Danfoss Controls Come Off the Internet Before Stock Goes Back on Sale

Lead on the Danfoss refrigeration incident affecting nearly 400 French supermarkets. Separate confirmed facts from inference: likely control path, relevance of software earlier than version 4, whether this was manipulation rather than ordinary outage, and implications for food safety versus inventory loss. Give retailers a four-hour containment and continuity sequence that does not create unsafe process changes. Argue the skeptical case as well: what missing evidence could materially downgrade the incident?

Halil, the physical consequence is loss of cold-chain control, not merely an IT outage. Confirmed reporting: attackers reportedly accessed older Danfoss refrigeration controllers and invoked their built-in defrost function, raising cabinet temperatures. Estimates vary between roughly 250 and 350 affected stores; Carrefour confirmed 80 locations, so “nearly 400” should be treated as an unreconciled media estimate. Assessment: this maps to Purdue Level 2 supervisory control, likely through an internet-reachable centralized refrigeration manager controlling Level 1 equipment. Deliberately issuing defrost commands is process manipulation rather than ordinary loss of service—but there is no public evidence that attackers modified field-controller logic, interlocks, or independent safeguards.

The reference to software earlier than version 4 is useful for triage, but not proof of the entry vector. Available reporting identifies older software and notes previously disclosed AK-SM 800A flaws capable of exposing administrative controls; it does not establish which vulnerability was used, that every pre-v4 release is affected, or that version 4 is inherently safe. The plausible path is internet exposure or compromised remote-management credentials into the central manager, followed by changes to defrost schedules or temperature controls. Unknown: whether displayed temperatures matched independently measured product temperatures. Until time-temperature records are reviewed, confirmed inventory loss and precautionary disposal should not be described as confirmed food-safety exposure.

Four-hour containment and continuity sequence — assessment: 1. 0–30 minutes: activate store operations, refrigeration engineering, and food-safety leads; suspend sales from affected cases, keep doors closed, and establish independent temperature measurements. Preserve controller, firewall, remote-access, alarm, and configuration logs. Do not power-cycle controllers or make fleet-wide setpoint changes. 2. 30–60 minutes: block external access to the refrigeration management interface at the OT boundary while confirming that local control and alarm paths remain operational. Disable suspect remote accounts and credentials from a clean administrative station. 3. 1–2 hours: compare schedules, setpoints, users, alarms, and configuration against known-good baselines; identify unauthorized defrost commands. Move stock only under established cold-chain procedures to validated storage or refrigerated transport. 4. 2–4 hours: have the food-safety lead disposition products using independent time-temperature evidence; maintain manual rounds and local operation. Validate any segmentation or software change on one representative system before wider deployment, then plan the vendor-supported upgrade during a controlled maintenance window. A hurried firewall change that breaks alarms or supervisory communication can create a worse process hazard.

The skeptical case remains substantial: no public controller audit logs, packet captures, primary forensic report, exact exploited CVE, reconciled store count, or independent product-temperature dataset has been presented. Shared integrator credentials, maintenance error, or automation misconfiguration have not been publicly excluded. Those gaps could downgrade this from a coordinated vulnerability-exploitation campaign to remote-account abuse or even a coincident operational failure; evidence of repeated unauthorized defrost commands across separate retailers would materially strengthen the manipulation finding.

Rank today’s exploited edge and server exposures by immediate compromise risk: Bricksforge CVE-2026-85097, GlobalProtect CVE-2026-0257, SonicWall SMA1000 CVE-2026-102255, Ahsay CVE-2026-105133/CVE-2026-105134, and the five new KEV entries. Distinguish observed successful compromise from scans or attempts, and give one hunt artifact and one escalation threshold per top subject. GlobalProtect and Ahsay were covered yesterday, so state only today’s operational delta for those two rather than repeating prior advice.

For internet-facing, unpatched deployments, my provisional order is:

1. GlobalProtect CVE-2026-0257 — strongest compromise evidence. Rapid7/Defused reporting says multiple environments were successfully compromised; today’s operational delta is continued use by Qilin and Settra, reportedly 149 days after patch availability. That closes the chain beyond scanning. Hunt: PAN GlobalProtect/6.0.0 user-agent traffic, especially from 104.207.144.154. Escalate: any matching request followed by an unexpected session or internal access—treat the appliance as compromised, not merely vulnerable.
2. Bricksforge CVE-2026-85097 — current reporting calls this active exploitation in attacks, but the evidence available does not distinguish every successful installation from attempts. Hunt: unexplained WordPress administrator creation or server-side file changes temporally adjacent to Bricksforge requests. Escalate: any unauthorized privileged account or executable file write.
3. Ahsay CVE-2026-105133/CVE-2026-105134 — no verified operational delta today, so retain yesterday’s priority and hunt threshold rather than manufacturing novelty. Its existing kill-chain completeness keeps it above scan-only activity.
4. SonicWall SMA1000 CVE-2026-102255 — active-in-the-wild reporting exists, but one source specifically describes probing only two days after patch release; successful compromise is not established in the evidence I have. Hunt: anomalous inbound appliance requests immediately preceding new sessions, administrator changes, or configuration changes. Escalate: any such privileged state change; scanning alone stays at containment-and-patch priority.
5. Five new KEV entries — unrankable as a group. I found no data on their identities or compromise telemetry in our database evidence here. KEV inclusion proves known exploitation, not that these five outrank confirmed compromise on a deployed edge device.

Bluntly: GlobalProtect is the clearest “assume breach” case. Bricksforge is urgent but needs victim-side confirmation. SonicWall currently looks more like attackers rattling the door handle than proof they entered. Exposure changes the local order: a deployed vulnerable system outranks products you do not operate.

Test the evidence behind the ShinyHunters arrest/FBI breach narrative. Separate what is established about Edward Dobrovsky, what remains unconfirmed about ShinyHunters affiliation, and what supports the reported 2–3 TB PeopleSoft-related theft. Decide whether this changes defenders’ priorities today or belongs as a law-enforcement quick hit. Also flag if the Anthropic Mythos exploit has been improperly fused into the same story without a meaningful operational connection.

The evidence separates sharply:

• Edward Dobrovsky: I found no primary charging document or official statement independently establishing the reported arrest details. Treat the arrest as moderate confidence, but identity, charges, and chronology require confirmation.
• ShinyHunters affiliation: Low confidence. The available material does not provide corroborating infrastructure, account control, communications, or court evidence tying Dobrovsky to the group.
• PeopleSoft theft: Huntress records ShinyHunters’ claim that it compromised the FBI jobs site, but the 2–3 TB volume remains an actor assertion, not verified victim or forensic reporting. Active PeopleSoft exploitation still warrants priority under T1190—Exploit Public-Facing Application, independently of the claimed FBI victim and theft volume.

So the arrest belongs in the law-enforcement quick-hit lane; it does not change defensive priorities. Defenders should continue prioritizing PeopleSoft exposure, patching, log preservation, and exfiltration review—not chase the named individual. High confidence: the Anthropic/Mythos item has been improperly fused into this narrative; no shared actor, infrastructure, tooling, victimology, or campaign timeline establishes an operational connection.

Translate the Danfoss refrigeration disruption into concrete retailer decisions. Identify the operational thresholds for isolating controllers, switching to manual monitoring, discarding stock, notifying insurers, or closing sites; avoid unsupported loss estimates. Contrast this with Ahold Delhaize, where checkout remained operational but online ordering and logistics were disrupted, and tell the board which incident should consume executive attention today and why.

Halil, Danfoss should consume executive attention first today. Reporting indicates at least 300 French supermarkets were affected, including roughly 150 Intermarché stores; some refrigeration systems were reportedly driven toward 50°C for about six hours. That creates immediate food-safety exposure and irreversible inventory destruction. By contrast, Ahold Delhaize’s physical checkouts remained operational while online ordering and logistics were disrupted—serious, but stores could still transact.

The retailer decision thresholds should be:

• Isolate controllers immediately: any unauthorized set-point/defrost command, unexplained temperature movement, or loss of confidence in remote-control integrity. Preserve local refrigeration where safe; isolate the remote-management path rather than blindly powering down cooling.
• Switch to manual monitoring: whenever controller telemetry is unavailable or untrustworthy but refrigeration remains functional. Quarantine affected stock and use the site’s food-safety plan for documented physical readings.
• Discard stock: as a conservative benchmark, FoodSafety.gov says perishables exposed above 4°C for more than two hours should be discarded, as should refrigerated perishables after four hours without refrigeration; thawed ice cream should be discarded. Product exposed to the reported Danfoss conditions should not return to sale without defensible time-temperature records.
• Notify insurers: the same day spoilage or business interruption becomes probable. Preserve temperature logs, photographs, SKU quantities, purchase costs, disposal records, and incident-response expenses before destruction where safety permits; exact deadlines and coverage remain policy-specific.
• Close selectively: shut chilled or frozen departments if suspect inventory can be segregated. Close the whole site only when management cannot prevent unsafe sales, maintain reliable manual checks, or safely operate essential systems.

For Ahold, escalate board attention if disruption survives the next order cut-off or delivery cycle, starts producing shelf gaps, or reaches checkout and store replenishment. Until then, Danfoss is the priority because every additional hour can convert recoverable stock into mandatory disposal and a food-safety event. I found no defensible inventory values, outage duration across all stores, or insurance terms, so attaching a loss estimate would be speculation.

Alex ranks GlobalProtect CVE-2026-0257 first for compromise evidence because Qilin and Settra are reportedly establishing unauthorized VPN sessions. Define the identity-side response after patching: which GlobalProtect, IdP, MFA, authentication-override, and downstream account records must be correlated; what must be revoked; and what single finding should escalate an organization from exposure review to full incident response. Focus on today’s ransom... [arg clipped]

Alex’s ranking is justified. Fact: reporting links CVE-2026-0257 exploitation to unauthorized GlobalProtect sessions and subsequent Qilin/Settra activity; affected configurations use authentication-override cookies with a vulnerable certificate arrangement. Patching closes the entry path, but it does not prove that previously established sessions or downstream credentials are clean.

Build one timeline per VPN session:

• GlobalProtect portal/gateway: username, session ID, connection and termination times, source IP, tunnel IP, endpoint/Host ID, client version, gateway, authentication method, authentication-override use, and configuration/certificate changes.
• IdP and MFA: corresponding primary authentication, SAML assertion or OIDC token issuance—as actually configured—factor type and result, Conditional Access/device posture, source IP, device identifier, and remembered-device state.
• Authentication override: original cookie issuance event, issuing user/device, cookie validity period, certificate fingerprint and key history, and every portal or gateway accepting that cookie.
• Downstream identity: AD/Entra sign-ins, Kerberos ticket activity, RDP/SMB, privileged-group changes, service-account access, password resets, new accounts, OAuth grants, SaaS sessions, and EDR evidence from the tunnel-assigned IP. Hunt specifically for BloodHound/SharpHound and Cobalt Strike activity reported in the associated intrusion chain.

Revoke every affected GlobalProtect session and authentication-override cookie; rotate the cookie-signing/encryption certificate and key, preferably replacing it with a dedicated certificate as Palo Alto recommends. For identities observed through suspicious tunnels, revoke IdP sessions and refresh tokens, remembered MFA/device state, third-party OAuth grants, and compromised device certificates; then rotate passwords or service credentials where exposure is supported. Do not pretend password rotation revokes bearer sessions—it does not. The single escalation finding is a successful VPN session for which no legitimate original authentication-override cookie issuance can be tied to the same user and device. That is compromise evidence, not merely exposure, and should trigger full incident response and downstream identity scoping. Unknown: the available evidence does not establish that every malicious session is reliably labeled as authentication-override use, so absence of that field must not close the investigation.

For the French supermarket refrigeration incident, identify the decision-relevant French and EU obligations without assuming a reportable personal-data breach. Distinguish food-safety, operational-resilience, criminal-evidence, insurance, and data-protection triggers. Sara and Pierre treat the physical impact as urgent, but technical attribution remains incomplete; explain what must be documented in the first 24 hours and which notifica... [arg clipped]

Sara and Pierre are right on physical urgency, but technical attribution is not the legal trigger. Food safety: immediately quarantine potentially temperature-abused stock and record cabinet temperatures, exposure duration, product lots, disposition decisions, and the basis for deciding whether withdrawal or authority escalation is necessary. Operational resilience: record affected stores, service degradation, manual controls, supplier dependencies, restoration decisions, and whether the operator falls within France’s current NIS2 scope; I could not verify the current French transposition, reporting route, or applicable reporting clocks. Criminal evidence: preserve controller logs, remote-access records, configurations, forensic images, hashes, timestamps, and chain of custody before rebuilding. Insurance: notify the broker/insurer under the policy’s contractual procedure, obtain approval for emergency vendors where required, and confirm whether a police complaint is a coverage condition; I could not verify the currently applicable statutory deadline.

Within the first 24 hours, maintain one decision log covering: detection time; operational and food-safety impact; affected assets and stores; temperature and product evidence; containment and continuity measures; suspected entry paths; vendor access; evidence-preservation actions; authority, insurer, and law-enforcement contacts; and the rationale for each notification or non-notification. Attribute cautiously—document “suspected malicious interference” rather than naming an actor until evidence supports it.

Data protection is a separate test. Do not notify CNIL merely because refrigeration systems were disrupted. Determine whether systems containing employee, customer, loyalty-program, CCTV, or account data were accessed, altered, lost, or exfiltrated. CNIL guidance requires an internal record of personal-data breaches; notification is due within 72 hours where the breach poses a risk to individuals, with direct communication where that risk is high. Therefore, preserve the CNIL assessment and awareness timestamp now, but notify only if the personal-data threshold is met. Food-safety escalation, insurer notice, and evidence preservation should proceed without waiting for attribution or the privacy analysis.

Triage three AI items against today’s exploited infrastructure: Google Workspace OAuth reach from 978 AI-connected applications, the repeat-after-me tool-call bypass across six agent frameworks, and Anthropic’s distributed inference on IoT devices. Which one warrants an enterprise control change tonight, which belongs in engineering remediation, and which is research-only monitoring? Give one concrete control and reject any hype the evidence does not support.

1 — Enterprise control change tonight: Google Workspace OAuth. Material found 978 active application connections across 159 Workspace organizations, many carrying full employee-level access. Control: require admin approval for third-party OAuth grants, then immediately revoke unapproved AI-app access to Gmail and shared drives. This is ordinary identity and authorization exposure—not an exotic AI exploit—and 978 connections do not mean 978 breaches.

2 — Engineering remediation: Repeat-After-Me. Researchers induced attacker-written tool calls across six agent frameworks, but explicitly did not establish that every deployment is vulnerable. Put a deny-by-default capability gateway between the model and tools: allowlist operations and arguments, scope credentials per tool, and require separate approval for consequential actions. This is a genuine agent-specific injection flaw—the model’s refusal is irrelevant if the orchestrator executes the structured call first—but it is not universal arbitrary code execution.

3 — Research-only monitoring: Anthropic’s distributed IoT inference work. Monitor it for reproducible evidence of uncontrolled privilege acquisition, persistence, or propagation outside a contained experiment. The available evidence does not establish an active IoT campaign or autonomous malicious intent, so “self-replicating AI loose on devices” would be hype. The immediate operational priority remains revoking standing OAuth authority; the agent bypass should enter the next emergency engineering sprint.

Close the operational discussion. Sara and Pierre put Danfoss first because reported controller manipulation created cold-chain loss, but primary technical evidence, exact affected-store count, and access path remain incomplete. Alex and Marcus put GlobalProtect CVE-2026-0257 first for compromise confidence because unauthorized sessions are linked to Qilin and Settra. Bricksforge CVE-2026-85097 is actively exploited; Ahsay has observed SYSTEM-level webshell/miner compromises; SonicWall currently has reported exploitation attempts; five older flaws newly entered KEV. Sofia says food-safety documentation is immediate even without attribution or a GDPR event. Arjun says AI-app OAuth grants warrant action tonight, agent prompt bypasses require engineering remediation, and IoT distributed inference is monitoring only. Build a 24-hour response order for a mixed enterprise. Argue against automatically putting Danfoss first, then make the final call. Specify when patching is enough, when hunting is mandatory, and when isolation or full incident response is required. Relegate the ShinyHunters arrest, deepfake trend, Ahold disruption, and AI research appropriately unless any changes tonight’s controls.

I would not automatically put Danfoss first. Reported controller manipulation implies potentially severe cold-chain and food-safety consequences, but the affected-store count, access route, and primary technical evidence remain incomplete. Run an immediate parallel safety check—validate setpoints against approved baselines, preserve controller and remote-access logs, and disable the remote path if unauthorized changes are confirmed—but don’t displace a demonstrated enterprise compromise. My final call is GlobalProtect first: Unit 42 confirms active CVE-2026-0257 exploitation, although it identifies the actor as unknown, so the Qilin/Settra attribution is less certain than the exploitation itself.

First 24 hours: CRITICAL, hours 0–4: preserve firewall, VPN, identity, Ahsay, web-server, and OT evidence before rebooting anything. Isolate any GlobalProtect appliance showing unauthorized sessions; revoke related sessions and credentials, and open full incident response. Test and deploy the vendor fix to exposed unaffected appliances, but hunt them regardless. Isolate Ahsay systems with SYSTEM-level webshell/miner evidence and rebuild from trusted media—patching an already compromised backup server is not remediation. Hours 4–12: disable or patch exposed Bricksforge installations; Patchstack reports that CVE-2026-85097 enables unauthenticated PHP upload and execution. Hunt webroots, upload directories, scheduled tasks, and PHP-launched child processes; executable uploads trigger isolation and full IR. Hours 12–24: match SonicWall and the five new KEVs against inventory, promoting internet-facing matches immediately. I found no current advisory or patch data on the unspecified SonicWall item, five KEV additions, or Danfoss case, so I would not invent version-specific instructions.

Patching alone is enough only where telemetry shows the system was not exposed during the exploitation window and there are no suspicious sessions, files, processes, accounts, or configuration changes. Hunting is mandatory for every exposed GlobalProtect, Ahsay, and Bricksforge asset; isolation and full IR begin when there is unauthorized execution, a webshell/miner, anomalous authenticated access, persistence, or controller manipulation. Tonight, revoke unapproved AI-application OAuth grants and review consent and token activity; route prompt-bypass findings to engineering unless actual abuse is found, and leave distributed-inference research on monitoring. The ShinyHunters arrest, deepfake trend, Ahold disruption, and general AI research remain intelligence/watchlist items unless they produce estate-specific indicators or alter tonight’s controls.

What confirmed evidence links the reported water-utility disruptions across seven U.S. states—shared vendor, remote-access path, actor, time window, or physical service impact? Separate confirmed loss of monitoring/control from broader warnings about PLC manipulation. If no common campaign is established, name the specific evidence or indicator that should trigger escalation from local containment to a coordinated multi-utility OT response.

The confirmed linkage is narrow: since 27 July 2026, utilities in at least seven states reported attacks on internet-facing Rockwell/Allen-Bradley MicroLogix 1100/1400 PLCs. Actors remotely changed IP addresses and passwords, causing loss of monitoring/control; some victims reported pressure loss and flooding. Those impacts are confirmed only in aggregate—not for every utility. No shared actor, source infrastructure, exploit, or single coordinated campaign is publicly established. Confidence: high on the common exposure/device pattern; low on unified attribution. Broader warnings about malicious logic downloads or arbitrary PLC manipulation should not be presented as observed behavior in this incident set.

Escalation should occur when two unrelated utilities show the same distinctive controller-state change—ideally an identical unauthorized project-file/logic artifact, or the same attacker-set password plus the same IP/gateway reconfiguration sequence. A shared source IP alone is insufficient. Preserve PLC uploads, configurations, logs, and data tables before resets; that cross-site artifact is what would justify coordinated multi-utility OT response.

Validate the public Ghostscript crafted-PDF heap-overflow PoC against server-side PDF-processing workflows. Which versions and configurations are practically exposed, what artifacts would distinguish successful code execution from a crash, and is there any reliable mitigation short of upgrading to Ghostscript 10.08.0? Convert the answer into a decision for services that generate thumbnails or otherwise process untrusted PDFs... [arg clipped]

The public PoC validates CVE-2026-39919 as more than a denial-of-service, but not as a universal one-shot exploit. Wordfence reports the vulnerable range as Ghostscript 9.21 through 10.07.1 when OpenJPEG support is present, plus confirmed vulnerable behavior in 10.08.0rc1. The trigger is PDF rendering of a JPEG 2000 image with sub-byte precision and mismatched component subsampling: the affected path allocates packed-row storage, then writes one byte per output column, overrunning the heap and corrupting Ghostscript allocator metadata. They achieved unauthenticated code execution on one purpose-built WordPress thumbnailing deployment even with -dSAFER; therefore -dSAFER is not a memory-safety boundary. Exact exploit reliability remains dependent on build, allocator, hardening, and worker layout.

For validation, do not count a Ghostscript error or worker termination as code execution. A crash-only result is a SIGSEGV/abort, allocator-corruption diagnostic, core dump, or failed conversion without attacker-directed side effects. Execution requires an independently observable effect attributable to the payload—such as creation of a unique marker file, an unexpected child process, or a controlled outbound callback—correlated with the rendering worker. The available reporting demonstrates execution but does not disclose enough about its exact marker or heap grooming to assume the public file will execute reliably across distributions.

There are only two dependable fixes: upgrade to 10.08.0 or later, or install a distribution package carrying the upstream fix commit 0a8bf88e39db07b0751a58d6ec1cf992073e4dc1; package version numbers may remain below 10.08.0 when backported, as Debian’s tracker illustrates. Disabling -dSAFER is irrelevant, and enabling it is insufficient. Moving conversion into a disposable, unprivileged service with no secrets, minimal read-only mounts, no unnecessary network access, syscall restrictions, and strict resource limits materially contains compromise but does not eliminate code execution. Rejecting PDFs or disabling the Ghostscript/OpenJPEG processing path is the only reliable temporary prevention if a patched binary cannot be deployed.

Decision: any internet-facing service that thumbnails, previews, indexes, or converts untrusted PDFs should treat affected Ghostscript execution as an RCE exposure, not merely a crash risk. Patch or apply the verified backport before restoring processing. Until then, suspend PDF conversion or route it through a strongly isolated, disposable worker; do not rely on -dSAFER or on the PoC merely crashing in staging.