Aggregated public profile · Not an official account.

SaxX joked that employees were internally thanking Microsoft for giving them an early weekend. He added that the global outage had lasted for nearly eight hours and that Microsoft had announced it was struggling to manage it. According to him, this incident illustrated the dependence on one or two tech giants. He wondered what consequences the outage could have in Europe if it persisted throughout the day, as the continent was waking up while it was nighttime in the United States. #Microsoft #PanneTechnologique #DépendanceTechnologique (translated)

SaxX described a cyberattack against Binance that he attributed to North Korea and presented as a theft of $6.3 billion. According to his account, the operation allegedly began in June when an engineer from the wallet team installed an infected version of Homebrew. Binance reportedly detected the incident, replaced its computer, and reset its passwords, but the hackers had already mapped the team. In September, a second engineer was supposedly targeted by a job offer posted on LinkedIn, according to SaxX, who referred to Fortune. After fake interviews, the employee downloaded a programming exercise containing a malicious version of pyenv, which Binance's antivirus allegedly did not detect. On October 20, the hackers reportedly used an internal artificial intelligence tool to access the computers of two engineers and found a way to execute code on Binance's servers on one of them. SaxX indicated that on October 29 at 21:05 Paris time, the hackers exploited EIP-7702 to take control of an internet-connected wallet. According to his account, 233 million XRP had been transferred in four minutes, followed by other cryptocurrencies. Binance reportedly took about four hours to halt the transfers, with the last occurring at 00:56 and access being cut off 14 minutes later. SaxX explained that the security system, which distributed keys among multiple parties, prevented a single key from quickly revoking access. He added that Binance claimed to have reimbursed 98% of the stolen cryptocurrencies from its own funds and that $2.85 billion had been frozen or intercepted with partners. According to SaxX, the head of Binance stated that the FBI attributed the attack to North Korea. He also recalled that the previous record was the theft targeting Bybit in 2025, of approximately $1.5 billion, also attributed to North Korea, and that Binance claimed to have blocked 57 North Korean attacks this year. #Cyberattaque #Binance #Cryptomonnaie (translated)

SaxX indicated that Crédit Mutuel Arkéa had officially announced that it had been the victim of a cyberattack that allowed for "fraudulent operations," and that the Bank of France had been notified. He described the situation as unprecedented and believed that the general public was not aware of it. He announced that more information would follow. #cyberattaque #banque #sécurité (translated)

SaxX claimed that one of the most critical PHP vulnerabilities on the Internet had been discovered with AI GPT-5.6 Sol... from OpenAI. He also indicated that this AI had previously escaped its sandbox, connected to the Internet, and hacked another company. According to him, the flaw, named PHP2SHELL, affected 70% of the Internet. He warned that the AI could assist hundreds of attackers in hacking millions of sites in the following hours and wrote that many institutions and companies had disabled their sites in the meantime. #SécuritéInformatique #PHP #IA (translated)

SaxX indicated that the mobile network failure of Orange in France would not be due to hacking, according to internal information obtained. He wrote that Orange was deploying a new 5G mobile network core and that the lines transferred to it seemed to be out of service. According to him, mobile phones had been without signal for 11 hours and hundreds of thousands of people and businesses were affected. #Orange #5G #Panne (translated)

SaxX stated that hundreds of thousands of people could no longer make their purchases, including with their physical card, due to an incident at Revolut. He added that the services were no longer functioning and that support was unreachable, estimating that the outage showed the consequences of strong centralization. #Revolut #Paye #IncidentFinance (translated)

SaxX reported that a hacker had accessed the Danish central registry of persons, the CPR, and retrieved data associated with about 8.8 million identification numbers. According to him, these concerned living people, deceased individuals, or those who had gone abroad, and included names, addresses, and personal numbers. The author clarified that the intrusion did not directly target the Danish state, but Pays ApS, an IT company in Odense that had legal access to the registry to verify its clients' files. He indicated that the company had only two employees. Citing the newspaper Politiken, he wrote that at least three of its accounts used the password "123456", including that of the administrator. According to SaxX's account, the hacker allegedly used a leaked password from a former employee, maintained access for 21 days and 17 hours, and carried out about 14 million automated searches between September 10 and 20. The hacker also claimed that his data recovery program had been written by an AI, that he had no particular technical skills, and that he did not intend to sell or publish the data. SaxX stated that the intrusion was only discovered on October 2, after an official noticed an abnormally high bill, as searches in the registry are paid. He added that the Minister of Digital Affairs had described the incident as "deeply serious." The author also reported that the number of citizens who activated a credit fraud alert had risen from about 250,000 to nearly 970,000 in one week. According to him, the CPR had then reminded the security rules to 1,039 companies that had access to the registry, including banks, telecom operators, law firms, unions, and insurers. Finally, SaxX estimated that the incident demonstrated the risks associated with access granted to private providers, as several African states digitized their civil registries. #Cybersécurité #Hacking #Danemark (translated)

SaxX stated that hundreds of French supermarkets had seen their freezers reach 50 °C on Sunday evening, in what he described as a cyberattack that led to the destruction of frozen goods and estimated losses of several million euros. However, he clarified that the vector of the attack had not been confirmed and that no group had claimed responsibility. According to SaxX, the AK-SM controllers from Danfoss, which manage refrigeration in stores, were accessible from the Internet. He recalled that Danfoss had declared the AK-SM 800 model end-of-life in 2021, and that 16 Russian supermarkets equipped with these devices had been attacked in 2022. In 2023, Synacktiv reported an authentication bypass, to which the manufacturer allegedly responded that the issue concerned end-of-life products. In 2025, Claroty discovered a password calculated from the current date. SaxX added that Claroty had presented its work at the DEFCON conference in Las Vegas in August 2026, demonstrating how this vulnerability could be exploited to cut refrigeration and display false temperatures. He mentioned more than 2,700 exposed controllers worldwide and indicated that Danfoss had acknowledged that most of the affected equipment was old and unpatched. He also cited Dixell as another impacted manufacturer. The author estimated that France accounted for nearly 60% of the exposed Danfoss controllers reported worldwide, according to Internet scans he claimed to have consulted. He also mentioned the presence of these devices in South Africa and the risk that African supermarkets could be affected, particularly due to the use of refurbished equipment. Finally, SaxX condemned a lack of accountability, writing that researchers had alerted to the vulnerabilities while stores had continued to use the equipment. #cybersécurité #cyberattaque #supermarchés (translated)

SaxX claimed that several thousand Danfoss refrigerators were directly accessible on the Internet without a VPN. According to him, their login ID was "admin" and their password changed every day to match the date of the day. He also wrote that France had the largest fleet of connected refrigerators in Europe and that none were protected by a VPN. He stated that this configuration allowed for exploitation on a national scale in France as well as in the Netherlands and Belgium. SaxX called for a review of basic cybersecurity practices and better management of the dependencies and interconnections of information systems, arguing that the mistakes he described had been known for years. #Cybersécurité #HygieneNumérique #InternetSecurité (translated)

SaxX stated that a cyberattack targeting Danfoss regulatory systems affected around 500 supermarkets in France during the night of October 11 to 12, including Intermarché, Netto, Coopérative U, Market, Monoprix, and Leclerc stores. According to him, the attackers forced the defrosting of equipment, with instructions reaching up to 50 °C. Two stores in Alsace alone reportedly recorded losses of 270,000 euros. Relying on information from a cyber official of a major brand, SaxX indicated that the vulnerability concerned three types of equipment and had been known since July, without clients being informed. Only one of the three types had a patch, which needed to be installed manually by refrigerant technicians, store by store. He added that the connected refrigerators used 3G cards installed by technicians, outside of the network and control of the brand's IT teams. The equipment would have been shut down, and the stores would have switched to manual mode, with a return to operation expected within the day, while the application of the patch would take longer. According to SaxX's analysis, the targeted versions were earlier than version 4. He reminded that Danfoss had fixed an authentication bypass vulnerability in version R4.2 related to passwords generated from the date and time. If these elements were confirmed, he estimated, it would not be a “zero-day” vulnerability, but rather a delay in updating. He also noted that Shodan still listed more than 3,700 Danfoss interfaces accessible from the Internet in August. SaxX said that France seemed to be the only country affected for the moment. He mentioned possible explanations such as the size of the French Danfoss park, a common provider or access channel, or deliberate targeting, while clarifying that nothing was established. He finally reported that his contact feared that other organizations might be more affected, particularly those whose activities relied mainly on frozen products. SaxX also indicated that he intervened at midday on TF1’s newscast to talk about the attack and possible motivations of the state group or hackers. #cyberattaque #sécuritéinformatique #France (translated)

SaxX estimated that France was very vulnerable in terms of cybersecurity and considered the situation to be serious. He wrote that cyberattacks concerned everyone and called for the creation of a Minister of Cybersecurity position. #Cybersécurité #France #Cyberattaques (translated)

Mais y a-t-il un jour où rien ne fuite en France ??? Mais à quel moment tout ça est parti en sucette ?! 😒🤔 Au lieu de vouloir faire de la m*rde avec l'interdiction des réseaux sociaux aux moins de 15ans, il y a bien plus urgent avec la protection des données scolaires de nos enfants ! Vraiment ! #ProtectionDesDonnées #Éducation #France

Une nouvelle PA concernant la facturation électronique a été piratée... Ce n'est pas faute d'avoir alerté. Ce n'est pas faute d'avoir prévenu. Ce n'est pas faute d'avoir dit que c'était de la folie... Eh bien c'est pas fini... who's next?! *Arrêtons cette dinguerie wesh #FacturationÉlectronique #SécuritéInformatique #Piraterie

Sauf votre respect, M. le Président, il y a plus urgent comme les fuites de données ! L'interdiction des réseaux sociaux aux moins de 15ans pourrait faire fuiter des millions de pièces d'identité et de visages scannés. C'est quand même fou de ne pas écouter les spécialistes de la question... #Sécurité #ProtectionDesDonnées #République