{"id":3869,"date":"2026-11-03T06:52:06","date_gmt":"2026-11-03T14:52:06","guid":{"rendered":"https:\/\/cyber.mag212.com\/the-forgotten-edge-mag212-cyber-daily-november-3-2026\/"},"modified":"2026-11-03T06:52:06","modified_gmt":"2026-11-03T14:52:06","slug":"the-forgotten-edge-mag212-cyber-daily-november-3-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/the-forgotten-edge-mag212-cyber-daily-november-3-2026\/","title":{"rendered":"The Forgotten Edge\u00a0: Attaques de type Freezer, ransomware Synology, Node-RED et un plugin de paiement inactif\u00a0: MAG212 CYBER Daily, 3 novembre 2026"},"content":{"rendered":"<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_Daily_2026-11-03-1.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Lire l&#039;\u00e9dition compl\u00e8te (PDF, 14 pages, 0,6 Mo) \u2192<\/a><\/div><\/div>\n\n<p class=\"wp-block-paragraph\">Aucun des principaux sujets de ce num\u00e9ro n&#039;a n\u00e9cessit\u00e9 une nouvelle faille zero-day. Des pirates ont r\u00e9gl\u00e9 la temp\u00e9rature des cong\u00e9lateurs de supermarch\u00e9s \u00e0 50 \u00b0C via des syst\u00e8mes de supervision de r\u00e9frig\u00e9ration accessibles par Internet, crypt\u00e9 des NAS Synology en fin de vie, sond\u00e9 des passerelles Node-RED ouvertes et cibl\u00e9 un plugin de paiement retir\u00e9 de WordPress.org en ao\u00fbt. Ce num\u00e9ro traite chacun de ces incidents. <strong>faits v\u00e9rifi\u00e9s<\/strong>, <strong>diagrammes de cha\u00eene d&#039;attaque<\/strong>, <strong>visites guid\u00e9es de l&#039;interface<\/strong> et <strong>panneaux de commande<\/strong> Vous pouvez vous adapter, ainsi qu&#039;aux vols de cryptomonnaies du week-end et aux autres failles critiques de la semaine.<\/p>\n\n<h2 class=\"wp-block-heading\">Qu&#039;est-ce qui requiert notre attention aujourd&#039;hui ?<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Histoire<\/th><th>IDENTIFIANT<\/th><th>Exploit\u00e9<\/th><th>Action<\/th><\/tr><\/thead><tbody><tr><td>Attaques contre les cong\u00e9lateurs des supermarch\u00e9s (France, puis Su\u00e8de, Irlande, Belgique, Luxembourg, Estonie)<\/td><td>Aucun CVE associ\u00e9\u00a0; CERT-FR ALE-012<\/td><td>Oui, deux vagues (11-12 oct., 1-2 nov.)<\/td><td>D\u00e9connectez les superviseurs Copeland, Danfoss et Dixell d&#039;Internet\u00a0; v\u00e9rifiez les param\u00e8tres de d\u00e9givrage\u00a0; acc\u00e8s uniquement par VPN<\/td><\/tr><tr><td>Ransomware Synology DSM (C3RB3R, selon 360)<\/td><td>SA-24:20 et SA-26:13 (CVE-2026-13639, CVE-2026-13684)<\/td><td>Oui (Synology, 29 oct.)<\/td><td>Mettez \u00e0 jour vers la version SA-26:13 ou ult\u00e9rieure, fermez les redirections 5000\/5001 et conservez une sauvegarde hors ligne.<\/td><\/tr><tr><td>Passerelle de paiement crypto WordPress<\/td><td>CVE-2026-81648, CVSS 10.0, aucune correction<\/td><td>Tentatives (Cyber d\u00e9samorc\u00e9es)<\/td><td>Supprimez les fichiers du plugin, faites tourner les cl\u00e9s et transf\u00e9rez les fonds vers de nouveaux portefeuilles.<\/td><\/tr><tr><td>Siemens SIMATIC IoT2050 Node-RED<\/td><td>CVE-2026-58115, CVSS 10.0<\/td><td>Impacts de leurres \u00e0 partir du 30 octobre (VulnCheck)<\/td><td>Mettez \u00e0 jour vers la version 4.3.4.1 ou ult\u00e9rieure, activez l&#039;authentification admin et l&#039;audit des flux d&#039;ex\u00e9cution.<\/td><\/tr><tr><td>Hame\u00e7onnage par code d&#039;appareil MadApe<\/td><td>Aucun CVE<\/td><td>Oui (Groupe IB)<\/td><td>Bloquer le flux de code de p\u00e9riph\u00e9rique dans l&#039;acc\u00e8s conditionnel, en mode rapport uniquement en premier<\/td><\/tr><tr><td>G\u00e9n\u00e9rateur d&#039;agents d&#039;IA Langflow<\/td><td>CVE-2026-93680, CVE-2026-110186, CVSS 9.8<\/td><td>Module Metasploit public<\/td><td>Mettez \u00e0 jour vers la version 1.13.0 et d\u00e9connectez-la d&#039;Internet.<\/td><\/tr><tr><td>LXD, MicroCloud et Incus<\/td><td>CVE-2026-112816, CVSS 10.0<\/td><td>Non<\/td><td>Actualisation instantan\u00e9e\u00a0; restreindre l\u2019API HTTPS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Corrig\u00e9 depuis le premier rapport<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>Coop\u00e9rative:<\/strong> Coop a indiqu\u00e9 \u00e0 Aftonbladet que six de ses magasins \u00e9taient concern\u00e9s ; elle n&#039;a pas fait \u00e9tat de \u201c falsification \u201d \u00e0 Reuters.<\/li><li><strong>Synology\u00a0:<\/strong> un deuxi\u00e8me fournisseur lie le ransomware C3RB3R aux failles plus r\u00e9centes SA-26:13, donc les versions SA-24:20 seules ne suffisent pas.<\/li><li><strong>Attaques DDoS sous Linux\u00a0:<\/strong> Le r\u00e9capitulatif hebdomadaire mentionne un seul botnet, Kairos, et non plusieurs.<\/li><li><strong>RISQUE:STATION:<\/strong> CVE-2024-10443 appartient \u00e0 Synology Photos (SA-24:19), et non \u00e0 SA-24:20.<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Dans ce num\u00e9ro<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>01<\/strong> Couverture : Le Bord Oubli\u00e9<\/li><li><strong>02<\/strong> Note de la r\u00e9daction et service de v\u00e9rification<\/li><li><strong>03<\/strong> Deux vagues d&#039;attaques de cong\u00e9lateurs \u00e0 50\u00b0C \u00e0 travers l&#039;Europe<\/li><li><strong>04<\/strong> Manuel de r\u00e9ponse \u00e0 la cha\u00eene du froid<\/li><li><strong>05<\/strong> Synology\u00a0: un avertissement, deux g\u00e9n\u00e9rations de correctifs<\/li><li><strong>06<\/strong> Node-RED\u00a0: la cha\u00eene d\u2019attaque observ\u00e9e et les indicateurs<\/li><li><strong>07<\/strong> Atelier pratique\u00a0: verrouillez l\u2019\u00e9diteur, puis examinez-le.<\/li><li><strong>08<\/strong> WordPress : un plugin de paiement sans solution<\/li><li><strong>09<\/strong> Identit\u00e9 et montre mobile\u00a0: MadApe, Kairos, uCreator<\/li><li><strong>10<\/strong> Le week-end crypto : Binance, Polymarket, Mercado Bitcoin<\/li><li><strong>11<\/strong> Br\u00e8ves techniques\u00a0: D\u00e9mant\u00e8lement de x.cpe, LXD, Langflow, Ivanti, Apple<\/li><li><strong>12<\/strong> Le bureau d&#039;action<\/li><li><strong>13<\/strong> Registre des sources (33 sources li\u00e9es)<\/li><li><strong>14<\/strong> Abonnez-vous et MAG212 Atlas<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Feuilletez l&#039;\u00e9dition<\/h2>\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_Daily_2026-11-03-1.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<p class=\"wp-block-paragraph\"><em>M\u00e9thodologie de notre rapport\u00a0: les sources ont \u00e9t\u00e9 v\u00e9rifi\u00e9es le 3\u00a0novembre\u00a02026 et sont r\u00e9f\u00e9renc\u00e9es en page\u00a013. Les faits relatifs \u00e0 l\u2019incident proviennent des avis des fournisseurs et des CERT, ainsi que des rapports cit\u00e9s\u00a0; les s\u00e9quences de r\u00e9ponse et les listes de contr\u00f4le sont issues des recommandations de s\u00e9curit\u00e9 MAG212. Les panneaux d\u2019interface sont des reconstitutions simplifi\u00e9es, la couverture est une illustration conceptuelle et les panneaux de commande marqu\u00e9s \u00ab\u00a0ILLUSTRATIF\u00a0\u00bb doivent \u00eatre test\u00e9s sur les syst\u00e8mes que vous \u00eates autoris\u00e9 \u00e0 g\u00e9rer.<\/em><\/p>\n\n<h2 class=\"wp-block-heading\">Articles connexes sur MAG212 CYBER<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/verify-what-is-deployed-ivanti-a-poisoned-extension-ad-cs-sysgorat-mag212-cyber-technical-edition-2-november-2026\/\">V\u00e9rification des moyens d\u00e9ploy\u00e9s : MAG212 CYBER \u00c9dition technique, 2 novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/broken-trust-mag212-cyber-november-1-2026\/\">Confiance bris\u00e9e : MAG212 CYBER Daily Edition, 1er novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/magazine-library\/\">Chaque num\u00e9ro de la biblioth\u00e8que de magazines<\/a><\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>Les attaquants ont exploit\u00e9 des \u00e9quipements que personne ne surveille\u00a0: attaques par cong\u00e9lation \u00e0 50\u00a0\u00b0C \u00e0 travers l\u2019Europe, ransomware Synology sur DSM en fin de vie, passerelles Node-RED ouvertes et plugin de paiement WordPress sans correctif, sans oublier le week-end crypto et les failles critiques de cette semaine.<\/p>","protected":false},"author":1,"featured_media":3868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15,14],"tags":[168,127,169,167,130,34,35,153,172,173,77,126,99,145,170,160,151,90,67,164,129,166,131,24,165,171,149,163,36],"class_list":["post-3869","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","category-vulnerabilities","tag-android","tag-binance","tag-botnet","tag-critical-infrastructure","tag-crypto-hack","tag-cve-2026-109618","tag-cve-2026-109619","tag-cve-2026-112816","tag-cve-2026-58115","tag-cve-2026-81648","tag-cybersecurity-magazine","tag-daily-edition","tag-device-code-phishing","tag-ivanti-connect-secure","tag-langflow","tag-linux","tag-lxd","tag-mag212-cyber-magazine","tag-microsoft-365","tag-node-red","tag-north-korea","tag-ot-security","tag-polymarket","tag-ransomware","tag-siemens","tag-spyware","tag-supply-chain","tag-synology","tag-wordpress-security"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3869","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3869"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3869\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3868"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3869"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3869"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3869"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}