Good morning!

DigiCert only confirmed in October that an exposed internal system had let outsiders read archived customer records, including identity documents. Researchers traced a phone espionage campaign to hijacked and spoofed websites. On Thursday, US agencies told operators to secure cooling controllers before attackers force them into heating cycles.

Here are the 5 things you don't want to miss:

1. 🔒 DigiCert breach exposed passports and licenses left readable online

DigiCert says a February 2025 server migration exposed an internal system to the internet, letting outsiders register accounts and read archived customer data. On 19 October it confirmed an unauthorized account read customer information between 27 June and 2 July 2026. Records include names, business contacts and, for some, driver's licenses, passports and utility bills. Certificate services were not hit. DigiCert still has not said how many customers are affected. (BleepingComputer)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 📱 APT29 reached phones through real, spoofed and hijacked sites, Sekoia says

Sekoia attributed a phone espionage campaign to APT29, the group also known as Cozy Bear. It planted code on legitimate sites, spoofed America250 and the Raffles London hotel, and compromised Plerdy, a Ukrainian web analytics service. Between late August and early September the injected script could reach visitors of hundreds of sites, including Ukrainian military and drone makers. The attacks used already-patched flaws. Patch your phones; the flaws used here are already fixed. (The Record)

4. 🧊 Feds tell operators to secure cooling controllers after European fridge hacks

CISA and the FBI told critical infrastructure operators Thursday to secure cooling controllers after European supermarkets had refrigerators remotely forced to raise temperatures. This week, controls were also tampered with at three of France's national blood banks, though links are unclear. The advisory warns unpatched, internet-accessible controllers can be forced into continuous heating and defrost cycles, causing inventory loss and equipment hazards. Check which cooling controllers sit on the internet, then patch or isolate them. (The Record)

5. 🛠 OpenSSH flaw lets attackers into password-disabled accounts on Alpine systems

A password verification flaw in OpenSSH, disclosed Thursday, lets attackers log into accounts set to block password logins on Alpine Linux, OpenWrt, Buildroot and Yocto — systems using the musl C library with PAM disabled. It dates to a 2016 patch and is fixed in OpenSSH 10.6p2. Alpine's official AWS and Azure images ship an affected default account that can reach root. Turn off SSH password auth on musl systems until you can patch. (BleepingComputer)

6. ⚖️ Meta, TikTok and Google sue California over kids online safety law

Meta, TikTok and Google filed three coordinated lawsuits in federal court Wednesday against California, seeking to block Assembly Bill 1709 before it takes effect on 1 January. The law bars platforms from deploying features deemed "psychologically exploitative" for children 15 and under. The companies say it violates free speech and conflicts with Section 230; Attorney General Rob Bonta says the state will defend it. If your product serves California children, audit features before 1 January. (The Record)