TechKnowvia
News & Security

The October 2026 Hacks: From PHP to Binance to Europe's Supermarket Fridges

October 2026 was one of the strangest months in cybersecurity: a critical PHP flaw, a record $6.3B Binance hack, and hackers cooking Europe's supermarket fridges. Here's what connects them.

Last updated 6 min read

In a single month, hackers broke a piece of software that quietly runs a huge slice of the internet, pulled off the largest cryptocurrency theft in history, and made supermarket refrigerators across Europe cook themselves. October 2026 wasn't a normal month in cybersecurity. It was a vivid, almost cinematic reminder that "getting hacked" no longer means just your email, it can mean your code, your money, and your groceries. Here's what happened, and what quietly connects all three.

Not professional advice: This article is for general information only and is not investment, financial, or security advice. Rules and products change and vary by country and situation. Confirm details with the official source and consult a qualified professional before making decisions.

Last checked: November 2, 2026. These are developing stories; confirm the latest details with the official sources linked below.

Act one: the bug in the internet's plumbing (PHP2Shell)

Start with the least visible but arguably most far-reaching. PHP is a programming language that runs behind an enormous portion of the web, everything from small blogs to large platforms. In late October, security researchers disclosed two critical flaws in PHP itself, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a severity score of 9.2 out of 10.

Why that's frightening: the flaws allow unauthenticated remote code execution. In plain terms, an attacker could potentially run their own commands on a vulnerable server without logging in and without needing a bug in the website's own code. The PHP project shipped emergency patches on October 21, 2026 (in the PHP 8.5 line), but the details leaked ahead of the fix, and attackers began probing almost immediately.

National authorities moved fast. CISA in the United States urged organizations to patch immediately, and EU-CERT issued its own advisory. Security firms reported that tens of millions of PHP instances were potentially exposed, and that real attacks had already rooted some internet-facing systems (notably certain management interfaces), even as exploitation against ordinary setups proved harder than feared.

What it means: if you run anything on PHP, patching to a fixed version was the urgent job. If you're just a user of the web, this one is a reminder that the ground beneath the sites you use is software too, and it needs maintaining.

Act two: the $6.3 billion heist (Binance)

Then came the headline even non-techies noticed. On October 29, 2026, the cryptocurrency exchange Binance reported that its hot wallets were compromised, with an estimated ~$6.3 billion in assets affected, described by multiple outlets as the largest crypto theft on record. The FBI attributed the attack to North Korea, and blockchain analytics firms including Chainalysis and TRM Labs reached consistent conclusions.

Binance said it would cover the losses from company funds and, within days, began restoring withdrawals, with a significant portion of the stolen assets reportedly frozen by industry partners. We covered the practical fallout, and what anyone holding crypto should do, in our dedicated explainer on the Binance hack.

What it means: money itself is now a software target at massive scale. For individuals, the lesson is unglamorous but vital: secure your accounts, and don't keep more on any exchange than you need to.

Act three: the hackers who cooked the fridges (Europe's supermarkets)

And then the story turned genuinely surreal. Starting overnight on October 11-12, 2026, an unknown party reached into the refrigeration systems of hundreds of French supermarkets, up to 700 stores across chains like Carrefour and Intermarché, and switched them into defrost mode. Freezers warmed, stock spoiled, and reporting described damage running into the millions, with some incidents even linked to fires.

Weeks later, on the night of November 1-2, 2026, it happened again, this time across at least seven countries, Belgium, Sweden, Ireland, the Netherlands, Luxembourg, Estonia, and Finland. The Guardian and NBC News reported fridge and freezer temperatures soaring as high as 50°C (122°F), with chains including Delhaize, Coop, and others forced to bin chilled and frozen food. One store manager's blunt summary, quoted in the press, captured it: "everything is destroyed."

How do you hack a fridge? Modern commercial refrigerators are connected to the internet through remote-management systems so staff can monitor temperatures centrally. When those systems are exposed or weakly secured, an attacker can send commands, like "defrost", from anywhere, without setting foot in the store. It's a textbook case of the risks in operational technology (OT): the quiet, connected machinery running the physical world.

What it means: the attack surface isn't just screens anymore. It's the devices humming in the background of daily life, and the businesses that run them.

What actually connects the three

There's no public evidence that the same group was behind all three, and we won't pretend otherwise. What connects them is more interesting than a shared culprit:

  • Software (PHP2Shell): the code the internet is built on.
  • Finance (Binance): money as pure software.
  • Physical world (the fridges): everyday infrastructure, now online.

In one month, attackers demonstrated reach across all three. That's the real story of October 2026: the line between "cyber" and "physical" has effectively dissolved. A flaw in a programming language, a raid on a crypto exchange, and a defrosted freezer aisle are now part of the same conversation.

What everyone should take from it

You don't need to run a supermarket or a crypto exchange for this to matter. The defenses that count are the same ones we always come back to, and they work:

Pros

  • Patch and update everything, promptly, the PHP flaw was fixable before most damage
  • Use strong, unique passwords with two-factor authentication on money and email
  • Keep only what you need on exchanges and online accounts
  • Secure connected devices, not just computers and phones
  • Back up important data so an attack is a setback, not a catastrophe

Cons

  • Ignoring updates because 'it still works'
  • Reusing passwords across accounts
  • Assuming 'that device isn't a computer' about anything connected to the internet
  • Treating security as someone else's job

If you want a concrete starting point, our freelancer cybersecurity checklist walks through the essentials in order, and our guide to securing your payment accounts covers the money side, two-factor authentication, passkeys, and hardware keys.

Our verdict

Sources

  • CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" — 2026-10-21 link
  • EU-CERT, "Critical Vulnerabilities in PHP (2026-018)" — 2026-10-20 link
  • The Hacker News, "Attackers Exploit PHP2Shell Flaws" — 2026-10 link
  • The Guardian, "Who is hacking Europe's supermarket fridges, and why?" — 2026-11-02 link
  • NBC News, "European supermarkets hit by new fridge cyberattack" — 2026-11-02 link
  • Forbes, "New Wave Of Refrigerator Cyberattacks Roils European Supermarkets" — 2026-11-02
  • ABC News / FBI statement, "FBI attributes Binance breach to North Korea" — 2026-10-31

Frequently asked questions

Are the three October 2026 attacks connected?

There is no public evidence that the PHP flaw, the Binance hack, and the supermarket fridge attacks were carried out by the same people or coordinated. What links them is timing and a theme: within a few weeks, attackers hit software, money, and physical infrastructure, showing how broad the modern attack surface has become.

What is PHP2Shell and should I worry?

PHP2Shell refers to two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. If you run a website or server on PHP, you should make sure it has been updated to a patched version. If you only use websites as a visitor, the main action is good account hygiene.

Was money actually stolen from Binance customers?

Binance reported that its hot wallets were compromised and said it would cover the losses from company funds, with a large share of assets frozen by partners. Always confirm the current status on Binance's official announcements, as the situation has been developing.

How do you hack a refrigerator?

Modern commercial fridges are connected to the internet through remote management systems so staff can monitor temperatures. If those systems are exposed or poorly secured, an attacker can send commands, such as switching units into defrost mode, without ever entering the building. It is a textbook example of the risks of connected 'operational technology.'

What's the lesson for everyday people and small businesses?

The attack surface now spans software, finance, and physical devices. The defenses that matter most haven't changed: keep systems updated and patched, use strong unique passwords with two-factor authentication, and secure anything connected to the internet, including devices you might not think of as computers.

Related reading