NewsDark Reading
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Teaser from the source
Hundreds of stores lost millions of euros because they hired third parties to manage the outdated OT firmware running their cooling systems.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Dark ReadingMore on Unpatched
Other advisories
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- Not ratedosv:CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- CriticalCVE-2025-59851HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, whic…
- Not ratedosv:CVE-2026-35667OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts
- Not ratedosv:ECHO-ddb8-c818-edcaVulnerable code is not present in libraw 0.21.4 (the version shipped in Debian trixie). The CVE describes a heap out-of-bounds write in HuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via LibRaw::sony_ycbcr_load_raw -> LibRaw_LjpegDecompressor::initialize -> HuffTable::initval. None of those symbols exist in 0.21.4: the src/decompressors/ directory, the LibRaw_LjpegDecompressor class, and the sony_ycbcr_load_raw entry point were all introduced together in libraw 0.22.0. Empirically confirmed by running the public PoC from https://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan build of unpatched libraw 0.21.4: the file is rejected at open with "Unsupported file format or not RAW file"; the same PoC reproduces the heap-buffer-overflow in 0.22.0 with the stack trace from the Talos report.
- HighCVE-2024-52798path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
- Not ratedosv:CVE-2024-52798path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
Other news entries
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedNewsThe Register — Security
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertNewsThe Hacker News
- PSA: Patch your Plex media server before someone hacks itNewsArs Technica — Security
- Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on RoutersNewsThe Hacker News
- Unpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoNewsBleepingComputer
- Unpatched AhsayCBS Vulnerabilities Exploited in the WildNewsSecurityWeek
- Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code RemotelyNewsThe Hacker News
- Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery PathNewsThe Hacker News
Source: https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware
ID