Home Assistant 2026.11 and attacks on shop fridges: IoT weekly #8

This issue comes out today, Wednesday 4 November, a day earlier than our usual Thursday, so that the site is up to date as of today; it covers the news from 30 October to 4 November.

Home Assistant 2026.11 builds in a marketplace, shows Matter cameras and renames everything

On 4 November, Home Assistant released version 2026.11, which the release post calls “the biggest release we’ve ever shipped, by far”. The largest change is a Marketplace, under Settings, that brings HACS, the community store through which users have installed third-party integrations, dashboard cards and themes for years, into Home Assistant itself. Existing HACS installations migrate automatically, the separate HACS installer stops with this release, and installing or updating anything from the Marketplace requires accepting a notice about the risks of community software. Cameras that follow Matter 1.5 now show live video over WebRTC and snapshots, provided the Matter server is recent enough, and a Labs preview adds two-way audio, a talk button for Matter and Reolink cameras that works only over HTTPS for now. Zigbee gains support for Green Power, the Zigbee feature for batteryless devices such as Friends of Hue switches, and Zigbee groups become devices of their own. A new LoRaWAN page connects ChirpStack and The Things Network; ESPHome devices can share a serial port over the network; backups and media can be kept on an internal or USB disk; and 38 new integrations arrive, with 19 existing ones reaching the top “platinum” quality grade. On the AI side, an assistant connected through Home Assistant’s LLM API could already search devices and automations and read logs and statistics; it can now also list and call actions and reload integrations, which means it can change a setup rather than only read it. Log access requires an administrator account, and the MCP server can be set to expose read-only tools only.

The change most users will notice first was explained a day earlier. On 3 November, the project described the new naming model, which took “more than four years”: each device and entity is named for what it is, and Home Assistant adds the context, such as the area and device name, where a screen needs it. Complex devices split into child devices, so a power strip can have one child per socket, each with its own name and area. Entity IDs, automations, scripts, scenes and dashboards “will keep working”, and old names become aliases so that voice commands to Assist, Alexa and Google Assistant still work. A first version was pulled just before the 2026.4 release after beta testers’ feedback, including that the naming terminology was confusing, and it took “a few extra months” to revise. Some migrated names will look odd at first; the example given is a switch named “Coffee machine” on a device called “Smart plug 3”, which now shows as “Smart plug 3 Coffee machine” until the device is renamed. Z-Wave, MQTT and ESPHome support child devices from this release; Matter and ZHA are “in progress”.

Why it matters: Home Assistant is the platform of choice for people who want a smart home that works without a cloud account, and three of this month’s changes widen who it is for. Building the store into the product removes a separate installation step, and the notice makes the risks of community projects explicit before anything is installed; it does not certify them as safe. Matter 1.5 cameras put Home Assistant among the first platforms where a camera from one brand streams into a controller from another through the standard, which is the promise of Matter and, for a camera, the privacy case for keeping the video at home. The naming change is the kind of work that makes a system usable by the rest of the household, the audience the project said last week it wanted to hear from. The one change to approach carefully is the AI assistant that can now call actions and reload integrations: the read-only option exists for a reason, and an AI agent that can act in your home should get the least access it needs. Home Assistant explained and Matter in Home Assistant, both new on the site this week, cover the basics; ZHA vs Zigbee2MQTT explains the two ways to run the Zigbee devices the release touches; LoRaWAN explained covers the network behind the new page.

EU bodies report a new wave of attacks on shop refrigeration controllers

On 4 November, the European Commission’s DG CNECT, ENISA, Europol’s European Cybercrime Centre, the EU CSIRTs Network and EU-CyCLONe, the network of national cyber crisis authorities, issued a joint statement on cyber incidents in refrigeration systems. “Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted” in a number of Member States, it says, and “a new wave of incidents” occurred on 1 and 2 November. The bodies advise organisations “to take immediate action to mitigate exposure in the affected systems” and to follow the advisories of their national CSIRT; ENISA published the same text and keeps the collection of national advisories on GitHub. The statement names no country, vendor or number of victims. It does recall the rules that now apply: since 11 September 2026, manufacturers must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s single reporting platform; the CRA’s main requirements apply from 11 December 2027; and entities covered by the NIS2 Directive must manage their cyber risks and report significant incidents to their national authority.

The technical picture comes from France. CERT-FR, the French government’s security response team, issued an alert on 12 October, updated on 16 October, on “numerous compromises” of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC series and Copeland and Dixell xweb supervisors. It does not say how the controllers were entered. It says that, in general, exposing a management interface on the internet is “contrary to good practice”, and that attack campaigns against this equipment “are probably still ongoing”. Its advice, for compromised and uncompromised units alike: take the controllers off the public internet, allow access only through a VPN or a protected network, update the firmware, set Danfoss units to Strict security mode and make sure default passwords have been changed. Uncompromised units should also have their whole configuration checked, including the defrost schedules. For a compromised Danfoss unit it adds a restart or factory reset, then reconfiguration, with a warning: keeping equipment that no longer receives security fixes exposed on the internet means “a very high probability” of compromise, and a factory reset alone “is insufficient”. Update, 6 November: on 5 November the director general of Italy’s cybersecurity agency ACN told a parliamentary commission that the attacks were helped by software that was out of date or could no longer be updated and by the practice of operating these fridges remotely, ANSA reported.

Why it matters: A supermarket’s refrigeration controller is operational technology, but the risks the French alert names are those of consumer IoT at a larger scale: a web interface left open to the internet, default credentials that may never have been changed, and models old enough to be out of support. The remedies in the French alert are the ones every guide on this site gives for a camera or a thermostat, and the end-of-support warning is the hardest one, because a controller that gets no fixes cannot be made safe by resetting it; it has to be isolated or replaced, as When smart devices lose support explains. The joint statement also points at the Cyber Resilience Act’s reporting duty during a live incident: since September, a manufacturer who learns that a flaw in its product is being exploited must report it through the single reporting platform the statement names. Vendors of equipment installed in shops and plants should assume that clock is running. Network segmentation describes the separation the alert asks for, and IoT security regulation sets out what the CRA and the NIS2 Directive require and when.

The Bluetooth SIG adopts High Data Throughput, a week after Nordic showed it in silicon

On 4 November, the Bluetooth Special Interest Group announced the adoption of Bluetooth High Data Throughput (HDT), “an optional feature in the recently adopted Bluetooth Core 7.0”. HDT adds a new physical layer with what the SIG calls “robust modulation schemes” and raises the maximum bit rate to 7.5 Mbps, “nearly four times that of the Bluetooth LE 2M PHY”, the fastest mode of Bluetooth Low Energy until now. The SIG lists four gains: faster transfers, more capacity in the same spectrum, better energy efficiency because the radio finishes sooner and returns to a low-power state, and better reliability. The first flagship application is premium wireless audio, with lossless and high-resolution sound and multi-channel surround, and “is expected to be released in 2027”; the SIG also names extended reality, AI-enabled devices, industrial automation and monitoring, and everyday devices such as wearables and smart home products, where it mentions quicker firmware updates. A companion blog post gives the same figures and no others: there is no channel bandwidth, packet length or modulation name in either text. Quotes come from Samsung’s semiconductor arm and from Nordic Semiconductor, whose Øyvind Strøm gives smartwatches syncing training data and smart home firmware updates as examples.

Why it matters: In issue 7 Nordic said it had proved HDT in silicon and expected the SIG to release it “in late 2026”; it took six days. The difference between a demonstration and an adopted specification is that chipmakers can now design, test and certify against a fixed text, so the question moves from whether to when. The 2027 date for audio gives the realistic pace: a speed gain needs both ends of the link, and phones that support Core 7.0 will arrive before the headsets that use it. For IoT the attractive part is not audio but the plain arithmetic of a firmware image: at nearly four times the speed, an OTA update over Bluetooth Low Energy takes about a quarter of the time and of the battery, and a product that carried a Wi-Fi radio only for updates may be able to drop it. The caution is the one the Bluetooth SIG itself implies by calling the feature optional: not every Core 7.0 chip will have it. Bluetooth Low Energy for IoT explains the radio as it works today.

Nordic announces the nRF71, a Wi-Fi 6 chip with Thread and a neural unit for battery devices

On 3 November, Nordic Semiconductor announced the nRF71 Series, a family of systems-on-chip that combine Wi-Fi, Bluetooth LE, Thread and on-device machine learning on one chip. The first two parts are the nRF7120, with dual-band Wi-Fi 6, and the nRF7120E, with tri-band Wi-Fi 6E and an integrated Axon neural processing unit that Nordic says runs models 10 to 17 times faster than the chip’s processor alone. Both have a 256 MHz Arm Cortex-M33, 4 MB of non-volatile memory and 1 MB of RAM for the application, and pair the Wi-Fi radio with the 2.4 GHz multiprotocol radio of Nordic’s nRF54 Series; the two radios can receive at the same time, so a device can stay on Wi-Fi while listening for Bluetooth LE or Thread. Nordic says the series uses “up to 20 times” less standby power than its current nRF70 Wi-Fi companion chips, without giving measured values or test conditions. It names keyword spotting, anomaly detection and image classification as practical on battery, with models from its Neuton software updated over the air through nRF Cloud, and it targets battery-powered smart home hubs, Matter bridges and Thread border routers, Matter locks and security panels, wearables and industrial sensors. The chips are sampling with selected customers; Nordic will show them, and a module, at electronica in Munich next week.

Why it matters: Wi-Fi has been the radio you avoid in a battery-powered device, because keeping an association alive costs more than a Zigbee or Thread node spends in a day; a chip built for battery life first, from a company whose business is Bluetooth LE, is an attempt to change that. The combination matters as much as the power figure. A device with Wi-Fi and Thread on one chip can be a border router, the bridge between a Thread mesh and the home network that today usually lives in a mains-powered speaker or hub; Nordic’s list of targets says that is the plan. It also puts Nordic directly against Espressif, whose ESP32-C6 and C5 already combine Wi-Fi 6 and an 802.15.4 radio in low-cost parts, as Choosing an ESP32 sets out. Two cautions: the twenty-times claim has no numbers behind it yet, and “sampling with selected customers” means finished products are still some way off. Matter over Thread vs Matter over Wi-Fi explains why a device would want both radios, and edge AI and NPU cover what the neural unit is for.

Raspberry Pi raises the price of its 16 GB boards and blames DRAM supply

On 2 November, Raspberry Pi’s chief executive Eben Upton announced that “from today, we are raising the price of the 16GB variant of Raspberry Pi 5 by $80, to $385”, and that the 16 GB variants of Compute Module 5, the version of the board that product makers solder into their own hardware, rise by USD 40. The price of the Raspberry Pi 500+, the keyboard computer with 16 GB, is held. The reason given is “a lack of alternative supply for 16GB DRAM, compounded by other ongoing component shortages”; rising memory costs over the past two years are the background, and the post says other companies in the sector have raised prices too. Upton calls the memory situation “difficult but ultimately temporary” and says the company looks forward to rolling back its increases when costs fall. Meanwhile it suggests lower-memory variants or earlier models, or making software use less memory, and warns buyers to use Approved Resellers at official prices rather than pay inflated prices elsewhere.

Why it matters: The 16 GB Raspberry Pi 5 is the board people buy to run a language model locally, and Running a local LLM on a Raspberry Pi, new this week, explains why memory, not processor speed, decides which models fit. At the new price, the arithmetic of a small home server changes, and for most IoT jobs it never applied: a gateway that runs a broker and a few radios does fine with far less, as Raspberry Pi as an IoT gateway shows, and many tasks belong on a microcontroller in the first place (ESP32 vs Arduino vs Raspberry Pi). The more serious effect is on the companies that designed the 16 GB Compute Module into a product; a system-on-module is chosen for a long production life, and a USD 40 rise lands on every unit. The post is also a plain statement that two years of rising memory prices have reached the bill of materials of small devices.

The Commission launches a 525 million euro platform for European chip design start-ups

On 4 November, the European Commission launched the European Chip Design Platform, an initiative under the EU Chips Act that “will mobilise €525 million in investment” to support new chip design companies. The platform offers design tools, design support services, blocks of intellectual property and access to manufacturing capacity; Executive Vice-President Henna Virkkunen said it “gives our chips start-ups and SMEs the support they need to overcome the barriers”. The Commission notes that European chip design companies “currently account for less than 1% of global revenues in this segment”. The full press release puts €285 million from the EU budget and €240 million from the participating states of the Chips Joint Undertaking; €440 million goes to grants (up to €100,000 for early-stage start-ups, €16 million for more developed ones) and €85 million to the platform’s infrastructure, services and open-source design tools. Twenty start-ups are already in its venture development programmes.

Why it matters: The microcontrollers and radio systems-on-chip inside connected devices are designed by a handful of companies, and the barrier to a new one is less the factory than the design tools, whose licences cost more than a start-up can carry, and the proven blocks (a radio, a processor core, a security module) it would otherwise have to design itself. That is what the platform offers, so it is aimed at the right bottleneck; whether 525 million euros can grow a company that competes with the suppliers in this issue is a question for 2030, not this week. Together with the 319 million euro grant for Infineon’s Villach plant in issue 7, it shows the Chips Act being spent at both ends of the chain, manufacturing and design.

Also worth your time

• 30 October: Arduino described how Techno Sky, the engineering company of Italy’s air navigation provider ENAV, built a visual emergency signalling system for ENAV’s digital control towers around a single Arduino Opta, the company’s PLC-class controller: it drives eight signalling modes over RS485 and Ethernet, with a watchdog and checks on communication integrity, and went from R&D concept to operational use in under twelve months.
• 4 November: the Connectivity Standards Alliance published a two-page note on how Zigbee 4.0 lays the foundation for bringing Smart Energy, the profile used by smart meters that stayed separate when Zigbee 3.0 unified the others, into one Zigbee ecosystem: one security model and onboarding flow, further 4.x updates to complete the work, backward compatibility with Zigbee 3.0 and Smart Energy devices, and as an example a Smart Energy device, such as a meter, telling a smart plug to switch off an appliance at peak hours, the kind of demand response utilities want from the home.
• 4 November: Raspberry Pi explained, in a post accompanying its podcast, what it provides to companies that build products on its boards: declarations of conformity, FCC approvals and test reports on its Product Information Portal, an in-house 3-metre anechoic chamber for radio tests, formal testing at accredited labs and a market access service for country approvals. Useful reading before CE marking or FCC certification of a product with a Raspberry Pi inside.

From the site this week

• What is Home Assistant, how does it run and who is it for? Home Assistant explained.
• Which ESP32 should you choose? Classic, S3, C3, C5, C6, H2 and P4 compared.
• Should a Matter device use Thread or Wi-Fi? Matter over Thread vs Matter over Wi-Fi.
• How long will a connected device get security updates, and where do you read it? Security support periods.
• Can you run an LLM on a Raspberry Pi? Memory, quantization, llama.cpp, Ollama and the AI HATs.
• Which humanoid robots exist, which can you buy, and what do they cost? Humanoid robot tracker.
• Is a robot vacuum really cheaper on Black Friday? Official prices before the sales, and how to tell a real discount.
• Is a heat pump worth it compared with a gas boiler? The break-even by country.

Term of the week: operational technology (OT), the hardware and software that monitor and control physical equipment, from a production line to the refrigeration of a shop. The attacks in this issue show why the distinction from IT matters less than it used to: once a controller has a web interface on the internet, it is attacked like any other computer, but the damage is physical.

Sources

• Home Assistant, Home Assistant 2026.11
• Home Assistant, Naming things in Home Assistant
• European Commission, Joint statement on cyber incidents in refrigeration systems across the EU
• ENISA, Joint statement on cyber incidents in refrigeration systems across the EU
• CERT-FR, Alerte CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
• ANSA, L'Agenzia per la cybersicurezza: gli attacchi hacker ai frigo favoriti da software non aggiornati
• Bluetooth SIG, Bluetooth High Data Throughput opens a new chapter in wireless performance
• Bluetooth SIG, Bluetooth High Data Throughput delivers a higher level of wireless performance
• Nordic Semiconductor, Nordic brings edge AI to battery-powered Wi-Fi devices, achieving twenty times lower standby power with new nRF71 Series
• Raspberry Pi, Price rises for some 16GB Raspberry Pi products
• European Commission, 525 million euro investment set to drive new generation of European chip design companies
• European Commission, press release IP/26/2345, European Chip Design Platform
• Arduino, How Techno Sky and Arduino Opta brought an industrial visual emergency signaling solution to air traffic management
• Connectivity Standards Alliance, Zigbee 4.0: Foundation for Harmonizing with Smart Energy
• Raspberry Pi, Product compliance, demystified: how Raspberry Pi helps you get to market

Topics: Home Assistant, Matter, Zigbee, Bluetooth, Bluetooth SIG, Nordic Semiconductor, Raspberry Pi, ENISA, Cyber Resilience Act, European Commission, industrial IoT, edge AI