France blames Iran for refrigerator hacks that sparked fires

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

• The full Metacurity archive: Every newsletter, searchable and browsable.
• Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
• Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
• A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

French officials accused Iran's Revolutionary Guards of responsibility for the cyberattacks that knocked out commercial refrigerators and freezers across France last month, saying there ​would be consequences for Iran.

In a joint report, issued by French spy and cyber agencies, officials accused Shahid Kaveh — described as a cyber offensive unit tied to the Revolutionary Guards — of being behind the hacking campaign, and named three alleged associates, Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.

The French report said the hackers worked through numerous front groups masquerading as vigilante hackers, including "CyberAveng3rs" and "Cyber Isnaad Front."

The French said they were able to link Shahid Kaveh to the ​hacks by tying the incidents to the digital infrastructure used to sabotage the fridges, by matching the pattern of the intrusion to other hacks carried out by Shahid Kaveh and by recovering traces of Farsi in the ‌attack infrastructure.

The report ⁠said that a total of 700 commercial sites had been targeted across France and that at least 15 fires had broken out as the hackers cranked up the heat. The report said that most of those affected were supermarkets but that the hacking also affected small butcher stores, a slaughterhouse and factories processing foodstuffs.

The hacks that struck hundreds of French supermarkets in early October were among the most disruptive cyberattacks of the Iran war that began in ‌February, a conflict that has been marked by scattered incidents of alleged digital disruption.

These have included hacks against the Los Angeles transit system in March, against US water treatment plants in July and against ships bound for the United States in August.

The French announcement was made only minutes after Reuters revealed that investigators privately suspected Iran of being behind the attacks. French Foreign ​Minister Jean-Noël Barrot said the Iranian ambassador had been summoned to France's foreign ministry. Barrot also threatened further EU sanctions against Iran.

The effects of the October 11 hacks were dramatic. ​Some refrigerators had the temperature turned up so high they caught fire. In the hours following the incident, supermarket employees carted boxes full of perished meat ⁠and melted ice cream into giant trash containers. The attack's total costs could add up to tens of millions of euros nationwide, one French supermarket owner estimated.

The ​sabotage of European supermarket fridges was preceded by ​at least one similar incident in the United ⁠States. (Raphael Satter and Gabriel Stargardter / Reuters)

Related: French CERT, New York Times, CBC, UNN, Voice of Emirates, France24, Bleeping Computer, The Record, Gizmodo, CircleID, SBS, Sky News, Financial Times, The Register, The New Arab, Security Affairs, Al Jazeera, The Washington Post, Associated Press, Channel News Asia, Slashdot, Business Standard, Business Standard, PCMag.com, TechCrunch, Sydney Morning Herald, The West Australian, Korea Times News, The West Australian, Japan Today, Devdiscourse News Desk, Jerusalem Post, Paris Guardian, The Guardian, Wall Street Journal, RFI, Le Monde

Blockchain analytics firm Elliptic said that the hackers who stole $6.3 billion from Binance in crypto’s biggest ever heist have turned to one of the sector’s most gimmicky assets to launder a slice of the proceeds: memecoins.

At least six new tokens were created on the NEAR blockchain network within days of the theft, Elliptic said, which allowed the attackers to pass through about $430,000 of the stolen crypto. The scheme was designed to disguise the path of money — rather than dupe unwitting traders into exchanging stolen assets for clean cash — and make it harder to trace where the ill-gotten gains eventually ended up.

Each of the six tokens — identified as FUK, OLCCL, MEILI, MMLI, DABI and SINU — traded heavily for a few hours after creation before being abandoned, Elliptic said. The hackers used NEAR tokens stolen from Binance to buy up the memecoins on decentralized exchanges, allowing them to receive the stolen NEAR in unconnected wallets on the other side of the trade. About $44 million in stolen NEAR remains untouched.

The tokens bore logos in classic memecoin style. One showed a picture of a monkey wearing a pink bow, while another featured an image of Elon Musk under a banner that read “Elon 2028 President,” Elliptic said. There is no suggestion that the Tesla Inc. chief executive officer has any connection to the token, it added. (Emily Nicolle / Bloomberg)

Related: Elliptic, Cyber Security News, CryptoNinjas, The Daily Hodl

Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.

Security researcher Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce.

Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member numbers. The database also stores customer login tokens (called JWTs) that keep customers logged in to their apps without having to repeatedly enter their own passwords. The database also contained Wyndham files and documents.

According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.

The researcher said Wyndham has no way to report security flaws, and asked for TechCrunch’s help in alerting the company. Soon after TechCrunch made contact with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database. (Zack Whittaker / TechCrunch)

Related: Neowin

The Cybersecurity and Infrastructure Security Agency finally got a new nominee for director, with Donald Trump nominating Michael LoSapio, chief information security officer at Palantir.

CISA has been without a Senate-confirmed director for the entirety of Trump’s second term, after his first pick, Sean Plankey, languished in the Senate before withdrawing in April.

LoSapio could face some obstacles of his own, with Palantir far from a popular company, as Democrats are set to take over Congress. Democrats have scrutinized the company over its work with the Department of Homeland Security, even as Palantir has denied aiding mass surveillance of immigrants.

As of late last month, Sen. Ron Wyden, D-Ore., was also still waiting for CISA to release a public version of a report on telecommunications cybersecurity, and he had placed one of several Senate holds on Plankey pending the receipt of that report. (Tim Starks / CyberScoop)

Related: Reuters, Defense One, Cyber Daily, NextGov/FCW

Fireworks, a popular infrastructure provider that helps large enterprises and startups build and run their own AI models, had some of its customers’ datasets and models accessed by hackers over the course of the past month.

The breaches expose a risk in corporate America’s rush to build cheaper, bespoke AI models: in doing so, they often send proprietary information, like sensitive customer data, to platforms like Fireworks. And a compromise at Fireworks would potentially expose information of its customers, making it an attractive target for hackers.

Fireworks counts roughly 10,000 enterprise custo­mers—including Uber, Shopify, Upwork and DoorDash as customers, as well as marquee startups like Cursor and Cognition—who use Fireworks to build specialized AI using their own proprietary data on top of cheaper, often Chinese models.

Fireworks said the evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as "LLMJacking". On November 2, Google Threat Intelligence Group and Mandiant published a blog post about the rise of LLMJacking, their motives, techniques used, and mitigation. (Anna Tong and Rashi Shrivastava / Forbes and Fireworks AI)

Related: Bleeping Computer, The Information, Shattered, Bloomberg, Cyber Security News, The Neuron, Unite.AI, Ukrainian National News, RuntimeWire

Google DeepMind researchers used agentic AI to mathematically prove, or “formally verify,” a number of the Signal protocol’s key cryptographic guarantees—a landmark development for the widely used cryptography and AI itself.

Conducted as a sort of proof-of-concept project in just four weeks, the work is significant in two ways. It serves as further independent validation of the cryptography that protects massive quantities of the world's communications on platforms like the Signal app, Google Messages, and WhatsApp. And it demonstrates Google DeepMind's formal verification capabilities using a new AI framework called AlphaProof Code.

More broadly, AI-aided formal verification is having a moment, but it is unclear how practical it will be for widespread use and how effective it can be at securing large amounts of code. Proponents of formal verification have long referred to it as a sort of holy grail in software security, because it uses math to check and validate that software is functioning as intended—in other words, that it doesn't have critical vulnerabilities.

Before the AI era, it was incredibly time-consuming for people to describe the characteristics of software they wanted to prove, turn these summaries into formulas, and then develop the proof. Agentic AI can significantly cut down the time of the latter project, enabling analyses like DeepMind's Signal evaluation. But even this analysis was limited in scope—it did not, for example, formally verify the entire Signal mobile app—and DeepMind researchers emphasize that their findings are just one milestone in a larger process.

“We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that,” Swarat Chaudhuri, a DeepMind research scientist, tells WIRED.

The DeepMind analysis did not find any new vulnerabilities in the portions of the Signal protocol it looked at, but when the researchers used AlphaProof Code on older versions of Signal that contain known and long-fixed vulnerabilities, it correctly identified them and showed that the protocol could not be formally verified. The researchers are releasing the specification and proof they developed for the Signal protocol analysis to aid other formal verification work.

While the speed of the project was notable, the DeepMind researchers point out that they were able to get a head start to a degree because of some past formal verification work that the Signal Foundation has conducted. (Lily Hay Newman / Wired)

Related: Forbes, Axios, 9to5Mac

Vanderbilty University networks experienced a cybersecurity incident, according to the university and
Vanderbilt University IT (VUIT).

Faculty were notified first, with there being an hour and 36 minutes before students were notified.

Dean of the Blair School of Music Melissa Rose said VUIT suggested students log off the network. “Everyone is following VU protocols and waiting for further instruction. VUIT is working on it. For now, we are simply asking everyone to stay off the network entirely until we know more,” Rose said.

Students reported VUIT staff entering classrooms across campus, alerting faculty that school-issued computers are not safe to use. VUIT has urged the Vanderbilt community to close all Microsoft Word documents, OneDrive, and Dropbox folders.

VUIT is urging the community to shut down university-issued devices and remain vigilant.

“[VUIT] is actively investigating and working to contain the situation. We are asking all members of the university community to shut down university devices, disconnect from university WiFi, and remain extremely vigilant,” the statement reads. “Take immediate action if you notice any unusual or suspicious activity.

The ransomware group BYOD appears to have claimed responsibility for the attack, based on messages attributed to them online.

One Vanderbilt employee described to the Banner what she saw on her computer Monday after starting it up. A notification that the computer was running a “system update” was followed by another saying that it was deleting old files, they said. Then came a warning about a ransomware attack with a link to click for more information. At that point, they said, all the computer’s files became “.byod” files. (José Ruiz-Zepeda and Charlotte Castle / The Vanderbilt Hustler and Steven Hale / Nashville Banner)

Related: Gizmodo, Bleeping Computer, The Washington Post, Axios, Cybersecurity Insiders, The Record, Nashville Scene, Hoodline, WZTJ

ControlPlane security researcher Chris Nesbitt-Smith found more than 100 serious vulnerabilities in publicly available UK government code, putting sensitive data at risk as a result of poor cyber hygiene.

The UK government has defaulted to openly publishing code it produces with public money for around a decade because it’s transparent, and making it easier for code to be reused is cost-efficient. This includes the Department of Health and Social Care, the Home Office, and local authorities.

While Nesbitt-Smith found the vulnerabilities using Claude’s Opus and Sonnet AI models, he says that he used consumer-grade models on a laptop and that many of the issues could have been caught by a routine IT health check. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he tells WIRED. “It’s all daft stuff.”

In the most serious case he identified, the Planning Inspectorate, which handles land-use matters across England, had failed to fully remove a login after it accidentally committed it to the public GitHub repository. The fact that the credentials gave such wide access—and seemingly didn’t expire—compounded the agency’s accidental publication of them, “made it particularly dangerous for them.”

The complete Microsoft Entra ID would have given “god-tier” read and write access to all SharePoint sites and private employee OneDrive accounts, according to Nesbitt-Smith, including HR records. It also would have given access to sensitive libraries that safeguard evidence under legal hold for statutory planning inquiries and appeals, according to the security researcher who found it. “The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” Nesbitt-Smith says. (Isabella Ward / Wired)

Researchers at ESET report that the Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan.

A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU).

"After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today.

Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).

In the campaign analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers.

The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery on the Exchange server.

Turla configured the malware to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files, and match certain sender, recipient, and subject criteria.

Another malware component, called CerealNeuron, waits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution.

CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute. (Bill Toulas / Bleeping Computer)

Related: We Live Security, Help Net Security, Cyber Scoop, Globe Newswire, Infosecurity Magazine

Australia will create a new artificial-intelligence safety regulator that will have the power to impose “significant penalties” on companies that do the wrong thing, Prime Minister Anthony Albanese said.

The government is in the process of writing AI-related legislation, with the new regulator to be included in those bills, Albanese said at a press conference. Firms will need to provide mandatory notifications of any security incidents to the government and allow independent evaluation of their models, he added.

“Strong mandatory safety and security protections will be legislated through the AI Standards and apply to all frontier AI companies that wish to operate in Australia,” the government said in a statement. “These protections will be enforced by a new targeted regulator for AI safety, which will work with the Australian AI Safety Institute to provide technical expertise and oversight as global standards evolve.”

The issue of AI safety came to the forefront in September when it was revealed that an OpenAI model had hacked an Australian government website. While the information accessed wasn’t sensitive personal data, the attack on a government website shone a spotlight on such risks.

That followed a series of incidents in which OpenAI models broke into online resources of outside companies, most notably the case of Hugging Face, a website hosting AI datasets.

Australia established a review in response to the hacking. It recommended changes including reforming criminal laws so that the government can criminally punish “egregious regulatory non-compliance” and create a “failure to prevent offense " where a company creates a model and doesn’t take reasonable steps to stop it from doing harm.

The government will accept all of the review’s recommendations, Albanese said. (James Mayger / Bloomberg)

Related: Australian Government, Capital Brief, Reuters, Reuters, iTnews, The Economic Times, Australian Financial Review, Cyber Daily, New York Times

Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers.

The company says the exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services.

The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords.

Also, email addresses registered with a “SEGA Account” are handled by a separate distribution system and were not affected by this incident.

The company is working with ARARA to determine what data was exposed and says it has no confirmed evidence of misuse. (Bill Toulas / Bleeping Computer)

Related: SEGA, Beta News, SC Media, Cyber Security News

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a security advisory.

As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.

Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code.

While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents. (Sergiu Gatlan / Bleeping Computer)

Related: Google, Security Week

N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems.

Security researcher Sean Bales disclosed the vulnerabilities late Sunday, November 8, and published a GitHub repository called Able2Shell containing proof-of-concept exploits for the flaws.

N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to monitor, manage, and secure customer devices and networks remotely.

The researcher says the vulnerabilities were tested against N-central Appliance 2026.4.0.31, a pre-release version of the software, and believes most, if not all, flaws also affect earlier versions.

Bales also confirmed to BleepingComputer that the discovery of the vulnerabilities was AI-assisted.

The disclosed vulnerabilities include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws.

One of the most critical exploit chains abuses an unauthenticated XXE vulnerability in N-central's service-import functionality to steal a trusted local session, reset an account password, and execute commands on the server as the nable user. (Lawrence Abrams / Bleeping Computer)

Related: Sean Bales on LinkedIn, TechTarget, DataBreachToday.com

Microsoft has been pressing the Trump administration to halt plans to bar Chinese imports of ‌a key component used in AI data centers, three people familiar with the situation said.

Reuters reported in August that the Trump administration wants to ban US imports of new models of Chinese optical transceivers, which allow data to travel over fiber-optic cables at the speed of light within data centers. The concern is that they could be used by Beijing to steal data, install ​malware or disrupt service at US data centers.

Microsoft has 35 data centers under construction in the US and another 134 planned, according to Cleanview, a market ​intelligence company which tracks data center development. It is one of a group of companies and trade groups making the case ⁠to the Trump administration that such a ban could irreparably damage the US edge over China in the AI race by further slowing the data center ​rollout, the sources said.

The cloud and software company was one of a handful of firms that met with officials from the White House Office of Science and Technology ​Policy and the National Security Council in September to flag the supply chain challenges that any such ban would present, two of the sources said.

"It really threatens to arguably grind (the data center rollout) to a halt," said John Miller, general counsel of the Information Technology Industry Council (ITI), a tech lobbying group, which has publicly urged the administration not to move forward with a ban.

He said many cloud companies ​have already purchased the AI chips needed for the buildout. "Those chips, without optical transceivers literally could just sit there waiting around un-utilized until you actually have the ​transceivers to essentially connect them together," he added.

Some data centers need millions of optical transceivers to connect servers, routers and switches.

The Federal Communications Commission, which oversees the US telecom industry, ‌is working ⁠on the ban. (Alexandra Alper / Reuters)

Related: CoinDesk

Ethersphere’s automated release process was compromised on November 9, 2026, distributing malicious software through official channels.

The affected products belong to Swarm, a decentralized storage network within Ethereum’s ecosystem.

The malicious @ethersphere/bee-js 13.3.0 npm package appeared around 00:09 UTC, followed by Swarm Desktop 0.56.2 at roughly 00:36 UTC—about 27 minutes later.

SlowMist said attackers broke into GitHub accounts and abused legitimate release procedures. The release-workflow breach involved either the bee-worker bot or stolen Continuous Integration credentials.

The tampered packages contained postinstall hooks: scripts that execute automatically during installation without another user click. Those scripts contacted an attacker-controlled server and downloaded additional payloads.

Researchers independently found malware designed to steal Swarm wallet files and install persistent remote-access tools. Malicious releases could expose wallet credentials and private keys while leaving permanent backdoors on affected systems.

The payloads targeted config.yaml and data-dir/keys/swarm.key. The latter held an encrypted Ethereum keystore, while its unlocking password was stored nearby in plaintext. The files were sent to the attackers.

The research findings identified the goal as draining xDAI and xBZZ tokens, checkbook funds, and stake associated with Swarm nodes. (Amelia Tomasicchio / The Cryptonomist)

Related: Cryptonews

Best Thing of the Day: Fewer Blocks, More Defense in New and Improved Mythos 5.2

To help ensure safety and alignment keep step with growing model capabilities, Anthropic ran extensive pre-release safety testing on the model that underlies Fable 5.2 and Mythos 5.2, saying it has produced fewer unnecessary blocks, while implementing its strongest-ever protections against distillation attacks.

Worst Thing of the Day: Let's Rummage Around Reddit Twice as Much

According to Reddit's latest transparency report, there was an 89% increase in legal requests from government and law enforcement to remove content from Reddit and a 6.8% increase in non-emergency legal requests for Reddit users’ account information compared to the second half of 2025.

Bonus Worst Thing of the Day: Let's Pit Offensive Cyber Against Defensive Cyber and See Who Wins

FBI Director Kash Patel says that the bureau has elevated its cyber operations into a new branch, consolidating offensive and defensive operations under one leadership chain.

Closing Thought