A back number, composed at the paper’s founding from the news of its own week.

Outlook: Thawing, with a cold front in the courts

The Packet Inspector

☞Four Public Notices this week. Three are urgent.

“All the Vulnerabilities Fit to Patch”

Est. 2026 · Composed by Mechanical Editor · Price: One Click

Vol. I, No. 1Friday, the Sixteenth of October, 2026
Outlook: Thawing, with a cold front in the courts
☞Four Public Notices this week. Three are urgent.

Freezers left to thaw · Investigation opened

The Ice-Houses Thawed!

Attackers Seize Refrigeration Controls in Hundreds
of French Supermarkets, Reports Say;
the Paris Prosecutor Investigates

Whatever answers to the wires, it transpires, will answer to a stranger

The door is barred; the dial is turned from outside all the same. Posed for this paper in the studio; no grocer was harmed.Photogravure, Art Dept.
By Phineas T. BlackwoodEditor

A shopkeeper may bolt his door at night and still be robbed through the wall.

On Sunday night, by French reports, attackers took over the fridge controls of French supermarkets. They set the fridges and freezers to defrost, a low trick to play on any grocer. French outlets, BleepingComputer reports, put the toll at 250 to 350 stores.

The controls, French reports say, were made by Danfoss, a Danish firm. Shops of Intermarché, Super U and Leclerc were affected, Help Net Security says. Carrefour Market and Monoprix stores were hit too, by one trade blogger’s account. The head of one chain called the attack unprecedented, and this paper will not quarrel with him. “It is unacceptable,” he said.

The Paris prosecutor has opened an investigation. How the brigands got in is not yet known, and this paper will not pretend otherwise. In early August, researchers reported flaws in Danfoss and Copeland controllers. Both makers have since released fixes. Whether those flaws were used here, nobody can yet say.

A researcher found 2752 Danfoss systems open to the internet on Monday. More than half, we note with some alarm, were in France.

Any shop whose cold room answers to the wires should ask its installer to shut that door. The ices are already lost. We are unamused.

Sources: BleepingComputer · Help Net Security, both 12 October 2026.

Developing story · first report · we will follow the investigation · all threads ›

Running Threads

Serial. The Phantom of the Mainframe, part 1 of 12. Parts so far: 1.

Developing. The French freezers. Reports so far: this number.

Developing. The bankruptcy courts’ notices. Reports so far: this number.

Staff. Zeke’s bid for the news desk. Mr. Quill corrects the Editor.

On the web edition, each thread links to an archive page with every part in order. Every number also reads complete on its own.

Latest Intelligence by Wire

By Miss Cordelia VanceCorrespondent at the Wires

Thorncastle’s VigilantNight-WatchAlarm Clock

Rings When the Larder Warms!

Stands beside the ice-box and keeps the hours. Should a stranger meddle with the cold, it strikes thirteen.

“It struck thirteen at midnight. I have since bought a second clock to watch the first.” A Grocer of the High Street

Three Bits, Wound

The clock cannot restore the cold. It can only announce, loudly, that the cold has gone.

Advt.

Old Files Taken

Britain’s Legal Aid Agency Finds Stolen Records Reaching Back to 1978

LONDON, by wire. Old files were in the haul from Britain’s Legal Aid Agency. Attackers broke in last year, in April 2025. Some 250,000 of the stolen records predate 2007. The earliest verified record dates from 1978. Most, we are told, cover the years since 2007. The ministry has seen no sign the data was published, BleepingComputer reports.

The Strongbox Tampered

Ledger Confirms a Hidden Implant in a Wallet Sold Through One Asian Reseller

PARIS, by wire. A hidden implant was found in a Ledger wallet, the maker confirms. Such wallets guard the keys to crypto savings. Every confirmed theft involves devices sold by one reseller, Cryptobilis, Ledger says. Its own systems and direct sales were not breached, it adds. Researchers put suspected losses above $93 million, we are told. Cryptobilis buyers are urged not to set theirs up, Help Net Security reports.

A Pattern Misread

GitLab Urges Owners of Self-Managed Servers to Patch a Critical Flaw

SAN FRANCISCO, by wire. GitLab urges owners of self-managed servers to patch a critical flaw. It could let a stranger run code on the server, the firm says. Fixed versions are 19.4.2, 19.3.5 and 19.2.8, out on 12 October. GitLab.com is already patched, it seems. Rapid7 researchers say an attacker must first be able to commit a rigged file. That is a small comfort, if any. Self-hosted owners should upgrade now, Help Net Security reports.

The Courts’ Post Halted

Attack on Contractor BAE Systems Takes Down the Notice System of US Bankruptcy Courts

WASHINGTON, by wire. The debt courts have lost their post, it seems. A firm that mails their notices was attacked. That firm is BAE Systems, which runs the notice system of America’s bankruptcy courts. The courts’ head office said so on Thursday. The notice websites are down. BAE says only that one system was hit, BleepingComputer reports.

Developing story · first report · all threads ›

Public Notices: Remedies Now Available

BeyondTrust Remote Support · CVE-2026-102764

BeyondTrust reports exploitation since late August. Affects Remote Support 26.2.3 and earlier. Cloud customers were patched on 8 October. Self-hosted appliances without automatic updates must have BeyondTrust’s patch applied by hand. Treat an appliance that faced the internet as possibly compromised.

Priority: today · BleepingComputer

Ivanti Connect Secure · CVE-2026-104935

Ivanti reports limited exploitation; others date it to early October. Lets an attacker run commands without signing in. Install the fixed release for your branch: 22.8R2.5, 25.1.3.0, 25.1.3.1 or 25.1.1.2. If an appliance was compromised, CISA advises a factory reset and new passwords for every account.

Priority: today · BleepingComputer

Cisco Secure Email Gateway · CVE-2026-76519

Cisco reports exploitation. A crafted email attachment can let an attacker run commands as root. Affects gateways where file reputation is enabled and assigned to a mail policy, with Content Scanner Tools earlier than 25.3.0.5525. Upgrade to a fixed release, then check firewall logs for unusual transfers.

Priority: today · BleepingComputer

Palo Alto Networks PAN-OS · CVE-2026-0322

Palo Alto reports very limited exploitation, against firewall management interfaces. An attacker with credentials can run code as root. Fixes are out for branches 10.2, 11.1, 11.2, 12.1 and 12.2; one for 11.2.16 was due on 15 October. There is no workaround. Limit the management interface to trusted internal addresses.

Priority: this week · BleepingComputer

By Appointment OnlyMadame Zero-TrustSeer · Doubter of Callers

Madame receives callers on the hour and asks each one who he is.

Familiar Faces Doubted at No Extra Charge

“I have sat with her weekly for a year. She has not yet admitted to knowing me.” A Faithful Client

One Dollar the Sitting

Madame declines to confirm that this advertisement is hers.

Advt.

The Week in Figures

By Barnaby QuillAlmanack Keeper
Over $93 millionin suspected losses from tampered Ledger wallets, by researchers’ count (Help Net Security).
250,000stolen Legal Aid Agency records older than 2007, approximately (the Agency).
Over 1,400BeyondTrust Remote Support instances exposed online (Shadowserver, via BleepingComputer).
250 to 350French supermarkets whose fridges were set to defrost, by French reports (BleepingComputer).
187laptops and input devices seized from suspected laptop farms in Texas, approximately (BleepingComputer).

(It will be recalled that the Editor, on the front page, calls a set of supermarket freezers “Ice-Houses.” An ice-house holds ice. It does not plug in. — B.Q.)

Running thread: Mr. Quill corrects the Editor · first appearance · all threads ›

Fifty Years Ago

In 1976, the National Bureau of Standards held two public workshops on its proposed Data Encryption Standard, as NIST’s own history records.

Some critics suspected the government had weakened the cipher on purpose. NIST’s history says the changes to its inner tables made it stronger. The present writer has seldom seen a suspicion so politely disappointed.

Its 56-bit key, NIST’s history adds, is now far too short for safety. (The record gives the year, not the week. Fifty years ago this season is as near as the present writer will go.)

Aunt Entropy Replies

By Aunt EntropyAdvice to the Subscribing Public

“A text message says I owe a road toll and must pay through a link by tonight. Must I?”Fretting in Fresno

My dear Fretting, a debt that can only be settled through a link in a text is no debt at all. This very week a market selling kits for such messages was disrupted. Its kits offered lures such as fake toll bills, BleepingComputer reports.

A bill pushed under the door that says to pay the boy waiting on the step is no bill either. A real toll office will not mind if you look up your account yourself, which is more than can be said for a swindler. A message that hurries you is selling the hurry.

  1. Do not tap the link, however urgent the message sounds.
  2. Look up the toll office yourself and check your account there.
  3. If you have already paid, telephone your bank today.

Today: do not tap the link.

Letters in this column are composites.

Notes From the Composing Room

By Zeke SprocketPrinter’s Devil

This is the first paper. I set the nameplate myself. The big letters are heavy and the small ones hide in the case.

Mr. Blackwood said the freezer story must lead. I asked if I could write a story too. He said one day, when I know what a source is. I am finding out.

I spent my wages on a Thorncastle’s clock. It has not struck thirteen yet. I am waiting up.

Running thread: Zeke’s bid for the news desk · first appearance · all threads ›

The Phantom of the Mainframe

A penny dreadful in twelve weekly parts, by Zeke Sprocket. Mr. Blackwood has registered a protest.

Part 1 of 12 · all parts so far ›

Part 1. It was a dark night and the engine-house hummed. Nobody was there, yet the lights blinked. Someone, or something, was at the keys. Constable Pratt crept in with his lantern. “Who goes there?” he said. The answer came upon the screen in green letters. It said only: “ADMIN.” Constable Pratt grew pale. He did not know that password. Neither, it turned out, did the Phantom. (To be continued, if Mr. Blackwood allows.)

Part 2 of 12 next week · all parts so far ›

Classified

Lost and Found

LOST: the cold, from a great many shops, over the weekend. Finder please return before the cream turns.

For Sale

ICE-BOX, warm, lightly used, contents not included. Seller recommends a padlock and a thermometer.

LAPTOP, one of a great many, seeks a quiet home. Types well. Will not say for whom.

Personals

WILL THE PARTY who writes that I owe a road toll kindly name the road? A Motorist.

Notices

OUR READERS will never be asked by this office for a watchword by letter, nor for a road toll.

Corrections and Apologies

No corrections this week.

Keep your watchwords long and your remedies current.
— The Editor