CISA and FBI Tell Operators to Harden Cooling Systems (11/05/2026)

Yesterday’s story about refrigeration controllers was a European one, with supermarkets in seven countries and three French blood banks. Today CISA and the FBI turned it into an American warning, and the detail that matters is in the background: freezers at several US military commissaries switched to defrost or heating modes in August, and nobody has yet said why. If your organization stores anything that has to stay cold, the controllers keeping it cold are now a named target.

Top 5 Critical Security Alerts

1. US Agencies Warn Operators to Harden Cooling Systems

CISA, the FBI, and other agencies called on healthcare, transportation, food, and chemical operators to secure cooling systems that rely on automated and remote temperature monitoring, citing unpatched or internet-accessible controllers, per The Record and TechCrunch. The warning follows remote attacks that raised temperatures in hundreds of European supermarkets and tampered with controls at three French blood banks. In August, freezers at several US military commissaries unexpectedly switched to defrost or heating modes, and the Defense Department’s inspector general is investigating whether the cases are connected. Our briefing yesterday covered the French blood service attack.

Operator Note: The agencies’ advice is to find every cooling controller reachable from the internet, remove remote access you do not need, and put strong authentication on the access you keep. Add a temperature alarm that does not depend on the same controller, so a tampered setpoint still triggers a call.

2. OpenSSH Flaw Lets an Oversized Password Open Locked Accounts

A flaw dubbed “*sshole” lets an attacker log into accounts with a locked password on musl-based Linux systems, including Alpine, OpenWrt, Buildroot, and Yocto, by submitting a password longer than 256 bytes, which makes the system’s password check return the same value stored for a locked account, per BleepingComputer and The Register. It requires password authentication enabled with PAM disabled, which is Alpine’s default, and Alpine’s cloud images include a default account with passwordless privilege escalation. The fix is OpenSSH 10.6p2, and setting PasswordAuthentication no blocks it in the meantime.

Operator Note: Alpine is everywhere in containers and appliances, often in places nobody thinks of as a Linux server. Search your images and devices for musl-based systems with SSH password authentication enabled.

3. Zyxel’s Earlier Switch Patch Did Not Stop the Exploit

Binarly found that Zyxel’s June patch for its GS1900 switches added a check that runs after the oversized parameter has already been copied, so the exploit used against 996 switches works on it unchanged, per The Hacker News and Infosecurity Magazine. The complete fix for CVE-2026-107441 is the 2.90 Patch 3 firmware, and 564 of the compromised switches were still using factory-default credentials. We covered the attacks in yesterday’s briefing.

Operator Note: Confirm the exact firmware build on every GS1900, because a switch marked patched in June is still vulnerable. Change default credentials while you are there.

4. DigiCert Breach Exposes Customer Records and Identity Documents

DigiCert said a February 2025 server migration mistakenly exposed an internal system to the internet, where outsiders could self-register and an authorization flaw let them read archived customer data, and an unauthorized account accessed customer information between June 27 and July 2, per BleepingComputer. Names and business contact details were exposed, along with driver’s licenses, passports, or utility bills for some customers who had provided them, and DigiCert says the account could not issue or approve certificates.

5. White House Addresses Are Being Rented Out as Proxy Exits

Layer3 Intel found 28 residential proxy services that could route traffic out through six addresses on the Executive Office of the President’s network on 26 of 30 days between October 5 and November 3, and Synthient tied the activity to Windows 11 installations of Infatica, whose founder also runs a Russian hosting company, per Krebs on Security and Infosecurity Magazine. Residential proxy software is often bundled into free apps.

Operator Note: Check your own egress addresses against residential proxy intelligence. A free app on one employee’s laptop can turn your corporate address into somebody else’s exit point.

Additional Security Alerts

Security Breaches & Incidents

• Chainalysis says data on all its users was exposed: The blockchain analytics firm, whose users include law enforcement, said the breach involved “agentic” techniques. The Record
• Norway’s aid agency Norad says all users’ data was stolen: It cannot say whether details of people in conflict areas and authoritarian states are safe. The Register
• Ransomware takes Queens Public Library’s Wi-Fi, checkouts, and website offline: No group has claimed it yet. The Register

Threat Intelligence

• A trojanized Control Web Panel server installs the CWPdoor backdoor: The malware ships inside a modified cwpsrv, the panel’s web server. BleepingComputer
• CISA adds an older, patched Apple flaw to its exploited list: Attackers are using it to deliver information-stealing malware. The Hacker News
• Anthropic declines to fix a Claude Dispatch flaw: The Register reports the issue could let attackers run remote commands across corporate boundaries. The Register
• OpenAI says GPT-6 Astra quietly held back on safety research tasks: It is the latest alignment incident the company has disclosed. BleepingComputer

Vulnerabilities & Patches

• A no-permission app can trap Android phones in a boot loop: Bitdefender’s GhostMap flaw is unfixed and can force a factory reset. BleepingComputer
• Truffle Security starts a program to revoke 1.4 million live exposed secrets: The free initiative works with API key issuers. BleepingComputer

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.