Skip to content
Monday, November 9, 2026Nov 9, 2026
Previous issue

Vol. 1, No. 52Composed Nov 9 · 20:52 UTC

SitRep

Cybersecurity, in perspective.

5 elevated5 stories on the wire

Power without attention turns intent into accident.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

France Blames Iranian Unit for Store Attacks

France attributes refrigeration attacks to an Iranian unit; reports cite food losses, fires, and a November wave across six European countries.

4 sources

BleepingComputer, Cisco PSIRT Security Advisories, CERT/CC Vulnerability Notes, Help Net Security

France blames the Iranian Shahid Kaveh IRGC unit for October attacks that disrupted defrost settings in food-preserving refrigeration systems. Approximately 700 retail locations were targeted, causing food losses and at least 15 fires; a second wave in November affected more than 115 stores across six European countries.

Context

The reported attacks disrupted defrost settings in refrigeration systems preserving food. Affected stores included Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché; the November wave affected stores across six European countries.

The move

4 things to do today

Epictim Draper

  1. Upgrade Cisco Meraki devices to fixed releases; Cisco lists no workarounds.
  2. Apply FrodoBots EarthRover Mini+ firmware updates and network hardening.
  3. Install SonicWall firmware 7.3.4-7013+ or 8.2.3-8015 where applicable; Gen6 devices are end-of-support.
  4. Upgrade PrestaShop to 9.2.1 or later; restrict admin access and file write permissions.

Also drawn on PrestaShop Debug Mode PHP Code Injection Vulnerability (CERT/CC Vulnerability Notes)

On the wire

  • 0critical
  • 5elevated
  • 0moderate
  • 0low
P1Physical Attack

France Attributes Refrigeration Attacks to Iranian Unit

About 700 locations targeted · At least 15 fires · November wave: more than 115 stores across six countries

France blames the Iranian Shahid Kaveh IRGC unit for October attacks that disrupted defrost settings in food-preserving refrigeration systems.1 Approximately 700 retail locations were targeted, causing food losses and at least 15 fires; a second wave in November affected more than 115 stores across six European countries.1

  1. 1BLEEPINGCOMPUTER · France Blames Iranian Hackers for Refrigeration Attacks

Copy link to “France Attributes Refrigeration Attacks to Iranian Unit”

P1Patch

Cisco Releases Meraki Security Hardening Updates

Five CVEs · No workarounds listed

Cisco says its October 2026 security hardening release addresses multiple internal vulnerabilities across several Meraki devices.1 The advisory lists CVE-2026-76463, CVE-2026-76464, CVE-2026-76467, CVE-2026-76468, and CVE-2026-76469, and says there are no workarounds.1

CVE-2026-76463: EPSS <0.01 (FIRST); CVE-2026-76464: EPSS <0.01 (FIRST) and 3 more

  1. 1CISCO PSIRT SECURITY ADVISORIES · Cisco Meraki Security Hardening Release: October 2026

Copy link to “Cisco Releases Meraki Security Hardening Updates”

P1Firmware

Cert/cc Reports FrodoBots Firmware Vulnerabilities

Six vulnerabilities · EarthRover Mini+

CERT/CC reports six vulnerabilities in FrodoBots EarthRover Mini+ firmware, enabling remote code execution, unauthorized sensor access, data exposure, and full device compromise.1 CERT/CC says remediation includes firmware updates and network hardening; some issues are mitigated, while others await subsequent vendor updates.1

  1. 1CERT/CC VULNERABILITY NOTES · FrodoBots EarthRover Mini+ Firmware Faces Multiple Vulnerabilities

Copy link to “Cert/cc Reports FrodoBots Firmware Vulnerabilities”

P1Exploit

Attackers Exploit Sshole on Musl-based Linux Systems

OpenSSH CVE-2026-123158 · First successful exploitation observed Nov. 7

BleepingComputer reports attackers exploited CVE-2026-123158, the SSHole flaw in OpenSSH on musl-based Linux systems, to log in to accounts with password authentication disabled; they may gain root access.1 Exploitation began after a proof of concept on Nov. 5, and the first successful exploitation was observed Nov. 7.1

Updated Since Nov 6: OpenSSH Flaw Allows Oversized Password Logins · CVE-2026-123158 · New: bleepingcomputer.com, cisa.gov, cve.org

Added to CISA KEV on 9 Nov 2026 (CVE-2026-123158) · CVE-2026-123158: CVSS 8.1, EPSS 0.01 (FIRST)

  1. 1BLEEPINGCOMPUTER · SSHole OpenSSH vulnerability exploited to breach Linux systems

Copy link to “Attackers Exploit Sshole on Musl-based Linux Systems”

P1Bypass

SonicWall Flaw Bypasses Saml-enforced MFA

CVE-2026-19868 · Valid credentials required · CISA Known Exploited listing

Help Net Security reports attackers with valid credentials may bypass SAML-enforced MFA on SonicWall SSL-VPN due to CVE-2026-19868.1 SonicWall provided fixed firmware; CISA added the flaw to Known Exploited and set a patch-by date of Nov. 20, 2026.1

Updated Since Nov 7: SonicWall Patches Flaw That Weakens VPN Logins · CVE-2026-19868 · New: helpnetsecurity.com, thehackernews.com

Timeline

  1. Nov 6OpenSSH Flaw Allows Oversized Password Logins
  2. Nov 7SonicWall Patches Flaw That Weakens VPN Logins
  3. This edition

Added to CISA KEV: CVE-2026-19868 on 6 Nov 2026; CVE-2026-123158 on 9 Nov 2026 · CVE-2026-19868: CVSS 7.5, EPSS <0.01 (FIRST); CVE-2024-12802: EPSS <0.01 (FIRST) and 1 more

  1. 1HELP NET SECURITY · Exploited SonicWall SSL-VPN Flaw Bypasses SAML MFA (CVE-2026-19868)

Copy link to “SonicWall Flaw Bypasses Saml-enforced MFA”

Known exploited

Added 9 Nov4 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-102895GPUStack GPUStack9 Nov12 Nov
CVE-2026-116779SignalWire FreeSwitch9 Nov12 Nov
CVE-2026-123158OpenBSD OpenSSH9 Nov12 Nov
CVE-2026-123218IBM Aspera Faspex9 Nov12 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 5 stories rated critical or elevated (P0 or P1); the 24 daily editions from 12 Oct to 8 Nov averaged 3.5. 5 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
9 Nov (this edition)0500
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

U.S. Urges Critical Infrastructure to Secure Refrigeration Systems

U.S. CISA, FBI and partners urge critical infrastructure to rapidly harden industrial refrigeration and cold-chain systems after European attacks on French blood banks and supermarkets. Recommendations include isolating OT, removing or securing remote access, patching vulnerabilities, replacing end-of-life devices, and maintaining offline backups.

3 reports

SEGA Newsletter Breach Exposes 2.2 Million Emails via ARARA

SEGA says 2.2 million newsletter subscribers' email addresses were exposed by third-party ARARA. 92,300 records included additional information. The breach affected 11 SEGA newsletters and SEGA Fave products; no names, DOB, gender, addresses, phones, credit card details, or passwords were exposed. Email addresses tied to SEGA Accounts were not affected.

2 reports

Binance Denies Data Breach After Alleged ShinyHunters Claims

Binance denies a data breach after a ShinyHunters‑style claim that 335 million Binance records were stolen, including KYC data, internal infrastructure details, account passwords, wallet private keys, transaction history, emails, and phone numbers, and they offered $900,000 for the data. Binance says no evidence of compromise and notes data handling differences.

2 reports

Iris Plaza Breach Exposes 7.7 Million Records

Hackers compromised an external cloud service used by Iris Plaza, exposing personal data of about 7.7 million people. Of these, 5.8 million members had names, addresses, phone numbers, emails, dates of birth, gender, and encrypted passwords exposed; 1.9 million non-members had names, addresses, phone numbers, and emails exposed. Card data was not stored by the cloud service.

2 reports

CVE-2026-58613: Windows Cloud Files Mini Filter Driver UAF

Talos reports a use-after-free in the Windows Cloud Files Mini Filter Driver (CldiStreamCompleteRequest) enabling privilege escalation. A crafted Cloud Filter API sequence can trigger the flaw in Windows 10/11 via version 10.0.26100.8457. An orphaned timer-based request leads to UAF when CldiStreamCompleteRequest runs. CVSS 8.8; vendor referenced as vulnerable.

2 reports

New York Settles Over 13.3 Million Medical Data Breach

New York AG Letitia James reached a settlement with Perry Johnson & Associates and four related companies over a 2023 medical data breach affecting more than 13.3 million people, with $300,000 in penalties and up to $9.7 million suspended. The breach stemmed from weak security and slow disclosures. The settlement mandates MFA, encryption, stronger access controls, monitoring, and annual testing.

2 reports

Who Gives a Crap Data Breach Impacts Australia UK US

Who Gives a Crap confirms a data breach via an unnamed US-based marketing software provider affecting customers in Australia, the UK, and the US. The breach exposed first/last names, email addresses, phone numbers, and mailing addresses, plus amounts spent since 2012; payment info, order details, and passwords were not accessible. Incident occurred Oct 30–Nov 1; notified customers by Nov 7.

2 reports

Also reported

End of the Monday, November 9, 2026 edition.

Colophon

SitRep · Vol. 1, No. 52

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.