700 French supermarkets defrosted through a hole documented in 2023, LG TVs rooted by a test certificate, cheap Androids shipping infected, implants in Ledger wallets, and a bug behind an OpenAI TV.
In this edition
Get the next GRC Brief in your inbox.
Subscribe to The GRC Brief700 supermarkets defrosted through a hole documented in 2023.
On the night of 11 October, attackers forced the defrost cycles of refrigeration units in around 700 of France's 10,000 supermarkets, according to the economy minister, pushing some cabinets to 50 degrees for six hours and starting fires. The CERT-FR alert covers the Danfoss AK-SM and AK-SC controllers plus Copeland and Dixell xweb, and says the campaigns are probably still running. Synacktiv reported an authentication bypass on these units to Danfoss in February 2023, and the mitigation published in May 2023 was one line: restrict network access. On the day of the attack, 2,752 Danfoss systems were still exposed online, 1,590 of them in France.
Source: My full analysis · christophemazzola.fr
My take
Three and a half years after the fix was published, 1,590 of these boxes were still reachable from the internet in France alone. Nobody burned a zero-day here. Somebody accepted a risk, through a signature, a deferred budget or a silence, and that decision is what I wrote up this week. A cyber risk is a business risk, and it gets accepted roughly the way you pick the plant in reception: one line in a spreadsheet, no amount, no expiry date, often no name. No supermarket gets to choose its own fire safety level. It applies it, funds it, and has it inspected by a commission that can close the doors. Go and read your own register with that in mind, and see which accepted risks would survive being read out loud.
A valid signature is not permission.
SSD Secure Disclosure published a chain of three webOS flaws that gives an attacker on the same local network root on an LG television, with no PIN and no interaction from the owner. It starts at the pairing service on port 3001: the attacker replays a signed manifest shipped inside a built-in demo app, which hands over a privileged key. A second app is then pointed at an attacker-controlled page that keeps access to PalmServiceBridge, the internal link to system services. From there, a logging daemon running as root fails to sanitise a path and the injected command runs as root. Tested on two models. LG has issued a fix.
Source: SSD Secure Disclosure · LG webOS sync-demo preauth RCE, 12 Oct 2026
My take
Each step trusted the one before it. The manifest carried a valid signature, so the pairing service accepted it, and nobody asked whether a demo app's signature should be worth a privileged key. The app was legitimate, so nobody checked where it navigated. The daemon trusted its input. A valid signature is not permission, and I have now written some version of that sentence three times this quarter, about an MFA token and a payment signing process. Meanwhile the television in your boardroom runs applications, exposes services that take commands from other devices, and appears in nobody's asset register.
The phone was compromised before anyone switched it on.
Bitdefender found malware baked into the firmware of low-cost Android phones built on MediaTek platforms. The core is a platform-signed system app, so Android treats it as trusted, and it cannot be uninstalled. It activates at first boot, grants itself permissions, installs and removes applications silently, pulls down remote code, runs ad fraud, and turns the handset into a residential proxy. Thousands of devices across more than 150 countries, led by Mexico, France and Italy. Affected models include Doogee and Cubot handsets plus counterfeits borrowing Samsung and Apple names. No vendor fix has been announced.
Source: Bitdefender Labs · Midnight Mimosa, 8 Oct 2026
My take
Every mobile security model you have assumes the operating system is the trust anchor and the threat arrives as an app. Here it shipped under the platform signature, so Android's own defences file it as trusted, and there is no remediation. You do not clean it, you bin the phone. For an organisation this is not the BYOD conversation you have been having. It is the sixty-euro handset a contractor bought on a marketplace, relaying traffic through your network and reading notifications off the screen. Bitdefender is blunt that the durable fix belongs to the vendors and the marketplaces, which is another way of saying it is not coming.
Somebody fitted a cellular modem inside a hardware wallet.
Ledger confirmed an unauthorised hardware implant in devices sold through a Southeast Asian reseller. Researchers taking the units apart found the attacker had swapped the original battery for a smaller one to make room, then fitted a microcontroller, a two-millimetre eSIM and a shielded LTE module that reads the screen and the button presses and sends the recovery phrase out over the mobile network. The hardware researcher Joe Grand bought eight wallets from sellers in Thailand and found four of them compromised. Blockchain analysts put the losses at around 102 million dollars across 315 accounts. Ledger's own genuine check cannot detect an added implant while the original secure element is intact.
Source: Zetter Zero Day · K. Zetter, with Tibane Labs teardown
My take
The manufacturer was not breached. Its systems were never touched. Somebody inserted themselves between the factory and the buyer, and the authenticity check the vendor provides was blind to that by design. Grand has been pulling hardware apart for decades and says he had never seen one of these in the wild before. He has now found four in eight. Take the crypto out of it and the question gets uncomfortable fast: what proportion of your hardware arrives through a reseller you have never assessed, and what would you actually inspect on arrival? Tamper-evident packaging is not an answer when the implant sits under the battery.
The one implant that got found, because somebody swept the room.
The US Justice Department charged an OpenAI employee with using a device to intercept oral communications. Prosecutors say he concealed a thumb-sized recorder in toilet paper and plugged it into a USB port behind the television in an executive conference room at the company's San Francisco office. OpenAI's technical surveillance countermeasures team found it during a sweep in September. Rather than pull it, they left the device in place and put a camera behind the television. On 5 October he returned and was recorded looking behind the screen. He was arrested on 9 October and faces up to five years. OpenAI says it has no indication that model weights, source code or customer data were accessed.
Source: US Department of Justice · DOJ press release, 13 Oct 2026
My take
The four items above are devices nobody inspected. This is the one where somebody did, and it was not luck. OpenAI runs a team that physically sweeps rooms, which almost no organisation does, and when they found the device they did the harder thing: they left it where it was and watched it. That is a decoy, in a boardroom, and it is precisely what CISA was recommending a month ago. Notice the restraint in the rest of it too. Access restricted, the employee placed on leave, the termination timed with the FBI so the investigation was not disrupted. If an insider case ever lands on your desk, that sequence is the one to copy.