--- title: "#AxisOfEasy 475: Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries" type: "post" post_id: "34527" slug: "axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries" canonical: "https://axisofeasy.com/aoe/axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries/" markdown_url: "https://axisofeasy.com/aoe/axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries.md" json_url: "https://axisofeasy.com/aoe/axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries.json" txt_url: "https://axisofeasy.com/aoe/axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries.txt" published: "2026-11-06T23:00:44+00:00" modified: "2026-11-06T16:00:52+00:00" author: "Mark E. Jeftovic" categories: - "#AxisOfEasy" tags: excerpt: "Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries Binance Loses $6.43 Billion In A Rigged Interview, AI-Tool Heist — The Biggest Crypto Theft Ever WordPress Core Flaw On CISA's KEV — Exploited During The Upgrade Window... this and more in AofE #475" site_name: "" publisher: "" language: "en-US" license: "" generator: "easyPress AI Discoverability" generator_version: "2.0.14" --- *![](https://axisofeasy.com/wp-content/uploads/2020/02/weekly-briefing-axis-of-easy.jpg)* --- *Weekly Axis Of Easy #475* ========================== --- ***Last Week’s Quote was:** “We choose mania over boredom every time.” was by James Gleick. No one got it.* ***This Week’s Quote:** “We are made wise not by the recollection of our past, but by the responsibility for our future.” By ???* ***THE RULES: No searching up the answer,** must be posted at the bottom of this blog post, in the comments section.* ***The Prize:** First person to post the correct answer gets their next domain or hosting renewal on us.* --- *This is your easyDNS #AxisOfEasy Briefing for the week of November 2nd, 2026. Our Technology Correspondent Joann L Barnes and easyCEO Mark E. Jeftovic send out a short briefing on the state of the ‘net and how it affects your business, security and privacy.* *To Listen/watch this podcast edition with commentary and insight from Joey and Len the Legend [click here.](https://axisofeasy.com/podcast/axisofeasy-475-supermarket-freezers-across-europe-hit-again-wave-2-seven-countries/)* --- **Your Agent Needs A Domain** We’re pleased to introduce **x402nic by easyDNS**, fully agentic enabled domain registrations in over 460+ TLDs Works with openclaw, Hermes, Claude, Codex and Grok bot. Details at [https://x402nic.com](https://x402nic.com/) [![](https://axisofeasy.com/wp-content/uploads/2026/11/x402nic-previewadd.png)](https://x402nic.com) ***In this issue:*** - **Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries** - **Binance Loses $6.43 Billion In A Rigged Interview, AI-Tool Heist — The Biggest Crypto Theft Ever** - **WordPress Core Flaw On CISA’s KEV — Exploited During The Upgrade Window** - **Linux Kernel TCP RCE (CVE-2026-98432) — Red Hat Patches, Ubuntu Still Testing** - **Chinese Hackers Run ARTEX AI Against 200 Organizations** ***Elsewhere Online:*** - **Syrian Hacker Behind The Fake Tweet That Triggered A $136 Billion Market Drop Gets 42 Months** - **UEFI Bootkit Infected Fully-Patched Windows Machines — “Is Microsoft To Blame?”** - **Google Adds A $250,000 Cloud VRP Reward For “Root-In-Cloud” Bugs** - **Police Seize 100+ Servers In A €4 Million Investment-Fraud Crackdown** - **Harvard University Data Breach Exposed 851,000 Accounts** --- [**Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries**](https://www.bbc.com/news/articles/cq1kd1nee80eo) Dozens of supermarkets in seven countries reported refrigerators and freezers running hot overnight, some to as high as 50°C. Around 40 Delhaize stores in Belgium and Luxembourg were affected, with a smaller number of shops hit in Sweden, Ireland, the Netherlands, Estonia and Finland. Belgian freezer-maker Sabcobel says the units’ evaporators were switched to defrost mode — the same method as last month’s French attack that seized up to 700 stores and wrote off tens of millions of euros of food. The EU’s food and agriculture commissioner called the repeated attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” The supplier behind the refrigeration-control software, Danfoss, says the same units were hit in last month’s French wave and this one — this is the second strike in under a month, so the actor holds standing access to the cooling-control layer, not a one-off bug. The practical close: for any operator running networked refrigeration, the exposed controller and its default credentials are the entry, not the app — and if you run the same vendor or firmware, treat this as a live regional campaign, not a one-off. *More via [BBC](https://www.bbc.com/news/articles/cq1kd1nee80eo) · [BBC World (X)](https://x.com/BBCWorld/status/2117216490105561262) · [The Guardian](https://www.theguardian.com/world/2026/nov/02/supermarket-freezers-across-europe-hit-by-second-suspected-cyber-attack) · [Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)* **[Binance Loses $6.43 Billion In A Rigged Interview, AI-Tool Heist — The Biggest Crypto Theft Ever](https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html)** Binance said the record $6.43 billion theft was the product of a “sophisticated, multi-stage campaign,” not a single breach. In June, a Wallet DevOps engineer (“Engineer A”) downloaded a trojanized Homebrew installer while searching for a popular AI tool — Binance rotated credentials, but his role and his contacts on the wallet-infrastructure team were exposed. In September, a second engineer was met through a legitimate job platform: a first round with an “HR representative,” a second round with the “CEO” of a company that doesn’t exist. A tampered AI tool plus an advanced transaction-authorization method did the rest. The FBI ties the trail to North Korea’s TraderTraitor actor; Pyongyang publicly protested the US attribution and launched missiles in response. Roughly $3 billion has reportedly been frozen. The practical close: a “rigged coding assignment” and an AI tool are now a documented entry path — interview and AI-tool screening are an attack surface, not a formality. *More via [The Hacker News](https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html) · [Ars Technica](https://arstechnica.com/security/2026/10/hackers-steal-6-3-billion-from-binance-in-record-crypto-heist/) · [SecurityWeek](https://www.securityweek.com/rigged-coding-assignment-abused-ai-tool-opened-path-to-6-billion-binance-heist/) · [The Hacker News](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html) · [SecurityWeek (North Korea missiles)](https://www.securityweek.com/north-korea-launches-missiles-toward-the-sea-as-pyongyang-protests-against-us-claims-on-binance-hack/)* [**WordPress Core Flaw On CISA’s KEV — Exploited During The Upgrade Window**](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html) CVE-2026-119977 (CVSS 8.1) is a time-of-check/time-of-use race condition in WordPress Core: predictable, web-accessible staging paths used during a full-package core upgrade let an unauthenticated attacker execute code on the server — specifically inside the upgrade window, the one moment most admins assume the box is safest. CISA added it to the Known Exploited Vulnerabilities catalog citing active exploitation. Wordfence logged 18,500+ hits on the staged “setup-config.php” installer paths in the first 21 hours after disclosure and 12,632 attacks in the most recent 24 hours; federal civilian agencies were ordered to patch by 6-Nov. The practical close: if you run WordPress, update Core now — the exposure is the upgrade itself, not a pending plugin, and the window is only open for a few minutes, but it’s open. *More via [The Hacker News](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html) · [The Hacker News](https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html) · [CISA](https://www.cisa.gov/known-exploited-vulnerabilities)* [**Linux Kernel TCP RCE (CVE-2026-98432, CVSS 9.8) — Red Hat Patches, Ubuntu Still Testing**](https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html) An unauthenticated, network-reachable use-after-free in the Linux kernel’s IPv4 TCP stack: the kernel passes IP options from an incoming request to the new socket without copying them, so if a client retransmits while another CPU is still reading those options, the kernel reads freed memory. The trigger is as simple as sending a connection request carrying IPv4 Record Route or Timestamp options to any listening TCP port — no login, no exploit complexity. The bug has been present since Linux 4.4. Red Hat raised its rating from Moderate (5.9) to Critical (9.8) and shipped fixes for RHEL 8/9/10 (RHSA-2026:93412/93413/93414) on 1-Nov; a reboot is required. Ubuntu’s fixes for 22.04/24.04/26.04 remain in the opt-in -proposed testing pocket with no release date. The practical close: a 9.8 unauthenticated RCE living in your kernel TCP stack is exactly the class of bug a self-hoster should treat as urgent — patch the distro you ship, and if you’re on Ubuntu, don’t wait on the proposed channel to ship a stable fix. *More via [The Hacker News](https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html) · [The Hacker News](https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html)* [**Chinese Hackers Run ARTEX AI Against 200 Organizations**](https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/) CrowdStrike attributes this campaign to a Chinese “targeted intrusion adversary” it tracks as Vapor Panda. Since 17-Oct, the ARTEX framework — a Go-based, AI-powered pen-testing tool running DeepSeek plus an unidentified commercial LLM behind a planner-and-worker agent swarm — has been pushed against 200+ distinct organizations: foreign ministries across Latin America, Europe, Asia and the Middle East, plus US defence, semiconductor and think-tank firms, and telecoms in several regions. Post-exploitation is confirmed at nine organizations, where the attacker deployed BLOODALCHEMY (a ShadowPad derivative) and ran credential spraying and lateral movement; at least 12 more saw password-spraying and recon, including WorkOS’s internal sales app. The practical close: this is “LLM as force-multiplier” with concrete numbers — a handful of operators using agent tooling to sweep a wider target set than manual ops support, then closing with stolen domain-admin credentials. If your egress or agent fleet can be reached by a commercial LLM backend, that’s part of the surface now. *More via [BleepingComputer](https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/) · [The Hacker News](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/)* --- ***Elsewhere Online:*** **Syrian Hacker Behind The Fake Tweet That Triggered A $136 Billion Market Drop Gets 42 Months** *Read: * **UEFI Bootkit Infected Fully-Patched Windows Machines — “Is Microsoft To Blame?”** *Read: * **Google Adds A $250,000 Cloud VRP Reward For “Root-In-Cloud” Bugs** *Read: * **Police Seize 100+ Servers In A €4 Million Investment-Fraud Crackdown** *Read: * **Harvard University Data Breach Exposed 851,000 Accounts** *Read: * --- **Previously on #AxisOfEasy** If you missed the previous issues, they can be read online here: - - - [October 30, 2026: #AxisOfEasy 474: Warhound Raises $200M To Engineer War Dogs And Arm Them With Anduril Gear](https://axisofeasy.com/474) - [October 23, 2026: #AxisOfEasy 473: PHP Ships Emergency Security Release For Two Critical RCE Flaws](https://axisofeasy.com/473) - [October 16, 2026: #AxisOfEasy 472: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited](https://axisofeasy.com/472) - [October 9, 2026: #AxisOfEasy 471: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software](https://axisofeasy.com/471) - [October 2, 2026: #AxisOfEasy 470: Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack](https://axisofeasy.com/470)