I’ve been writing on Medium for a while. It did the job, but I missed having control over layout and could never make a post look the way I wanted. So I built my own place for it, and I’m moving the writing here.
A lot has happened in the last few weeks, so I’m starting with three things that stuck with me.
Fridges, twice #
On 12 October, hackers heated the refrigeration at roughly 150 Intermarché stores in France to 50°C for six hours. Food was lost and fires were reported. Danfoss controllers were reportedly involved, and the French agency said Copeland and Dixell systems were hit too.
It happened again overnight into Monday 2 November, this time in Belgium, Sweden, Ireland, Estonia and several other countries. Fridges and freezers went into defrost or heated up. Danfoss said its products were involved again, and Ahold Delhaize confirmed an “IT incident” affecting refrigeration at some of its stores. The CEO of Sabcobel, which runs Delhaize’s refrigeration in Belgium, said the attackers got into individual stores’ systems rather than the contractor’s. Nobody has claimed responsibility.
None of this is new, people just forget about it. After the first wave, researchers used OSINT to show how many of these controllers were still reachable from the internet. Modat , which runs internet-wide scans, counted about 16,000 refrigeration systems reachable worldwide in October. Its CEO told NRC that more than 9,000 have since gone offline. That is more than half, and it still leaves a lot of controllers answering from the internet.
Albert Heijn #
Around the same time, Ahold Delhaize had apps, websites and deliveries down, and shelves stayed empty for days. Ahold filed a police report, and experts estimated the damage at over €10 million.
What stayed with me is how visible the impact was. Critical infrastructure usually sits out of sight until it fails, and here everyone saw it: no online orders, empty stores. It gave the public a clear picture of how much society depends on this.
PHP2Shell #
On 21 October the PHP project shipped emergency patches (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for CVE-2026-109618 and CVE-2026-109619, two unauthenticated RCEs.
Many people had no idea. That goes especially for individuals and smaller businesses, who run PHP through a CMS or a hosting package and never see an advisory. It also showed how much of the internet depends on a single piece of open source software.
Logs lie less than people do, but they still lie. I’ll write about that next, with evidence.