Weekly Axis Of Easy #472
Last Week’s Quote was: “There is no pleasure in having nothing to do; the fun is having lots to do and not doing it.” By ??? — Still unsolved, so the prize carries forward once more.
This Week’s Quote: “Security is a process, not a product.” By ???
THE RULES: No searching up the answer, must be posted at the bottom of this blog post, in the comments section.
The Prize: First person to post the correct answer gets their next domain or hosting renewal on us.
This is your easyDNS #AxisOfEasy Briefing for the week of October 12th, 2026. Our Technology Correspondent Joann L Barnes and easyCEO Mark E. Jeftovic send out a short briefing on the state of the ‘net and how it affects your business, security and privacy.
To Listen/watch this podcast edition with commentary and insight from Joey and Len the Legend click here.
Announcing easyPage.studio – customize your domain’s parked page
We’re pleased to announce the next generation of parked page customizations.
easyPage.studio has pre-configured templates (currently “Coming Soon” and “Link List”) style so you can let visitors to your parked pages know what’s happening: whether it’s “Coming soon”, where to find you on social media, “This Domain Is For Sale” or any other message you want to convey to visitors.
You can access it via https://easyPage.studio and once you set it up, your custom parked page shows up instead of the default easyDNS parking pages.
– mark
In this issue:
- A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited
- French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported
- An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room
- GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking
- Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF
Elsewhere Online:
- ShinyHunters Extorted A Boeing Spin-Off Before The Arrests Started
- FBI Arrests An Executive At A Ransomware Negotiation Firm
- Let’s Encrypt Cuts Cert Lifetime To 64 Days Starting February 2027
- Meta Says Hackers Took Code And Personal Data Of 1,500 In A GitHub Breach
- Hackers Have Been Exploiting A Critical Zimbra Flaw To Steal Emails
easyHermes Is Here
We’re pleased to announce the expansion of our agentic hosting platform with the rollout of easyHermes, the latest agent-enabled VPS appliance on the easyNode.ai platform. It’s a Nous Hermes–powered conversational agent that sits on the same private VPS and control panel as easyClaw, but is built for natural, steerable conversation — assistants, knowledge bases, and chat workflows — rather than shell access and autonomous ops.
Now you can finally settle the “openClaw vs. Hermes” argument for yourself, or just run both and let them fight it out.
Check it out today, and get your first month on us when you use promo code:
AXISOFEASY ⇒ https://easynode.ai
A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited
A YouTuber in Canada built a custom, Flock-style surveillance camera aimed at his local police presence that filters its feed to police vehicles only — tracking law-enforcement cars by plate / vehicle-class detection while deliberately ignoring civilian traffic — and the local officers’ response was the inverse of the usual story: they visited his home to voice privacy concerns about a private individual running vehicle-tracking hardware on them. Here the camera is a single creator’s livestream and the “survilled” are the department the device is pointed at, flipping the framing where it is normally the state with the cameras and the public filing the complaints.
The tension this produces is less “is it legal” (genuinely murky — recording police activity in public space is broadly permissible in much of North America, but dedicated plate-recognition infrastructure aimed at officers raises a different, less-settled set of questions, not least Flock’s own terms about who may run vehicle-tracking) and more what “police only” actually means in practice. If the claim holds, a hobbyist feed scoped to one driver class is arguably a lighter privacy posture than a municipal ANPR array aimed at every motorist; if it doesn’t, a home rig is a plate-logger with a livestream backend. If you run or evaluate any plate/vehicle-class stack — Flock, OpenALPR, or a home-brew rig — keep the data model, the “police only” scope claim (a filter, not a guarantee, and filters fail), and the consent posture as three separate questions, because the device is the easy part and the defensible claims around it are the rest of the job.
More via Tom’s Hardware
· Hat-tip: David Fraser
French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported
Hundreds of French supermarket refrigeration units were taken out this week in an attack that heated fridges and freezers to around 50°C (120°F), spoiling stock worth an estimated millions of euros and, at a number of locations, starting fires. Roughly 400 stores across the ~15,000 in France are affected — Carrefour says about 80 of its 6,000 stores, Monoprix 5% of its 400-plus, and Coopérative U well over 100 of its supermarkets in a “unprecedented” event; Intermarché says its units ran at 50°C for about six hours overnight and it threw out the affected food on health-risk grounds. The vector is a supply-chain one: the target was not the retailer’s IT stack but the Danfoss refrigeration controllers that sit on the shop floor — several exposed directly to the internet, with an anonymous actor claiming the work on X and Paris prosecutors opening an investigation.
The real story is the credential pattern: an admin account whose password is the current date, rotating daily and identical across the whole fleet — anyone who knows the date can log in — plus a demonstrated authentication bypass that POSTs to a controller endpoint and skips the login entirely, all on firmware the vendor itself admits is outdated. If you run any Danfoss — or any OT / building-automation — controller reachable from the internet, treat the date-password as a known, copyable default and the unauthenticated endpoint as a live foothold: pull the admin endpoint off the public net even if the password “rotates,” and assume any pre-fix firmware is a direct path to a physical consequence, not an inconvenience.
More via BBC · The Register
An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room
OpenAI disclosed an internal incident the FBI is now treating as a criminal case: an employee allegedly planted a small listening / recording device in a conference room to capture executive meetings, and the individual has since been arrested and suspended pending investigation. The pattern — a privileged insider with physical access placing a passive recording device where the sensitive conversation is known to happen — is a failure mode a perimeter, an MFA stack and a secrets-rotation policy cannot see at all: no packet intercepted, no credential leaked, no service compromised; the eavesdrop was physical, inside the building, done by someone with the keys.
The lesson is that the perimeter is only the perimeter if the threat model includes the people inside it. Insider recording is the cheapest zero-day in corporate life because it requires no exploit — only proximity and intent — so the controls that actually matter are the unglamorous ones: friction on the rooms that hold the sensitive conversations, device-allowlisting for anything that carries audio in and out of them, and a culture where “why did this person need to be in that room at that time” is a question that gets asked. Insider eavesdropping is not a security incident in the CVE sense; it is a governance incident that happens to have an audio trail.
More via Help Net Security · SecurityWeek
GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking
GitHub rolled out a tightening of its npm trusted-publishing flows after a flaw left more than 1,500 packages exposed to hijacking: the class of attack was an attacker using one user’s trusted-publishing configuration to publish new versions of a different user’s package. The fix is two-pronged — unvalidated trusted-publishing configurations now expire 48 hours after creation, and npm will (going forward) reject trusted-publishing tokens issued from GitHub Actions issue_comment events, alongside the existing restriction against pull_request_target as a token-issuing path. The unprivileged “someone with access to a comment can mint a publish token” window is closed, and the default for new configurations shifts from “trust until revoked” to “expire fast, revalidate.”
This lands where the actual risk has been all along: the packaging pipeline, not the code. A package hijack does not require a CVE in your dependency graph — it requires a token, and the token was being generated from a comment surface the platform had not gated, the same shape as a string of the recent supply-chain incidents across npm, PyPI and RubyGems. Treat your package-publishing token as a first-class credential: rotate on schedule, scope it to the repositories it actually needs, and never issue it from an event surface you do not control (an incoming comment, an external PR, a third-party webhook). The GitHub posture is a good one to copy even if your registry is not GitHub’s — a publish token that can be minted from an untrusted surface is a standing invitation, and this week the platform closed the front door.
More via The Hacker News
Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF
A critical heap buffer overflow in Ghostscript’s interpreter and rendering engine, tracked as CVE-2026-39919, lets a single specially crafted PDF trigger remote code execution. Wordfence’s Argus team (disclosed August 23) showed the trigger is a PDF containing a JPEG-2000 image that, when Ghostscript is pulled in to render it — for example WordPress calling ImageMagick / the PHP Imagick extension to build a thumbnail — runs the overflow. The affected range is Ghostscript 9.21 through 10.07.1, tested across Debian, Ubuntu, Fedora, Alpine, AlmaLinux and the official WordPress Docker image; the fix shipped in 10.08.0 (rolled out September 8) and is backported, but the common upload vector means this is active exposure now rather than theoretical.
For a self-hosting audience this is the “it is on your box whether you know it or not” category of bug: Ghostscript is a transitive dependency of document converters, print services, media pipelines and thumbnailers, and you can be running it in production without ever having deliberately installed it. The practical test is not “is Ghostscript here” (it probably is) but “is there any reachable path that turns a user-supplied PDF into an ImageMagick / Ghostscript call,” and in the WordPress case the honest answer for a lot of installs is yes. Update to 10.08.0+ wherever it runs, and if you cannot update the binary (vendor stack, container image, appliance) gate the PDF-to-image pipeline — treat a public PDF upload endpoint plus Ghostscript as one pre-auth RCE primitive until you have proven the version is patched and the path is gated.
More via BleepingComputer
Also on AxisOfEasy this week: Nothing new in Curated Posts since our last check — still nothing since May. We’re not going to pad this section with filler just to fill space; when something worth your time crosses our desk, it’ll be here.
Elsewhere Online:
ShinyHunters Extorted A Boeing Spin-Off Before The Arrests Started
https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/
FBI Arrests An Executive At A Ransomware Negotiation Firm
https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
Let’s Encrypt Cuts Cert Lifetime To 64 Days Starting February 2027
https://arstechnica.com/gadgets/2026/10/lets-encrypt-cuts-certificate-lifetimes-to-64-days-starting-february-2027/
Meta Says Hackers Took Code And Personal Data Of 1,500 In A GitHub Breach
https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach
Hackers Have Been Exploiting A Critical Zimbra Flaw To Steal Emails
https://arstechnica.com/security/2026/09/attackers-have-been-exploiting-critical-zimbra-flaw-to-steal-emails/
Previously on #AxisOfEasy
If you missed the previous issues, they can be read online here:
-
- October 9, 2026: #Axisofeasy471: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software
- October 2, 2026: #AxisOfEasy 470: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched
- September 25, 2026: #AxisOfEasy 469: Google Confirms Gemini Broke Into Three Real Companies During A Security Test
- September 18, 2026: #AxisOfEasy 468: A Compromised HBO Max Account Became A Malware Storefront
- September 11, 2026: #AxisOfEasy 467: Your LG TV Is Listening Even When It Is Off
