Attackers remotely switched off or overheated refrigeration in more than 115 supermarkets across six European countries, and Google took down a botnet of 1.3 million Android TV boxes it says the manufacturer backdoored at the factory. Synology warns of ransomware on outdated NAS devices, Microsoft details Teams help desk scams that ended in certificate abuse, and AI shows up in an infostealer that asks commercial models to rank its victims.
Australian focus
- Qantas notifies the ACSC over the Amadeus breach (update). Qantas is checking whether any bookings were affected; it says its own systems were not, and Amadeus reports no evidence payment data was accessed. 7NEWS
- Refrigeration controllers and ASD's October OT alert. Check that refrigeration and cooling controllers are not reachable from the internet. ASD's ACSC alert
Global threats
- Supermarket refrigeration attacked across Europe. More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; controllers shut down, set to defrost or set to +50°C. BleepingComputer
- Google disrupts the XCPE botnet and bans Videostrong. 1.3 million backdoored Android TV boxes; Google estimates at least 10 million more devices cut off from related malware servers; clean firmware or disconnection required. Google Threat Intelligence; BleepingComputer
- C3RB3R ransomware hits outdated Synology DSM. Update DSM, block internet access to the management interface, keep an offline backup. Synology; BleepingComputer; HKCERT
- Teams help desk impersonation leads to AD CS abuse. Quick Assist sessions, then ESC1 template abuse and ESC8 relay for privileged certificates; password resets do not revoke issued certificates. Microsoft Security Blog
- GitLab: more than 1,000 servers still exposed (update). The 21 October releases fix both regex engine flaws; the earlier October fixes cover only one. Self-compiled installs and custom images also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. BleepingComputer; GitLab patch release
- BTCPay Server hot wallets drained on 2.4.1 and earlier. Sweep funds and rebuild on 2.4.7. BTCPay Server; BleepingComputer
- DarkBlinders targets Israel and Iraqi Kurdistan. Iran-linked espionage per a single vendor. Dream Research; The Hacker News
AI security
- VOLTA infostealer asks commercial models to rank victims. The malware's code calls models through OpenRouter and switches provider when one refuses. Cisco Talos; The Hacker News
- CL-UNK-1211 uses suspected AI-generated scripts against government Linux servers. SysGoRAT and PHP auto_prepend_file persistence. Unit 42; The Hacker News
- Critical Langflow flaws fixed only in 1.13.0. Unauthenticated authentication bypass and code execution (CVE-2026-93680, CVE-2026-110186). IBM bulletin; The Hacker News
Industry
- Microsoft quietly fixed a Windows 11 Get Help privilege escalation with no CVE. iTnews
Outlook and patch priorities
- Critical: GitLab 21 October releases; Synology DSM updates; Langflow 1.13.0; refrigeration and building controllers off the internet.
- High: AD CS template and web enrolment audit; external Teams contact; BTCPay Server 2.4.7 rebuild; remove uncertified Android TV boxes.
- Indicators: XCPE command domains anyevonline[.]com and mqtt.szbboys[.]com (Google); SysGoRAT command server 104.194.158[.]65 on port 443 (Unit 42; hardcoded default the operator can change).