LinkedIn Carousel - #CyberWeekly Week 45

Warned Three Weeks Ago. 60,000 Euro Of Food Lost On Monday.

Belgian shop freezers switched to defrost from the internet. The fix had been out for a year.

Pluxee: cardholder data, your inbox

ECP: connect Claude or ChatGPT

For your IT partner: four fixes

Easy Cyber Protection

Your to-do list

This week's cyber to-do list

For you

Ask your cooling or building installer, in writing, for a dated line: "the controller cannot be reached from the public internet and runs the current firmware". No written line means assume it can be reached. Today.
Write down who gets the temperature alarm at 3 a.m., by which route, and whether that person can switch the system to manual. Today.
Call your insurer: is stock lost because someone changed a setting from outside covered, and under which policy? Get the answer in writing. This week.
Tell staff: no mail, text or call about their Pluxee card gets a PIN, password or card number. Put a second login step on the account that manages the vouchers for your company. Today.

For your IT partner

Forward this list. Ask for Done, Not applicable or a date on each line.

Cooling, heating and access controllers in every client building: check from a public address whether the web page answers. If it does, VPN or internal network only tonight, then current firmware (Danfoss AK-SM 800A: CVE-2025-41450 and CVE-2025-41451, Strict mode; Copeland xweb; Dixell). Now.
WordPress: 7.1.4 on every site, including the ones on auto-update, and check that the update landed (CVE-2026-119977, remote code execution without login, exploited, CISA deadline 6 November). Now.
Cisco Secure Firewall ASA/FTD with SSL VPN and secondary authentication: the fixed release of your line (CVE-2026-76418, exploited; CISA deadline was 1 November). No fix yet: disable the secondary authentication. Now.
Macs still on macOS Ventura or older: onto a supported macOS, or at least Safari 17.5 (CVE-2024-27834, on CISA's exploited list since 4 November, deadline 18 November). This week.
Employer accounts at Pluxee: second login step, and a flag on inbound mail naming Pluxee from outside pluxee.be. Today.

1/5

Warned three weeks ago. 60,000 euro of food gone on Monday.

Why this one is different from week 42.

Belgian shops lost their freezers to a hacker, three weeks after the warning. Non-IT Get a written, dated line from your installer that the controller is off the internet and updated; name who answers the 3 a.m. alarm. IT Building controllers: not reachable from the internet, then firmware.
Pluxee, the meal-voucher company, found an intruder on a server. Non-IT Nobody gets a PIN or password over mail, text or phone; second login step on the employer account.
Four flaws hackers already use. IT WordPress core and Cisco VPN now; Ivanti again; old Macs this week.

VRT NWS liveblog: supermarkets and butchers hit by a cyberattack on their cooling (2-4 Nov 2026) → https://www.vrt.be/vrtnws/nl/liveblog/getroffen-supermarkten-van-delhaize-draaien-zoals-normaal-na-hac~1793610043244/

2/5

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: I was not in the freezer aisle on Monday. I read the liveblog like everyone else, and then I read the CCB warning of 14 October again.

3/5

Pluxee found an intruder. Your card still works. Your inbox is the target.

And the tax office, one week on.

What Pluxee told cardholders on Wednesday: stay alert for unexpected emails, text messages or phone calls, and "Pluxee will never ask you to share your PIN code or password".
Why it is your problem: meal-voucher cards sit in a lot of Belgian wallets, so there is a fair chance some of your staff are on that list. The address file of a benefits company is a phishing list with the employer's name attached.
Who gets the sharpest message: the person who orders the vouchers for your company. They hold a login to the employer portal, and a mail saying "your order could not be processed, log in here" lands on the busiest day of the month.

VRT NWS: possible data leak at Pluxee, names and contact details of cardholders (4 Nov 2026) → https://www.vrt.be/vrtnws/nl/2026/11/04/mogelijk-datalek-bij-pluxee-namen-en-contactgegevens-van-kaarth/

4/5

Ask Claude or ChatGPT about your own compliance file

New here?

It reads before it writes. Every app first sends you to an ECP approval page. The AI can fill one field, after you approve the exact value. It never publishes anything. A bigger change becomes a draft for a person to approve. Disconnect in one click, in the same settings page.
Six free templates for IT partners. An incident response plan, a tabletop exercise kit with three scenarios, a supplier security questionnaire, an acceptable use policy, a board memo on NIS2 and CyFun, and the CyFun Basic evidence checklist. English, Dutch and French, behind the same email form as the other downloads.
Also this week: every gap in the register now names the risk behind it, and Google Workspace users and devices land in the account register by themselves. The rest is in the changelog.

See everything that shipped → https://easycyberprotection.com/changelog/

5/5

For your IT partner

Not in IT?

Cooling, heating and access controllers (Danfoss, Copeland, Dixell)Flaw: Danfoss AK-SM 800A, CVE-2025-41450 and CVE-2025-41451, authentication bypass, used this week against Belgian shops; Copeland xweb controllers also targeted.Fix: not reachable from the public internet (VPN or internal network only), then current firmware, Danfoss "Strict" mode. The CCB says a factory reset is not enough while the device stays reachable.Do by: tonight.Who checks: IT, from a public address, in every client building with a cold room, a heating system or badge doors.
WordPress coreFlaw: CVE-2026-119977, race condition in the full-package core upgrade, remote code execution without login, exploited.Fix: WordPress 7.1.4, released 28 October, backported to every line down to 4.7. Auto-updates are rolling out. Open the dashboard of each site and read the version number, do not assume.Do by: now. CISA says 6 November.Who checks: IT or the agency that runs the site.
Cisco Secure Firewall ASA and FTDFlaw: CVE-2026-76418, CVSS 8.6, denial of service, exploited since October according to Cisco. Only firewalls with SSL VPN and secondary authentication in the tunnel group.Fix: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 or 9.24.1.27; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1. No workaround; until then, disable the secondary authentication.Do by: now. CISA's deadline was 1 November.Who checks: IT.
Apple Safari and WebKit on older MacsFlaw: CVE-2024-27834, on CISA's exploited list since 4 November.Fix: Safari 17.5, released May 2024 for macOS Monterey and Ventura. A Mac that never got it is on an unsupported system; move it to a supported macOS.Do by: this week. CISA says 18 November.Who checks: IT, on every Mac in the inventory still on Monterey or Ventura.

CISA Known Exploited Vulnerabilities catalog: CVE-2026-76418, CVE-2026-111357, CVE-2026-118527, CVE-2026-119977, CVE-2024-27834 (added 29 Oct to 4 Nov 2026) → https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Read the full issue

5 stories. Context that matters.
Belgian cybersecurity, weekly.

Scan to read online

https://easycyberprotection.com/cyberweekly/2026/week-45

Follow #CyberWeekly

easycyberprotection.com