeners to be wary of unsolicited AirDrop content and to verify the sender.