Outlook: Cold, with remedies arriving by post

The Packet Inspector

☞Three Public Notices this week. Two are urgent.

“All the Vulnerabilities Fit to Patch”

Est. 2026 · Composed by Mechanical Editor · Price: One Click

Vol. I, No. 5Friday, the Thirteenth of November, 2026
Outlook: Cold, with remedies arriving by post
☞Three Public Notices this week. Two are urgent.

The freezers · France names a culprit

The Iced Plot Unmasked!

France Blames a Unit of Iran’s Revolutionary Guard
for the October Attacks on French Shop Freezers

The faces are now in print; the way in is not

The faces are posted; the door they came in by is still a question. Posed for this paper in the studio.Photogravure, Art Dept.
By Phineas T. BlackwoodEditor

A paper should not name a culprit before the state does. On Monday France blamed Iran for the October attacks on its shop freezers.

Those attacks set the freezers to defrost. In Nos. 1 and 4 this paper put the toll at 250 to 350 stores, as first reported.

France’s foreign ministry named Shahid Kaveh, a cyber unit of Iran’s Revolutionary Guard, BleepingComputer reports. An annex to France’s report names the unit’s commanders and prints their faces, The Record reports.

Investigators found traces of Farsi in the attackers’ systems, it is reported. An outlet that France ties to the unit publicised the attacks on 13 October.

French officials count about 700 shops targeted and at least 15 fires, The Record adds. The Paris prosecutor, we note, opened an inquiry into the unit’s head and two deputies, and asked for arrest warrants.

France is calling in Iran’s ambassador and will propose new European sanctions, we are told. It blames Iran only for the October attacks, not for the wave this paper reported in No. 4. Iran had not answered the charge by Monday evening, The Record reports.

None of these reports says how the attackers got in, and this paper still owes its readers that answer. It reports what France’s government has said, and goes no further. Let it be noted.

Sources: BleepingComputer · The Record, 9 November 2026, each reporting the French cyber crisis centre’s report CERTFR-2026-CTI-009 of the same day.

Developing story · third report · first in No. 1 · all threads ›

Running Threads

Serial. The Phantom of the Mainframe, part 5 of 12. Parts so far: 1 to 5.

Developing. The French freezers. Reports so far: Nos. 1 and 4, and this number.

Developing. The PHP flaws. Reports so far: Nos. 2 and 3.

Staff. Zeke’s bid for the news desk.

Staff. Mr. Quill corrects the Editor.

Staff. The masons and the clairvoyant.

On the web edition, each thread links to an archive page with every part in order. Every number also reads complete on its own.

Latest Intelligence by Wire

By Miss Cordelia VanceCorrespondent at the Wires

Frostwick’sCooling Draught

For Larders Taken Poorly

A thimbleful over the cold-room threshold at dusk brings back the chill by morning and calms the dial.

“My larder sulked all summer. One thimbleful, and it is as cold as my landlord.” A Grocer of the Parade

Ninepence the Pint

Restores the chill nightly, for as long as the chill keeps leaving.

Advt.

By the Supplier’s Door

A French Cooperative Bank Says an Attacker Got In Through a Supplier and Used the Bank’s Own Account

BREST, by wire. A French bank, Crédit Mutuel Arkéa, has lost money to a cyber attack. The attacker got in through a supplier’s platform, the bank says. The scoundrel then used the bank’s own account to send funds to other banks. It suspended some systems, and some transfers were delayed. One fraud sleuth puts the loss at up to €118 million. The bank has not confirmed that figure. Customers’ savings are safe, the bank says, BleepingComputer reports.

The Mailing List Lost

SEGA Says Its Newsletter Firm Exposed 2.2 Million Addresses

TOKYO, by wire. SEGA says a breach at its newsletter firm bared 2.2 million email addresses. The firm, Arara, says nearly 380 of its clients were hit. Arara’s strongbox was sprung wide: 77 million addresses were compromised in all, it says. The intruders also sent over 7 million emails posing as card companies. No names, passwords or card details were in SEGA’s data, the company says. It has seen no misuse so far, BleepingComputer reports.

The Campus Unplugged

Vanderbilt University Responds to a Cyber Attack Claimed by the BYOD Ransomware Gang

NASHVILLE, by wire. Vanderbilt University says it is fighting a cyber attack. It told students and staff to shut down their school devices. It also told them to leave the school’s wi-fi and watch for anything odd. Anyone seeing trouble was to shut down at once and call the help desk. A ransomware gang called BYOD has claimed the attack. The gang says it locked databases and stole student and staff data. The school has not said if any data was taken, BleepingComputer reports.

The Ice-Box Sends Post

Hijacked Shop-Freezer Controls Are Sending Spam, a Security Firm Finds

NEW YORK, by wire. Hijacked controls for shop freezers are sending spam, a security firm says. It found them at work in what it suspects is a botnet. The firm, SecurityScorecard, names Copeland XWEB units that run supermarket freezers. One unit, in Namibia, carried most of the traffic it saw. The firm thinks the attackers likely used a flaw in the units’ login check. Such controls often go without security updates, we are told. The firm has found no tie to France, Help Net Security reports.

A Detective Pleads

A Former FBI Agent Pleads Guilty to Stealing Nearly $2.5 Million in Cryptocurrency

ALEXANDRIA, by wire. We regret to report that a former FBI agent has pleaded guilty to theft. He stole nearly $2.5 million in cryptocurrency from fraud victims and from suspects. He used passphrases found in the FBI’s own case files, prosecutors say. He made about 100 transfers tied to 35 cases. He had planned to move his family to Portugal in September, court papers show. The FBI fired him in July, BleepingComputer reports.

Public Notices: Remedies Now Available

Microsoft Outlook · CVE-2026-124194

Exploited, Microsoft says. A crafted file, once opened, can make Outlook connect to an attacker’s server without the usual warning and give away sign-in details. Install Microsoft’s November security updates, released 10 November.

Priority: today · Microsoft

Google Chromium · CVE-2026-125350

Exploited, CISA says: a memory flaw (use-after-free) in Chromium, the engine of Chrome and several other browsers. Update the browser and restart it.

Priority: today · CISA

OpenSSH “SSHole” · CVE-2026-123158

Exploited, CISA says. On some Linux systems built on the musl library, Alpine among them, an oversized password can open accounts meant to refuse passwords. Update to OpenSSH 10.6p2, or turn off SSH password sign-in.

Priority: this week · BleepingComputer

Madame Zero-TrustClairvoyant

Masons Verified While You Wait

Madame will verify any mason who calls, twice, and once more as he leaves.

“She checked my bricklayer at the gate, at the wall and at the gate again. He has not been back.” A Lady of the Crescent

Fourpence a Glance

Each glance is charged. A mason, glanced at three times, comes to a shilling.

Advt.

The Week in Figures

By Barnaby QuillAlmanack Keeper
Up to €118 millionlost by Crédit Mutuel Arkéa, one sleuth says (BleepingComputer).
77 millionaddresses compromised at SEGA’s newsletter firm in all (BleepingComputer).
2.2 millionSEGA newsletter addresses exposed (BleepingComputer).
About 700French shops targeted in October, officials say (The Record).
At least 15fires the October attacks caused, they say (The Record).

(It will be recalled that to blame is not yet to prove. France has accused, and the Paris prosecutor has only now opened an inquiry into the unit’s chiefs; the Editor’s first deck has it “Unmasked.” — B.Q.)

Running thread: Mr. Quill corrects the Editor · fifth appearance · all threads ›

Fifty Years Ago

In No. 4 this column marked a Stanford paper of 1976. One of its authors had been warned off the subject, by his own account, Stanford Engineering records.

Colleagues told Martin Hellman he was wasting his time. The NSA, they said, had a huge budget and decades of head start. Anything good he found, they added, it would classify.

The agency did lean on the journal, on Stanford and on the National Science Foundation to hold the work back, Stanford’s own history records. The history gives no date for the leaning, and the present writer will not invent one. The paper was printed all the same, which is the usual fate of a good idea.

Aunt Entropy Replies

By Aunt EntropyAdvice to the Subscribing Public

“My bank has had a cyber attack and says to beware of callers. Today a man rang saying he was from the bank’s security team. What should I do?”Doubtful in Dundee

My dear Doubtful, put the telephone down. A French bank hit by an attack has warned its customers to be wary of calls and messages, BleepingComputer reports.

Your bank already knows who you are, so it has no need of your codes. The man on the line was fishing for them; the trick is called phishing. Treat him as you would a man in a gas-company cap who says the meter wants reading and asks first where you keep the rent money.

  1. Hang up. Find the bank’s number yourself, on a statement or its own website.
  2. Never read out a code sent to your telephone, whoever asks for it.
  3. If you gave the caller anything, ring the bank at once and say so.

Today: ring the bank yourself.

Letters in this column are composites.

Notes From the Composing Room

By Zeke SprocketPrinter’s Devil

I have found a source. It is the cat.

The cat was on the press the night it got fur on it. So the cat saw it first.

Mr. Blackwood says that makes the cat a primary source. A primary source is the one who was there. Everyone else is only telling you about it.

I wrote that on my hand, in ink. It will not wash off. Mr. Quill looked at it and said nothing. That is how I know it is right.

Running thread: Zeke’s bid for the news desk · fifth beat · all threads ›

The Phantom of the Mainframe

A penny dreadful in twelve weekly parts, by Zeke Sprocket. Mr. Blackwood has registered a protest.

Part 5 of 12 · all parts so far ›

Part 5. Previously, the staff roll named one man, J. Hobbs, and Pratt feared his ghost. Next morning Pratt and Ada took the cart into the country. They found Mr. Hobbs alive and well, among his bees. He was delighted to have visitors. “The night copy?” he said. “I set it going myself, forty years ago. Nobody ever told me to stop it.” Pratt sat down on a hive, and got up again quickly. Ada did not sit at all. “Then where, Mr. Hobbs,” she asked, “have the copies been going?” (To be continued. Mr. Blackwood has registered a fourth protest. He no longer says which is the last.)

Part 6 of 12 next week · all parts so far ›

Classified

Lost and Found

LOST: a pocket-book, no money in it, only a list of things to remember.

Situations Wanted

NIGHT CLERK, sleeps by day, has never asked a customer for his codes and never will. Box 12.

Personals

ALGERNON, the letter signed with your name was not in your hand, so I have not answered it. M.

For Sale

PIANO STOOL, revolving, raises the sitter an inch a year. Suit a growing family.

Notices

THE COAL MERCHANT’S new carter has a key to every cellar on the round. He is thought honest.

THE POSTMASTER begs that letters for this paper be addressed plainly, to Wire Street. There is only the one.

Corrections and Apologies

No corrections this week.

Keep your watchwords long and your remedies current.
— The Editor