Skip to content
Monday, November 2, 2026Nov 2, 2026
Previous issue

Vol. 1, No. 44Composed Nov 3 · 06:27 UTC

SitRep

Cybersecurity, in perspective.

2 elevated4 stories on the wire

Automation amplifies both risk and urgency; attention still decides outcomes.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

Hackers Disrupt European Supermarket Refrigeration

Attackers remotely changed freezer temperatures across 115-plus locations in six countries, causing refrigeration failures and product losses.

Hackers remotely changed freezer temperatures across 115-plus locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia, causing refrigeration failures and product losses. BleepingComputer reports affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu, and Selver. The attack used a vulnerability tied to Sabcobel controllers that had been seen in a prior France incident.

Context

BleepingComputer links the supermarket incident to a vulnerability tied to Sabcobel controllers that had been seen in a prior France incident. It reports refrigeration failures and product losses across 115-plus locations in six countries.

“The report says the attack used a vulnerability tied to Sabcobel controllers that had been seen in a prior France incident.”
From Senecowitz · Analysis

Zeno Khosla

Skeptical perspective

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Botnet Disruption Leaves Infections on Devices

Google and partners disrupted the XCPE botnet and cut access to at least 10 million more compromised devices. BleepingComputer reports that infections remain unless firmware is clean; the disruption does not itself establish that affected devices have been cleaned.

BleepingComputer

The move

One thing to do today

Epictim Draper

  1. Patch Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527, which CISA added to its Known Exploited Vulnerabilities catalog.

On the wire

  • 0critical
  • 2elevated
  • 1moderate
  • 1low
P1Operational Disruption

Hackers Disrupt European Supermarket Refrigeration

More than 115 locations · Six countries

Hackers remotely changed freezer temperatures across 115-plus locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia, causing refrigeration failures and product losses. BleepingComputer reports that the attack used a vulnerability tied to Sabcobel controllers that had been seen in a prior France incident.

Copy link to “Hackers Disrupt European Supermarket Refrigeration”

P1Patch

CISA Adds Exploited Ivanti Flaws to Its Catalog

Ivanti Connect Secure · CVE-2026-111357 · CVE-2026-118527

CISA added two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after Ivanti issued patches. The flaws, chained with CVE-2026-104935, enabled footholds via missing authentication, predictable identifiers, and remote file upload leading to remote code execution. Volexity linked the attack to UTA0576; attackers reportedly stole AD credentials and LAPS/BitLocker keys.

Updated Since Oct 31: Ivanti Connect Secure Enables Unauthenticated Root · CVE-2026-111357, CVE-2026-118527, CVE-2026-104935 · New: bleepingcomputer.com, securityweek.com, helpnetsecurity.com

Added to CISA KEV: CVE-2026-104935 on 13 Oct 2026; CVE-2026-111357 on 30 Oct 2026; CVE-2026-118527 on 30 Oct 2026 · CVE-2026-111357: CVSS 7.0, EPSS <0.01 (FIRST); CVE-2026-104935: EPSS 0.87 (FIRST)

Copy link to “CISA Adds Exploited Ivanti Flaws to Its Catalog”

P2Botnet

Google Disrupts XCPE Android Botnet

Over 1.3 million Android TV boxes infected · Disruption cut access to at least 10 million more compromised devices

Google and partners dismantled the XCPE Android malware botnet, linked to Videostrong Technology Co., which infected over 1.3 million Android TV boxes. The backdoor enabled ad fraud, residential proxies, and additional malware via modules and an MQTT-backed command-and-control system. The disruption cut access to at least 10 million more compromised devices. Google revoked Videostrong’s license and access to certified Android devices; infections remain unless firmware is clean.

Copy link to “Google Disrupts XCPE Android Botnet”

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 22 daily editions from 5 Oct to 1 Nov averaged 3.7. 7 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
2 Nov (this edition)0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Multipath TCP: Use and Detection

Multipath TCP use and detection explains MPTCP, enabling a single connection to switch between IP addresses (v0 and v1) to suit mobile handoffs. It covers MPTCP options MP_CAPABLE, MP_JOIN, DSS, ADD_ADDR/REMOVE_ADDR, and how to detect MPTCP via TCP Option 30 with tools like Wireshark, Suricata, Zeek.

Chainalysis Discloses Data Breach From AI-Driven Cyberattack Incident

Chainalysis reports an AI-driven cyberattack with attackers using offensive agentic techniques to access systems and internal tools. Some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, were accessed. The breach is not tied to the Binance heist. Number of affected individuals not disclosed.

FBI Flags TraderTraitor Addresses in Binance Heist

The FBI formally attributed the Binance hack to North Korea's TraderTraitor, pegged at about $6.3 billion. The alert lists 608 Ethereum addresses, 19 Bitcoin addresses, and 1 Solana address linked to the theft. Investigators urge industry actors to refuse transactions from these addresses as laundering proceeds continue.

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI

Threat researchers identify VOLTA-AUTODOXER, a Windows infostealer that harvests credentials, tokens, wallets, and more, ranking victims by monetization value using an AI chain via OpenRouter. It collects data from browsers, Slack, Outlook, and Gmail receipts, then generates a monetized dossier with a ‘WHAT THEY’RE WORTH’ section. Exfiltration occurs in three stages over Telegram.

Microsoft Windows Cloud Files Mini Filter Driver Type Confusion Vulnerability

Talos identifies CVE-2026-80093, a type confusion flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affecting specific WinBuild versions. An attacker can exploit via a crafted Cloud Filter API sequence to trigger a kernel crash and potential write primitive. Exploitation involves CfAbortOperation and hydration/abort flows, with CVSS v3.1 score 8.8.

BITTER APT Delivers PapRAT via Fake Diplomatic Documents

BITTER APT, active since at least 2013, targets South Asian government, energy, and engineering sectors. FortiGuard Labs links three infection chains delivering PapRAT to Windows. Chain one uses diplomatic-themed LNK shortcuts with ftp.exe, curl, PowerShell, and scheduled tasks exfiltrating to abc.pdf. Chain two mounts a VHDX and launches Visa_Details.msi.

End of the Monday, November 2, 2026 edition.

Colophon

SitRep · Vol. 1, No. 44

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.