Resources · Attack surface, Supply chain, Connected devices, PHP, PAN-OS
Fridges, Hosting, Firewalls: What the Oct–Nov 2026 Attacks Share
In four weeks, attackers changed fridge settings in European supermarkets, reached a blood service through its supplier, wiped a hosting provider's cloud and broke into firewalls. What the cases share and what to check.
Our view
What these cases share is not a well-known company's main website. They involved fridge controllers reachable from the internet, a refrigeration supplier, a hosting provider's management servers and firewalls broken into through a PHP flaw; how the attackers got in is not confirmed in every case. We would start a security review with what a company exposes to the internet and whom it depends on, not with whether it looks like a target.
IntruForce
Between 11 October and 2 November 2026, attackers changed cooling settings in hundreds of European supermarkets and at three French plasma storage sites. They wiped much of a hosting provider's cloud and took over firewalls, the devices meant to protect a network.
These attacks hit different sectors in different countries. In each, the way in involved one of three things: equipment reachable from the internet, a supplier with access, or a flaw that was not yet fixed.
Supermarket refrigeration attacks: France, then across Europe
On the night of 11–12 October, attackers remotely switched supermarket refrigeration controllers across France into defrost mode. Some units reached about 50 °C, and stores had to throw food away. France's finance minister put the number of affected supermarkets at about 700; other estimates are lower.
France's cybersecurity agency ANSSI named controllers from Danfoss and Copeland (Dixell XWEB) in its alert. Danfoss told the press that most of the affected devices were old models it no longer supports. How the attackers got in has not been confirmed. Vulnerable software and default passwords are suspected.
Three weeks later, on the night of 1–2 November, a similar attack hit more than 115 stores. They were in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, according to BleepingComputer. Delhaize, Carrefour, Intermarché, SuperValu, Coop and ICA were among the chains. In one ICA store the temperature setting was changed to +50 °C, and one Coop system started heating instead of cooling.
Palo Alto Networks' research team Unit 42 counted more than 5,000 internet-reachable devices from the manufacturers named in the French alert. Being reachable does not mean being vulnerable. After the alert, the number of such devices visible from the internet in France fell from 1,853 to 316.
French blood service (EFS): the way in was the supplier
On 2 November, at three sites of Établissement français du sang (EFS), France's blood service, the temperature settings of plasma freezers were changed to extremely high values. According to press reports, the problem came through the refrigeration equipment supplier, Coolworld, which said a third-party component was involved.
EFS's temperature monitoring detected the abnormal settings. Staff moved or secured the plasma, and EFS said no products were lost.
Beget hosting breach: one breach, many customers
Beget is a Russian hosting provider and domain registrar. Beget estimates that attackers reached its management servers at about 02:00 Moscow time on 2 November. At 02:30 they launched malware that deletes data. At 02:55 Beget cut its servers off the network.
Beget expects most shared hosting sites to come back, but data on virtual servers, cloud storage and Kubernetes was wiped. Beget said the binary backups of virtual servers, which it kept itself, were lost too; some file-level backups survived. On 6 November it said it was rebuilding its cloud from scratch. The question for any company: can one breach at your provider delete both your servers and their backups?
PAN-OS firewalls broken into through PHP2Shell
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself, fixed on 21 October 2026. We covered what they are and how to find your PHP sites.
By 26 October, the research firm Dreamgroup reported at least 25 Palo Alto Networks PAN-OS firewalls and management servers taken over. The attackers combined PHP2Shell with a Linux kernel flaw, CVE-2026-46300, to get full control. CERT-EU, the EU institutions' cybersecurity team, notes that the count comes from Dreamgroup, not from a government agency. As in an earlier PAN-OS case, what mattered was a management interface reachable from the internet.
What about AI?
For the fridge, EFS and Beget cases, nothing published shows that AI was involved. In the PAN-OS case, Dreamgroup found AI tools on the attackers' server and says the code of their scripts suggests AI-assisted development, but it has no direct evidence that AI wrote the exploit.
A separate case is better documented. On 21 October, Microsoft reported that the group Storm-0940 used ARTEX, an open-source set of AI agents built for penetration testing, to automate attacks on cloud accounts. It tried to sign in to more than 2,250 Microsoft 365 tenants, the cloud accounts of organizations. One password-guessing run made over 151,000 failed attempts, and none succeeded. Automation increased the speed and scale of the attempts; the methods were the familiar ones.
Four lessons from these cases
- Equipment that rarely appears on an IT inventory, such as a fridge controller, had a management page reachable from the internet.
- A supplier or provider had access to the victim's systems, and that access was the way in.
- Backups sat with the same provider as the servers, so one breach reached both.
- A flaw in a widely used component, PHP, reached security devices; the fix on such a device depends on its vendor and on the owner installing it.
- What helped at EFS: temperature monitoring that detected the abnormal settings and staff who acted on it.
Refrigeration and building controllers, an old test server or a device installed by a contractor can all be missing from the list of what your company exposes to the internet. It helps to compare what you think you expose with what is actually exposed.
Monitoring covers what can be reached from the internet on addresses associated with your company. It does not audit your suppliers' internal systems or how your provider keeps your backups, and it does not fix anything. It shows your team what to look at first.
Five questions for whoever runs your IT
- Which equipment on our premises can be managed over the internet: refrigeration, heating and air conditioning, cameras, access control? Who installed it, and who holds the passwords?
- Which suppliers can connect to our systems remotely, and how quickly can we cut that access if one of them is breached?
- Are our backups kept with the same provider as our servers? Could one breach delete both?
- Which of our internet-facing systems run PHP or a firewall management page, and are they on fixed versions?
- If someone changed a critical setting, would a separate alarm tell us?
Sources
- Unit 42: attacks on European refrigeration systems, Palo Alto Networks, 6 November 2026.
- CERT-EU Cyber Brief 26-11: October 2026 incidents, including PHP2Shell on PAN-OS.