The Forgotten Edge: Freezer Attacks, Synology Ransomware, Node-RED & a Dead Payment Plugin: MAG212 CYBER Daily, 3 November 2026
None of this issue’s lead stories needed a fresh zero-day. Attackers set supermarket freezers to 50°C through internet-facing refrigeration supervisors, encrypted end-of-life Synology NAS boxes, probed open Node-RED gateways and went after a payment plugin that was pulled from WordPress.org in August. This edition covers each one with verified facts, attack-chain diagrams, interface walk-throughs and command panels you can adapt, plus the weekend’s crypto thefts and the week’s other critical flaws.
What needs attention today
| Story | ID | Exploited | Action |
|---|---|---|---|
| Supermarket freezer attacks (France, then Sweden, Ireland, Belgium, Luxembourg, Estonia) | No CVE tied; CERT-FR ALE-012 | Yes, two waves (11–12 Oct, 1–2 Nov) | Take Copeland, Danfoss and Dixell supervisors off the internet; check defrost settings; VPN-only access |
| Synology DSM ransomware (C3RB3R, per 360) | SA-24:20 and SA-26:13 (CVE-2026-13639, CVE-2026-13684) | Yes (Synology, 29 Oct) | Update to SA-26:13 builds or later, close 5000/5001 forwards, keep an offline backup |
| WordPress CryptoPayment Gateway | CVE-2026-81648, CVSS 10.0, no fix | Attempts (Defused Cyber) | Delete the plugin files, rotate keys and move funds to fresh wallets |
| Siemens SIMATIC IoT2050 Node-RED | CVE-2026-58115, CVSS 10.0 | Decoy hits from 30 Oct (VulnCheck) | Update to V4.3.4.1+, enable adminAuth, audit exec flows |
| MadApe device-code phishing | No CVE | Yes (Group-IB) | Block device code flow in Conditional Access, report-only first |
| Langflow AI agent builder | CVE-2026-93680, CVE-2026-110186, CVSS 9.8 | Public Metasploit module | Upgrade to 1.13.0 and keep it off the internet |
| LXD, MicroCloud and Incus | CVE-2026-112816, CVSS 10.0 | No | Snap refresh; restrict the HTTPS API |
Corrected since early reporting
- Coop: Coop told Aftonbladet six of its stores were affected; it did not tell Reuters about “tampering”.
- Synology: a second vendor ties the C3RB3R ransomware to the newer SA-26:13 flaws, so SA-24:20 builds alone are not enough.
- Linux DDoS: the weekly recap names one botnet, Kairos, not several.
- RISK:STATION: CVE-2024-10443 belongs to Synology Photos (SA-24:19), not SA-24:20.
Inside this issue
- 01 Cover: The Forgotten Edge
- 02 Editor’s brief and the verification desk
- 03 Two waves of 50°C freezer attacks across Europe
- 04 Cold-chain response playbook
- 05 Synology: one warning, two patch generations
- 06 Node-RED: the observed attack chain and indicators
- 07 Hands-on lab: lock the editor, then investigate
- 08 WordPress: a payment plugin with no fix
- 09 Identity and mobile watch: MadApe, Kairos, uCreator
- 10 The crypto weekend: Binance, Polymarket, Mercado Bitcoin
- 11 Tech briefs: x.cpe takedown, LXD, Langflow, Ivanti, Apple
- 12 The action desk
- 13 Source register (33 linked sources)
- 14 Subscribe and MAG212 Atlas
Flip through the edition
How we report: sources were checked on 3 November 2026 and are linked on page 13. Incident facts come from vendor and CERT advisories and the cited reporting; response sequences and checklists are MAG212 defensive guidance. Interface panels are simplified recreations, the cover is a conceptual illustration, and command panels marked ILLUSTRATIVE should be tested on systems you are authorized to manage.