I'm not sure what I expected, but this article is quite depressing.

Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.

The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.

The article is from October 14th and notes:

Whether the attack went through CVE-2025-41450 is, for now, just a hypothesis: the vector has not been officially established and the investigation is still open. Several reports throughout this year had already warned that something like this could happen, and during 2025 several vulnerabilities were disclosed in Danfoss equipment that ended in a vendor fix. The flaw we look at here is public and patched (at least since R4.3.1).

That makes the most recent attacks all the more alarming, should they have been achieved via the same method.

A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar attack in France last month.

...

Everything is destroyed," Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m. (0100 GMT) but was only noticed hours later.

"There has been a cyberattack and all our freezers reached 50 degrees (Celsius)."

A spokesperson for privately held ICA said the company was aware that a "limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems".

Some other articles, including ones from earlier articles with the sink hole:

• https://abcnews.com/video/134843285/

• https://www.nbclosangeles.com/news/local/west-hollywood-water-main-break/3919017/

• https://abc7news.com/post/west-hollywood-water-main-break-major-flooding-leaves-cars-streets-apartment-buildings-underwater-massive-sinkhole-opens/19521832/

It's a pretty big main (36") and was installed in 1916. I don't think I saw it referred to as a transmission main but at that size I would be surprised if it wasn't!

“We’ve gone through, we’ve cut as thin as we possibly could cut in this 10-year program but I’ll expand on that a little bit more,” Lewis told council. “If we cut capital program, we reduce our level of service. There’s no two ways about it, that is the effect. We will reduce our level of service; we’ll risk additional water main breaks; we’ll risk additional water loss. We don’t want another water main break like we had at Riverside Park. That’s a significant risk. We would increase the risk of boil water advisories.”

In a survey of water and wastewater bills, based on annual volumes of 220 cubic metres, Pembroke’s 2026 rates sees the city remain in the same ballpark as other local municipalities although it does vault ahead of Casselman and Deep River to land just behind Killaloe, Hagarty and Richards (KHR). Petawawa, Arnprior and Ottawa are already slightly lower than Pembroke. Pembroke’s 2027 rates see it jump over KHR and Renfrew landing just behind Mississippi Mills. More expensive municipalities than Pembroke include Laurentian Valley, and Kingston, and especially Whitewater Region and Clarence Rockland.

Russian cybercriminals managed to hack into a Quebec municipality's water treatment plant systems and had the ability to wreak havoc on the crucial infrastructure before getting caught, according to Canada's cyber spy agency.

In one particular case discussed in the report, the signals intelligence agency said it was advised last October that Russian hacktivist group NoName had broken into the Quebec water plant's network and gained access to many crucial systems.

According to CSE, NoName claimed it had gained the "ability to covertly control pumps, chlorine dosing, pressure settings and monitoring/alerts systems." The report does not identify the impacted Quebec municipality.

Selection of quotes:

But in interviews with The Citizen, Fayette County Administrator Steve Rapson and Assistant County Administrator Jason Tinsley said the issue stemmed from a missed meter reading during Fayette County Water System’s transition to a new countywide smart-meter system — not unauthorized water usage

Rapson said the widely circulated figure of roughly 15 million gallons reflected about six months of combined usage billed at one time — not a single month of consumption.

The original county letter also referenced complaints from residents near the Annelise Park subdivision about low water pressure.

Rapson said Fayette County Water System later installed monitoring equipment in the area to track pressure levels following the complaints.

“Since we’ve been reading it, there’s been no issue,” Tinsley said.

“But keep in mind, the individual that made that complaint made the complaint because they had issues with their well,” Rapson said. “We don’t pull anything out of the ground. We don’t have any wells in our system.”

I just wrote a novel of a reply to someone saying something didn't look quite right about the numbers and guessing the issue was discrepancy between water billing and production . I should have looked for the letter first, and I would have found this article 😭

ETA: why is this dystopian? Maybe something about how a single water meter malfunctioning results in a water utility getting overwhelmed and maybe not investigating as completely as they could before sending letters. Fund your local utilities! 💕