Loading story…
A faulty firmware update delivered through Samsung's SmartThings platform caused some Bespoke AI refrigerators in South Korea to lose power, go offline, and stop cooling. The reports primarily involve four-door models manufactured from 2024 onward; affected units displayed an update-related SmartThings message or became unreachable in the app, with some losing both refrigeration and freezer functions and prompting owners to discard spoiled food.
Samsung halted distribution of the update after reports emerged and attributed the incident to an error in software-update testing. The company directed customers to support and emergency repair channels, but the outage coincided with the Chuseok holiday, constraining service availability and reportedly leaving some customers facing repairs no earlier than October. Samsung has not disclosed the number of affected devices, whether deployments outside South Korea were impacted, or measures to prevent recurrence.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Samsung stopped rolling out the problematic firmware after affected owners submitted hundreds of support complaints. The company confirmed the issue on its official forum and directed affected customers to support and emergency service channels.
Samsung stated that a software-update testing error caused power and display-operation problems on some Bespoke AI refrigerators in South Korea. Reports began among primarily four-door models manufactured in 2024 or later after updates through SmartThings, with some units losing refrigeration and freezer capability and spoiling food.
Samsung said it would restore all affected refrigerators, provide emergency on-site service for urgent refrigerator or freezer failures, and review possible compensation for customers whose food spoiled. The company’s response followed reports that some technician visits would be delayed until October.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcexakep.ru
Open sourcearstechnica.com
Open sourcestarnewskorea.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung released its August 2026 Security Maintenance Release for Galaxy smartphones and tablets, patching **56 vulnerabilities** across supported devices running Android 14, 15, and 16. The update incorporates **38 fixes** from Google’s August Android Security Bulletin and **18 Samsung-specific patches** affecting One UI and Galaxy software, with Google’s share including **eight critical** and **30 high-severity** issues. Samsung said the device-specific fixes address components including **SemClipboardService**, **Samsung Contacts**, **Dialer**, **Messages**, **Galaxy Themes**, **AppLock**, media codecs, and the **Weaver** hardware component. The company also noted that nine vulnerabilities listed by Google were not included in the Galaxy update because one had already been fixed in July and eight did not affect Samsung devices due to unused hardware or configurations; rollout is expected to begin with newer flagship models before expanding to older supported Galaxy and A-series devices, while national CERT advisories have also flagged Samsung product vulnerabilities.
Aug 16, 2026
Researchers disclosed a Samsung smartphone exploit chain that turned a malicious link into **remote system-level compromise** by chaining flaws in **Samsung Members**, **Samsung Account**, and **Bixby**. Demonstrated at Pwn2Own Ireland 2025 against a **Galaxy S25** and later detailed at Black Hat 2026, the attack used `CVE-2025-21079`, `CVE-2025-58486`, and `CVE-2025-58487` to pivot across Samsung apps and abuse Bixby’s Capsule infrastructure, enabling sensitive data theft, elevated privileges, and ultimately remote code execution on stock devices. Samsung’s mobile security advisories show the affected ecosystem also included multiple high-severity weaknesses across Samsung software, including **Samsung Members**, **Bixby wakeup**, **Samsung Gallery**, **Secure Folder**, and `libsavscmn`, with impacts ranging from arbitrary file read/write and lock reset to memory corruption and code execution. Samsung said it patched the Samsung Members issue in **November 2025** and the Samsung Account flaws in **December 2025**; the exploit chain was reproduced on **Galaxy S25, S24, and Flip 7** devices, and researchers warned that older phones may remain vulnerable if they did not receive the updates.
Aug 8, 2026
Researchers at LucidBit Labs disclosed **CVE-2026-20971**, a high-severity use-after-free flaw in Samsung’s **KNOX** framework that left millions of Galaxy devices exposed to potential kernel-level attacks for roughly eight years. The bug affected Galaxy **S9 through S25** models, tested **A-series** devices including the **A54**, and both **Exynos** and **Qualcomm** variants across Android **13, 14, 15, and 16**. Samsung said the issue was fixed in its **January 2026** Android security update, and users were urged to verify a security patch level of **`2026-01-01`** or later. The vulnerability was traced to a race condition between KNOX’s **PROCA** process authenticator and the **FIVE** kernel integrity subsystem, specifically involving `procfs` handlers under `/proc/pid/integrity/` that accessed a `task_integrity` object without a proper reference in a fully preemptive kernel. LucidBit said the flaw could let a local untrusted app trigger kernel memory corruption and identified exploitation primitives including a memory leak that could aid **KASLR** bypass, an arbitrary-call path mitigated by **KCFI**, and a constrained write through spinlock operations on reclaimed memory. Although exploitation required local access and user interaction, researchers warned that a compromised Galaxy device could still enable deeper device takeover and provide a foothold for attacks against enterprise environments.
Jun 29, 2026