Weekly brief · Week of 9 November 2026
Hacked fridges, encrypted backups and a WordPress flaw: three systems to check this week
By efex. Last updated .
This week's cyber stories have something in common: they involve systems many organisations rely on but someone else looks after. Refrigeration equipment, backup storage and a company website can all become cyber risks when ownership for updates, access and monitoring is unclear. Here is what happened and what to check this week.
In this brief
Connected equipment
The alarm that caught a cyberattack
On 2 November, a cyber incident affecting a refrigeration provider altered temperature and defrost settings in cold-storage equipment at three sites operated by France's national blood service, the Établissement français du sang (EFS).
The EFS itself was not directly targeted. Its monitoring and alarm systems detected the changes quickly, allowing staff to secure the affected equipment or move products to other cold storage. The EFS said no blood products were lost, stored samples were not affected, no health impact was identified, and collection and distribution continued.
The incident came amid separate attacks on refrigeration systems used by supermarkets elsewhere in Europe. There is no established link between those attacks and the EFS incident.
On 5 November, the FBI and the US Cybersecurity and Infrastructure Security Agency, with the US Departments of Health and Human Services, Agriculture and Transportation, warned that attackers are targeting unpatched or internet-accessible temperature and refrigeration controllers in grocery stores and cold storage facilities. Attackers can change settings, force units into continuous heating and defrost cycles, and stop staff seeing current temperatures. The agencies said these systems are widely used in healthcare, food and agriculture, chemical and transport.
Why it matters
The refrigeration equipment was operational technology, but the cyber risk reached the organisation through a supplier. Just as importantly, independent monitoring meant the problem was detected before it caused harm.
Check this week
Identify connected equipment managed by suppliers, including vaccine, medicine and sample fridges, building controls and security systems. Ask how each device is accessed remotely, whether default credentials have been removed, who monitors it and who receives an alert outside business hours. Confirm no temperature controller can be reached from the public internet, and ask the supplier whether any controller is too old to receive security updates.
Backup storage
Ransomware is targeting Synology NAS devices
Synology is warning customers about ransomware attacks against network-attached storage (NAS) devices running outdated versions of its DiskStation Manager software.
NAS devices are common in small and mid-sized organisations because they provide shared storage and are often used as part of a backup system. Synology says attackers are exploiting a vulnerability it patched in December 2024 to encrypt data and demand payment. It has not publicly identified the specific vulnerability being used.
What matters most is that these attacks are succeeding against devices for which a security fix has been available since December 2024. If a NAS has remained unpatched and can be reached from the internet, the organisation may be relying on an exposed device to protect the data it would need for recovery.
Why it matters
If ransomware encrypts the NAS that holds your backup, that backup may be lost or unavailable when you need it. Without another clean copy that the compromised device cannot alter or delete, the organisation may have no practical way to restore its files without paying, rebuilding from other records or accepting permanent data loss.
Check this week
Ask your IT team or provider: Is any Synology or other NAS running outdated software? Can its management interface be reached directly from the internet? And do we have at least one clean backup copy that the NAS cannot change or delete?
Also: QNAP and Plex
QNAP says the Plex Media Server app on its NAS devices is being breached through flaws CISA listed as exploited on 20 October. Update Plex to version 1.43.3.10861 or later, and treat any device that exposed a vulnerable Plex server to the internet as compromised: check it, reinstall the operating system and reset passwords.
Websites
A WordPress flaw is already being exploited
A high-severity flaw in WordPress, the software behind approximately 40% of all websites, is already being used in attacks. Wordfence, a WordPress security company, says it has blocked more than 240,000 attempts to exploit it. That gives organisations another reason to check the websites managed on their behalf.
CVE-2026-119977 affects WordPress versions 4.7 through 7.1.3. The weakness occurs during a full WordPress update, when temporary installation files can briefly become accessible from the internet on vulnerable configurations. An attacker who reaches those files at the right time may be able to execute code on the server.
WordPress released version 7.1.4 on 28 October, with corresponding security releases for supported older branches. Wordfence says attack attempts began the same day. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 3 November, confirming that exploitation has occurred.
Why it matters
A compromised website can be used to alter content, redirect visitors, steal information submitted through forms or create a foothold into connected services. Your agency or hosting provider may manage the site, but the reputational and operational impact still belongs to your organisation.
Check this week
Ask whoever manages the site to confirm the exact WordPress version currently running, whether it is on the fixed release for its branch, and whether they have reviewed the site and server logs for signs of compromise. Before the update runs, ask them to block web access to the site's temporary update folder (wp-content/upgrade). Do not accept "automatic updates are switched on" as confirmation that the site is secure.
Stat of the week
380,000+
Synology NAS devices observed as reachable from the internet. That does not mean 380,000 vulnerable devices, but it illustrates how much storage infrastructure is externally accessible.
Source: Shadowserver figures reported by BleepingComputer, 2 November 2026
Ask your IT provider: Which of our storage devices can be reached from the internet, and does any management interface need to be?
Key numbers
What to check this week
- 1.Know what suppliers can access. List connected equipment, storage and web systems managed outside your organisation.
- 2.Remove unnecessary internet exposure. Ask whether NAS management pages, refrigeration controls, building systems or similar devices can be reached directly online.
- 3.Confirm what is actually updated. Do not settle for "automatic updates are on". Ask for the version currently running on storage devices and websites.
- 4.Keep one clean recovery copy out of reach. Your IT provider should be able to explain which backup cannot be changed or deleted from the primary environment or the NAS it protects.
- 5.Know who gets the alert. For critical equipment and systems, confirm who is notified after hours and who has authority to act.
The common question across all five is simple: who owns the check? If the answer is unclear, that is the first thing to fix.
The check worth making
None of this week's incidents requires a business leader to become a cyber security specialist. But they do reinforce a basic management responsibility: know which systems the organisation depends on, know who is responsible for them and verify that the important controls are actually working.
A supplier managing the equipment, backups or website may be entirely appropriate. What should not be outsourced is the organisation's understanding of who owns the update, who monitors the system and who responds when something goes wrong.
That is the check worth making this week.
Get the report in two pages
ASD's Annual Cyber Threat Report 2025-26, released in late October, is 68 pages long. We've pulled out the five facts that matter most to mid-sized organisations, and ten questions to ask your IT team, in two pages.
Get the summaryTo understand how at risk your business is from a cyber attack, take our free 3-minute cyber self-check. It shows your current risk areas and what to fix first.
Free cyber audits are available until 30 November 2026.
Questions people ask
On 2 November 2026, a cyber incident affecting a refrigeration provider changed temperature and defrost settings in cold storage at three sites of France's national blood service. Its monitoring detected the changes quickly, and the service said no blood products were lost and no health impact was identified. Separate attacks hit supermarket refrigeration elsewhere in Europe; no link has been established.
Synology's advisory lists DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8, or later. Synology advises updating now and turning on automatic updates. BleepingComputer also advises blocking internet access to the management interface.
WordPress 7.1.4 fixes the vulnerability in the current 7.1 branch, with corresponding security releases available for supported older branches. If an agency or provider manages your website, ask them to confirm the exact version currently running rather than assuming an automatic update completed successfully. Versions 4.6 and earlier do not receive the relevant security fix and should be upgraded.
Automatic updates help keep WordPress current, but they are not enough on their own. CVE-2026-119977 affects the update process itself on vulnerable configurations. Ask whoever manages the site to confirm that it is running a fixed release and that they have checked for signs of compromise. If they manage the hosting environment, they should also confirm that temporary WordPress update files cannot be accessed from the web.
Sources
BleepingComputer, 4 November 2026 (EFS) · BleepingComputer, 2 November 2026 (Synology) · Synology security advisory Synology_SA_24_20 · WordPress.org, Version 7.1.4 release notes · Wordfence, November 2026 · The Hacker News, 6 November 2026 · W3Techs, WordPress usage statistics, 8 November 2026 · CISA Known Exploited Vulnerabilities catalogue · The Hacker News, 4 November 2026 · CISA, FBI, HHS, USDA and DOT, 5 November 2026, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems" (fact sheet) · BleepingComputer, 5 November 2026, "FBI, CISA warn of cyberattacks targeting refrigeration systems" · BleepingComputer, 6 November 2026, "QNAP says hackers breaching NAS devices in Plex2Shell attacks"