> InfoSec News Nuggets – 11/10/2026

France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators France on Monday blamed Iran for the October 12 cyberattack that remotely seized refrigeration systems in roughly 700 French supermarkets, pushing temperatures as high as 50°C for about six hours and forcing stores to discard fresh and frozen goods. The national cybersecurity agency ANSSI attributed the attack to the Shahid Kaveh group, a cyber unit tied to Iran’s Islamic Revolutionary Guard Corps, and Paris prosecutors have opened a formal judicial investigation and are seeking international arrest warrants for the group’s leader and two deputies. Foreign Minister Jean-Noël Barrot summoned the Iranian ambassador, called it the first large-scale sabotage cyberattack on French soil, and pledged to pursue European sanctions against those responsible, as similar refrigeration attacks continue to hit supermarkets elsewhere in Europe.   Google fixes Chrome XML zero-day flaw exploited in attacks Google has released a Chrome security update fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. The bug, reported anonymously on November 6, traces back to the libxslt library’s pattern-matching cache, where a nested XML evaluation could free memory still referenced by an earlier operation, potentially letting crafted web content run malicious code in the browser. Google has not disclosed who is behind the attacks or who was targeted. The update moves Chrome Stable to version 157.0.8103.50/.51 on Windows and macOS and 157.0.8103.50 on Linux, and users need to relaunch the browser after updating for the fix to take effect.   Turla’s Cereal malware turns victims’ Exchange servers into spy hubs ESET researchers have uncovered Cereal, a modular .NET toolset that the Russia-aligned Turla group planted on Microsoft Exchange servers at government organizations in Kazakhstan and Romania to quietly copy selected email straight out of the mail flow. Rather than relying on attacker-owned infrastructure, the CerealNeuron backdoor accepts encrypted commands disguised as ordinary Outlook Web Access, Autodiscover and ActiveSync traffic, effectively turning the victim’s own server into the command post, while a second backdoor reads commands from encrypted files on disk as a fallback. A component called CerealBox injects into Exchange’s EdgeTransport.exe process to hook transport agents already loaded in memory, a technique ESET says has never been documented before, and in Romania it was configured to grab messages exchanged with NATO and EU addresses.   Hackers Exploit Qubole’s Trusted AWS Access to Breach Customer Accounts and Steal Data Cloud security firm Wiz reports that an attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 using credentials for the AWS account the data lake platform relies on to reach customer environments. Because customer IAM roles trusted Qubole’s account, the attacker’s AssumeRole requests succeeded even on long-unused roles, allowing them to harvest secrets from Lambda environment variables, Secrets Manager and SSM Parameter Store, validate stolen credentials with TruffleHog, and copy entire S3 buckets. Any organization that has ever connected Qubole to AWS is urged to review CloudTrail logs from October 1 onward, rotate exposed secrets, remove unneeded Qubole roles, and restrict trust policies with source IP conditions.   Hackers Use New Lindnor Backdoor to Target Microsoft SQL Servers in Anubis Ransomware Attack Symantec has documented a previously unknown custom backdoor called Lindnor that attackers deployed on two Microsoft SQL Server machines at a U.S. organization during an October 2026 Anubis ransomware intrusion, disguising it as a Chrome component on one server and a VMware file on the other. Within about an hour, the operators dropped at least 13 executables designed to kill security products along with five signed but vulnerable drivers, and configured AnyDesk to survive a Safe Mode boot to sidestep defenses. The encryption payload was ultimately blocked and no files appear to have been encrypted, but researchers note that custom backdoors are rare in ransomware operations and advise defenders to watch for new services, driver loading, Safe Mode registry changes and unexpected AnyDesk installs. The post InfoSec News Nuggets – 11/10/2026 appeared first on AboutDFIR - The Definitive Compendium Project.