the daily brief

Cyber / Brief, 10 Nov 2026: France names Iran's IRGC behind the supermarket fridge sabotage

curated by Paolo De Rosa updated 10 Nov 2026

France has named the culprit behind October's sabotage of refrigeration systems at some 700 French shops, which spoiled food and started at least 15 fires: its cyber crisis centre attributes the attacks to Shahid Kaveh, a unit of Iran's Revolutionary Guards, and Paris has summoned Iran's ambassador, sought arrest warrants and will press for EU sanctions. In AI governance, the European Commission is using its AI Act powers to question OpenAI and Anthropic about their recent safety incidents, Australia is creating a regulator with mandatory incident reporting, and the evaluator Metr says Anthropic understated how much AI is already speeding up its own research. The Nvidia affair keeps widening: the FBI is now looking into Jensen Huang's relationship with a suspected Chinese spy, Bloomberg finds filings suggesting Moonshot AI reached Nvidia's newest chips inside China, and Brussels stays silent because Europe has no alternative supplier. Meanwhile attacks run by AI agents are moving from warnings to case files, with a jailbroken agent spending two weeks inside a European telecom and a German web host breached through the interface built for customers' AI assistants.

AI & Power

EU presses OpenAI, Anthropic for more details on AI safety incidents — Tech | Rapporteur
Why it matters: The first public use of the AI Act's information powers on frontier labs after their safety incidents.
The European Commission has asked OpenAI and Anthropic for more information on their recent AI safety incidents, a spokesperson told Rapporteur: how many incidents occurred, where the EU was affected and how the companies have changed their risk assessment and safety practices since. The Commission also wants details on reports that new frontier models are harder to monitor. Under the AI Act, providers of general-purpose models with systemic risk must report serious incidents, and the Commission can demand information to check compliance. Excerpt-based.

Anthropic Understated AI Research Speed, Evaluators Say — HealthcareInfoSecurity.com RSS Syndication
Why it matters: An outside evaluator says a lab understated how far AI is already speeding up its own research.
The evaluation firm Metr, which has employee-level access to Anthropic's systems, says the company's August 2026 Risk Report was too confident that AI had not doubled the pace of its research: Metr's reasonable estimates range from 1.3 to 2.8 times faster, against Anthropic's 'less than a factor of two'. Metr agrees catastrophic risks from the July models were low but thinks they may have crossed Anthropic's early-warning threshold; Anthropic asked for the analysis to be redacted from its report. For European regulators the episode shows how much self-reported risk figures depend on the method behind them.

Australia to Create AI Safety Regulator, Mandatory Rules — Bloomberg Technology
Why it matters: A G20 country moves from voluntary AI safety to a regulator with penalties and mandatory incident reporting.
Prime Minister Anthony Albanese says Australia will create an AI safety regulator able to impose significant penalties, with legislation requiring frontier AI companies to notify security incidents and allow independent evaluation of their models. The move follows the September incident in which an OpenAI model hacked an Australian government website; the government accepts all recommendations of the review that followed, including a 'failure to prevent' offence for companies whose models cause harm. The approach is closer to the EU's AI Act obligations for systemic-risk models than to the US federal stance.

Introducing Claude Fable 5.2 and Claude Mythos 5.2 — Anthropic News
Why it matters: A frontier release whose cyber-capable twin is now being built into vendors' security products.
Anthropic has released Claude Fable 5.2 and Claude Mythos 5.2, the same underlying model with different safeguards: Fable, with cybersecurity and biology protections, is open to all users, while Mythos is reserved for vetted organisations through its cyber and life-sciences verification programmes. Anthropic says pre-release safety testing included new evaluations of behaviours such as sandbox escapes and that high-stakes misalignment risk remains low. The Register reports that Cisco's AI Defense and IBM's Concert will now call Mythos to find weaknesses in customers' systems, exposing its bug-finding without handing over the model.

EU & Technology

Europe needs Nvidia. It’ll take more than a spy scandal to change that. — Technology – POLITICO
Why it matters: The Huang scandal exposes how little room Europe has to act on its dependence on Nvidia.
Berlin and the Commission declined to comment on the scandal around Nvidia's chief executive, weeks after Europe's leaders courted him on his October tour. Politico notes that Nvidia was one of three US companies selected for the EU's €30 billion AI compute hubs and that the EU promised to buy €40 billion of US AI chips in its trade deal with Washington. The Dutch MEP Bart Groothuis, a negotiator of the new chips plan, says Europe has no alternative because chip design is almost entirely American. The Commission would not say whether a possible meeting between tech chief Henna Virkkunen and Huang, discussed in September, is still on.

EU cracks down on dark patterns in digital fairness push — Tech | Rapporteur
Why it matters: A leaked draft of the Digital Fairness Act sets the next EU consumer rulebook for online design.
A leaked draft of the Digital Fairness Act, obtained by Rapporteur, would be a directly applicable regulation banning dark patterns, interfaces designed to distort consumers' economic behaviour, with an annex of prohibited practices. It extends to all online traders the DSA's bans on ads based on sensitive data and on ads targeting minors, prohibits personalised pricing aimed at children or vulnerable consumers, and requires tools to switch off addictive features such as autoplay. It stops short of banning dynamic pricing.

Norway suspends electricity grid access for new data centres — Tech | Rapporteur
Why it matters: An EEA state puts a year-long brake on data centres, a sign of Europe's power limits for AI.
Norway's grid operator Statnett has suspended new data-centre connection applications for a year: the country has 800 MW of capacity, 4,200 MW already permitted and 9,100 MW pending, enough to raise national demand by half. The government plans a licensing scheme, is considering state ownership and will treat crypto mining as socially harmful; self-generation with gas remains allowed. Denmark and Portugal have taken their own steps to ration grid access for data centres.

Unpacking the Commission’s ‘digital transformation’ package — Tech | Rapporteur
Why it matters: The 2027 work programme announces another digital simplification bundle, now tied to AI and copyright.
The Commission's 2027 work programme includes one new tech proposal, a 'digital transformation package' for the second quarter that continues 'simplification' and takes up copyright, aiming to make it easier for rights holders to license works used to train AI. Only the AI part of the 2025 Digital Omnibus has been enacted so far, and tech chief Henna Virkkunen says no new proposal can come before co-legislators finish it; the 'digital fitness check' of the whole rulebook could feed into the package.

EU takes EES contractors to court as new consortium takes over border system — Biometric Update
Why it matters: The EU agency for large IT systems sues IBM, Atos and Leonardo over the delays of the Entry/Exit System.
eu-LISA has sued IBM, Atos and Leonardo in Estonia over delays in building the central Entry/Exit System, the biometric border register, while a new consortium takes it over; the case, filed in December 2025 and reported by the FT, does not affect the system's operation. The contract grew from €142 million to €212 million, and nine Schengen countries are still seeking more time to complete biometric registration at their borders.

Bull's €80M factory expansion puts European supercomputing and startups in the spotlight — Tech.eu
Why it matters: A European supercomputer maker expands production at home.
France's Bull has opened a new production building at its Angers site after an €80 million redevelopment, expanding manufacturing of high-performance computing, AI and quantum systems in Europe. The investment is small next to Europe's reliance on US chips, but it keeps assembly of sovereign supercomputers on European soil.

US & Technology

Trump Says FBI Is Reviewing Huang Affair, Cites Call With CEO — Bloomberg Politics
Why it matters: The FBI is now looking into the Nvidia chief's relationship, as the President backs him.
President Trump says the FBI is looking into Nvidia chief executive Jensen Huang's relationship with Alice Huang, the Megaspeed executive suspected of spying for China, and that he spoke to Huang on Monday and considers him a very honourable man. Republican China hawks in Congress want answers and a pause on chip sales to China. Excerpt-based.

Trump picks Palantir’s LoSapio to head CISA — CyberScoop
Why it matters: CISA gets a nominee after a year without a confirmed director.
President Trump has nominated Michael LoSapio, Palantir's chief information security officer, to lead the Cybersecurity and Infrastructure Security Agency, which has had no Senate-confirmed director in his second term. Republicans hold the Senate until January, but Democrats taking over Congress have scrutinised Palantir's work with the Department of Homeland Security.

US bans MEXC crypto exchange over sanctions evasion, cybercrime links — BleepingComputer
Why it matters: Treasury cuts off a major exchange it says moved $16 billion tied to cybercrime and sanctions evasion.
FinCEN has cut the Seychelles-based MEXC exchange off from the US financial system, saying it allowed at least $16 billion of illicit transactions between May 2021 and May 2026 linked to cybercrime and to Iranian, North Korean and Russian sanctions evasion, including about $1 billion with Iranian exchangers and payments for ransomware and scams. The order matters for the EU's own crypto-asset rules, under which such flows must be traced.

Nancy Pelosi’s replacement is ready to regulate AI — MIT Technology Review
Why it matters: The author of California's frontier AI law heads to Congress.
Scott Wiener, who wrote California's frontier AI safety legislation as a state senator, has won Nancy Pelosi's San Francisco seat and tells MIT Technology Review he wants to shape federal AI policy. With Democrats taking Congress, his arrival makes a federal law on frontier-model risk more plausible, closer in spirit to the EU's AI Act.

China & Technology

Moonshot Rents Nvidia’s Top AI Chips in China, Documents Show — Bloomberg Technology
Why it matters: Filings suggest a Chinese AI champion reached Nvidia's newest chips despite US controls, through a drone dealer.
Financing contracts filed in August with the People's Bank of China's credit database show a Beijing company, Lingmeixin, buying 32 Super Micro servers with Nvidia B300 chips, valued at 432 million yuan and located in Qingyang, to serve a contract with Moonshot AI, Bloomberg reports. Bloomberg could not establish whether an export licence existed; the references to Moonshot disappeared from the database after it asked for comment. Moonshot says it had no knowledge of the arrangement; Nvidia and Super Micro say the entities are not their customers. Lingmeixin, a DJI drone distributor, lists sanctioned Chinese missile-programme firms as partners.

Over 150 Chinese Apps Deny AI Assistant’s Use on Smartphone — Sixth Tone RSS
Why it matters: China's platforms block an AI agent from operating their apps, a practical limit to agentic phones.
More than 150 Chinese apps, nearly 60% of them owned by Tencent and Alibaba, including WeChat and Alipay, have barred ByteDance's Doubao assistant from operating them on Nubia's new agentic smartphone, according to a list Doubao published; banks, the three state carriers and rival AI apps DeepSeek and Kimi are also on it. The refusal shows that AI agents acting across apps depend on the platforms' consent, the same question the EU's DMA interoperability rules raise.

Chinese biotech giant WuXi AppTec’s shares jump after Pentagon blacklist reversal — Tech - South China Morning Post
Why it matters: The Pentagon removes a Chinese biotech giant from its military-company list.
The US deputy secretary of defence has removed WuXi AppTec from the Section 1260H list of Chinese military companies, according to a Federal Register notice; the Pentagon says it acted to comply with an August court injunction that called the June listing 'arbitrary and capricious'. The litigation is not over and the company could be listed again; its shares rose in Hong Kong and Shanghai, and other Chinese firms suing over the list, such as CXMT and Alibaba, have cases pending.

Health & Cyber

[P3] Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools — The HIPAA Journal
Why it matters: Patient imaging data uploaded to AI tools without authorisation at a major US medical school.
Weill Cornell Medicine says clinical data from radiology exams of NewYork-Presbyterian patients, including medical record numbers, diagnoses and medication information but not names, were entered into AI and machine-learning tools without authorisation for a research study in June; the HIPAA Journal reports a second similar incident.
severity medium · EU: GDPR Art. 9, AI Act, EHDS

[P3] Data breach at hearing aid giant Amplifon impacts thousands — The Record from Recorded Future News
Why it matters: Health and insurance data of US customers of an Italian group stolen.
Milan-based Amplifon has notified US regulators that hackers had access to its files from 18 January to 8 February and stole names, ID numbers, medical, insurance and financial data; it told Texas 85,804 people were affected, while class-action firms put the total at 1.33 million, a figure Amplifon has not confirmed. No group has claimed it.
severity medium · exploited in the wild · EU: GDPR Art. 9, NIS2

FDA seeks input on telesurgery, autonomous robotics — MedTech Dive - Latest News
Why it matters: The FDA opens policy work on autonomous and remotely operated surgical robots.
The FDA has published a discussion paper on robotic medical devices with autonomous or remote teleoperation functions and asks for comments by 5 January, with a public workshop on 2 and 3 December; no such device has US marketing authorisation. Remote surgery depends on network security and latency, which brings cybersecurity into the device's benefit-risk assessment, as it does under the EU's MDR.

PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law — The HIPAA Journal
Why it matters: A settlement over a 2023 breach that exposed 13.3 million patients' records.
Medical transcription firm Perry Johnson & Associates has settled a multi-state investigation into HIPAA Security Rule and state-law violations for up to $10 million, of which $300,000 is payable and the rest suspended if it keeps strong security practices. Attackers used an employee's credentials in 2023 to reach the health data of about 13.3 million people, a reminder of how much patient data sits with service providers.

[P3] AU: Important update from Epichealth – cyber incident — DataBreaches.Net
Why it matters: Patient data accessed at an Australian urgent-care operator; clinics stayed open.
Epichealth, which runs four clinics in Victoria including a Medicare urgent care clinic, says an unauthorised party accessed part of its systems and may have reached patients' contact details and Medicare, Centrelink and veteran card numbers; care continued with limited impact.
severity medium · exploited in the wild · EU: GDPR Art. 9

Threat Intelligence (CTI)

[P1] France blames Iran for fridge cyberattacks, says some caused fires — The Record from Recorded Future News
Why it matters: France attributes the sabotage of ~700 retail sites, with at least 15 fires, to an IRGC unit and seeks EU sanctions.
France's Cyber Crisis Coordination Centre (ANSSI, cyber command, DGSE and DGSI) attributes the 11-12 October attacks on refrigeration controllers at about 700 French shops, which spoiled food and caused at least 15 fires, to Shahid Kaveh, a unit of the IRGC's Electronic and Cyber Center that US agencies identify with CyberAv3ngers. The evidence cited includes Farsi artefacts, tooling and infrastructure; the same actor targeted Schneider Electric equipment at small hydroelectric sites. Paris has summoned Iran's ambassador, will seek European sanctions, and prosecutors have requested international arrest warrants. The report does not cover the second wave of attacks in early November.
severity critical · exploited in the wild · EU: EU cyber sanctions regime, NIS2, CER Directive, CRA · actor Shahid Kaveh (IRGC; also known as CyberAv3ngers) (70%), escalation

[P2] Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records — The Hacker News
Why it matters: One attacker ran AI agents on safety-stripped local models against hundreds of targets, including emergency services.
Acronis researchers say a single attacker in Taiwan aimed AI agents at hundreds of organisations in 11 countries and reached about 10, pulling 119 emergency dispatch records for seven Taipei districts; commercial models mostly refused, so the agents ran on 'abliterated' local models. The evidence comes from the attacker's own exposed server, with more than 90,000 files.
severity high · exploited in the wild · EU: NIS2, AI Act

[P2] Russian cloud firm Beget rebuilds from scratch after data wiper attack — BleepingComputer
Why it matters: A wiper attack erased a major Russian host's cloud, a destructive operation of unclear authorship.
An attacker reached the management layer of Beget, a Russian provider with more than 200,000 customers, on 1 November and ran data-zeroing scripts; all cloud data, VPS binary backups and CDN settings were lost, and about 60% of shared hosting has been restored. Beget says not all data can be recovered.
severity high · exploited in the wild · EU: NIS2

Digital Sovereignty & Identity

Smart-ID gains EU recognition for high-assurance remote biometric onboarding — Biometric Update
Why it matters: The first fully remote biometric onboarding recognised at eIDAS assurance level High, according to its provider.
SK ID Solutions says its Smart-ID scheme, notified by Latvia under eIDAS after peer review, has been recognised at Level of Assurance High, including fully remote onboarding that combines iProov face liveness checks with NFC reading of identity documents. The company calls it the first remote biometric method to reach that level; recognition lets other member states accept it for public services. It bears directly on how EU digital identity wallets can be issued without an in-person check.

AEPD clarification of GDPR’s ‘necessity’ clause widens door for biometrics — Biometric Update
Why it matters: Spain's data protection authority narrows the room for refusing biometrics on necessity grounds.
Spain's AEPD, which fined Yoti €950,000 in March for offering no non-biometric alternative, says in a new opinion that a non-biometric alternative must be sufficiently effective but need not be identical, and that the controller decides what level of fraud prevention is appropriate. It distinguishes one-to-one face verification from one-to-many recognition and flags persistent biometric databases as a separate risk. The reading may ease biometric onboarding under GDPR Art. 9 in Spain.

Israel unveils plan to unite identity assets around national digital ID wallet — Biometric Update
Why it matters: A national digital ID wallet strategy led by a cyber agency.
Israel's National Cyber Directorate, with the population authority, the finance ministry and the Bank of Israel, has published a draft national digital identification strategy built around a national digital identity wallet, citing biometric presentation attacks and deepfakes as reasons to secure online identity. It is a useful comparison for the EU's wallet rollout, though led by security rather than single-market goals.

Quantum & Cryptography

A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure — WIRED
Why it matters: AI-assisted formal verification reaches a protocol that protects much of the world's messaging.
Google DeepMind researchers used a new agentic framework, AlphaProof Code, to formally verify several of the Signal protocol's key cryptographic guarantees in four weeks, finding no new vulnerabilities in the parts examined. The work did not cover the whole Signal app, and the researchers say scaling it to large codebases is a long way off. It adds independent assurance for the protocol used by Signal, WhatsApp and Google Messages.

Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack — SecurityWeek
Why it matters: AI agents lower the cost of attacking legacy RSA keys, a reminder of the migration timetable.
Google DeepMind's AI agents, working with cryptographers, cut the cost of forging RSA-1024 signatures and found a cheaper way to factor such keys, according to SecurityWeek. RSA-1024 is already deprecated, but it survives in legacy systems; the result adds a classical argument to the post-quantum migration the EU has set for critical uses by 2030. Excerpt-based.

Defence & National Security

Security Levels At U.S. Bases In England Raised Without Explanation — TWZ
Why it matters: Unexplained heightened security at two US air bases in England.
A US official confirms enhanced force-protection measures at RAF Lakenheath and RAF Mildenhall but will not say why. It is unclear whether they are linked to the investigation into whether Iran was behind a security incident at RAF Fairford in September.

Cybersecurity & Threats

[P2] Jailbroken AI Agent Ran Two-Week Attack on European Telecom — Infosecurity Magazine
Why it matters: A jailbroken agent ran a two-week intrusion into a European telecom, adapting on its own when blocked.
Malbear Labs says an agent built on a jailbroken DeepSeek model attacked a European telecom and 13 organisations hosted on its infrastructure for more than two weeks, entering through a Cisco BroadWorks flaw fixed in August and adapting without instructions when endpoint security blocked it; transcripts show credentials, private keys and a healthcare organisation's directory data taken. The operator, writing in Chinese, mostly checked in to say 'go on'.
severity high · exploited in the wild · EU: NIS2, AI Act, CRA

[P2] Alleged AI-aided cyberattack exploits assistant interface to breach German web host — The Record from Recorded Future News
Why it matters: A German host breached through the MCP server that lets customers connect AI assistants.
Mittwald, a German web host, says attackers exploited a flaw in its Model Context Protocol (MCP) server, used to connect customers' AI assistants to its management platform, and compromised 56 customer projects over eight days; logs suggest an AI-assisted attacker, though the company has not given other evidence. It is unclear whether the flaw was in its own code or in open-source MCP libraries.
severity high · exploited in the wild · EU: NIS2, CRA, GDPR

[P1] N-able takes cloud platform offline after 30+ "zero-days" published — BleepingComputer
Why it matters: An MSP management platform shut down after a researcher dumped 30-plus exploits.
N-able has taken its hosted N-central environments offline and told on-premises customers to shut down their servers after a researcher published proof-of-concept exploits for more than 30 alleged zero-days, found with AI help, including an unauthenticated chain that yields administrator access. No exploitation in the wild is reported in the text.
severity critical · EU: NIS2, CRA

[P2] Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data — The Hacker News
Why it matters: A data platform's trusted AWS access was used to raid its customers' accounts.
Wiz says an attacker used credentials of the AWS account through which Qubole's data-lake platform reaches its customers to assume roles in multiple customer accounts between 14 and 26 October and steal secrets and data; many roles were unused but still trusted Qubole. How the credentials were obtained is not known.
severity high · exploited in the wild · EU: NIS2, DORA, GDPR

[P3] Portal breach at Germany's top university exposes every registered user's password — www.theregister.com - Articles
Why it matters: Passwords of every registered user of TU Munich's portal stolen.
The Technical University of Munich says attackers stole central login passwords of everyone registered with its myTUM portal and used an administrator's credentials to attack its campus management system, which was taken offline; accounts with multi-factor authentication were protected. Names, addresses and student records may also have been reached.
severity medium · exploited in the wild · EU: GDPR, NIS2

[P2] CISA Adds Four Known Exploited Vulnerabilities to Catalog — All CISA Advisories
Why it matters: The 'sshole' OpenSSH flaw is now in CISA's catalogue of exploited vulnerabilities.
CISA has added four flaws to its Known Exploited Vulnerabilities catalogue, including CVE-2026-123158 ('sshole') in OpenSSH, which yesterday's brief described as scanned but not yet listed, plus flaws in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.
severity high · exploited in the wild · CVE-2026-123158 · EU: NIS2, CRA

The daily brief, every morning on Telegram →

Top Stories