[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0ZxndCJx_XBs_A-zCIgi4_XcFfs_GR-kWi_Bw_Ivnn0":3},{"article":4,"iocs":58,"watch_terms":62,"solutions":63,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f510dde5-cce5-4a71-b976-660c448c8279","Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast","week-in-review-refrigeration-cyberattacks-hit-european-retailers-again-patch-tue-7ba1c2","Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf. Google disrupts XCPE botnet, bans … More → The post Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast appeared first on Help Net Security.","European retailers are once again targeted by cyberattacks affecting refrigeration systems. Google has disrupted the XCPE botnet, which compromised over 1.3 million Android TV devices, attributing it to Videostrong Technology. Additionally, research highlights risks associated with AI coding agents potentially installing unpatchable software.","Refrigeration cyberattacks hit European retailers again; Google disrupts XCPE botnet; AI coding agents pose patching","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F08\u002Fweek-in-review-refrigeration-cyberattacks-hit-european-retailers-again-patch-tuesday-forecast\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2023\u002F12\u002F01112506\u002Fcybersecurity_week_in_review2.jpg","2026-11-08T09:00:21+00:00","2026-11-08T10:00:05.871744+00:00",7,[17,20,22,25,28,30],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Videostrong Technology",{"name":23,"type":24},"Android TV","product",{"name":26,"type":27},"AI coding agents","technology",{"name":29,"type":19},"KloudStax",{"name":31,"type":19},"HackerOne","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[59],{"type":57,"value":60,"context":61},"XCPE","Backdoor found in Android TV set-top boxes",[18,21,29],{"controls":64,"vendors":143},[65,94,115],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[99,107],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":36,"name":116,"problem":117,"products":118},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"google","\u002Fvendor-logos\u002Fgoogle.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"refrigeration-cyberattacks-and-botnet-compromises-expose-ot-and-iot-blind-spots","Refrigeration Cyberattacks and Botnet Compromises Expose OT and IoT Blind Spots","European retailers are suffering repeated cyberattacks targeting refrigeration and building management systems, underscoring that operational technology (OT) environments remain dangerously under-secured. The XCPE botnet's compromise of over 1.3 million Android TV devices — attributed to a named manufacturer — highlights how supply chain actors can embed malicious capability into consumer and commercial hardware at scale. Meanwhile, AI coding agents introducing unpatchable software dependencies signals an emerging software supply chain risk that traditional patch management cannot easily address. Together, these incidents reveal that organizations are failing to treat IoT, OT, and third-party software components with the same security rigor as conventional IT assets. Without proper segmentation, inventory visibility, and vendor accountability, attackers will continue to exploit these overlooked attack surfaces.",[154,155,156,157,158,159,160],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1195: Supply Chain Compromise","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"MITRE ATT&CK T1195: Supply Chain Compromise":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"CIS Control 1: Inventory and Control of Enterprise Assets":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168},"NIS2 requires essential and important entities — which includes European retailers operating critical supply-chain infrastructure like refrigeration — to implement incident handling and supply-chain security measures that were clearly absent here.","SI-2 requires organizations to identify, report, and correct information system flaws, which directly applies to the unpatched or unpatchable software introduced by AI coding agents and unmanaged IoT firmware.","The XCPE botnet was attributed to the device manufacturer Videostrong Technology, making this a textbook supply chain compromise where malicious capability was embedded before the device reached the end user.","The risk of AI coding agents installing unpatchable software dependencies maps directly to this category, as outdated or unmanageable third-party components create persistent vulnerabilities that cannot be addressed through normal patch cycles.","Repeated attacks on refrigeration systems suggest known vulnerabilities are not being remediated; a structured vulnerability scanning and patching cadence covering OT and IoT assets would reduce this exposure.","The botnet compromised 1.3 million devices that organizations likely had no visibility into; a complete, continuously maintained device inventory would have enabled detection and response far sooner.","This control mandates timely identification and remediation of technical vulnerabilities across all assets, including OT and IoT devices that were exploited in the refrigeration and botnet incidents."]