Maximum-severity flaws in GitLab, the Bricksforge WordPress plugin and SonicWall SMA1000 appliances drove both urgent patching and exploitation activity, a confirmed hardware implant in Ledger wallets sold through one reseller sits behind an 87 million dollar crypto drain, and an attack on refrigeration controllers disrupted hundreds of French supermarkets.
🔴 CRITICAL (2)
Exploitation attempts against SonicWall SMA1000 flaw CVE-2026-102255 mount days after patch Confirmed
Threat intelligence firms Previdian and Defused report continued scanning and exploitation attempts against SonicWall SMA1000 appliances for CVE-2026-102255, a pre-authentication server-side request forgery flaw rated CVSS 10.0. Previdian counted about 135 attempts from two IP addresses in the United States, with the first probes seen two days after SonicWall disclosed and patched the issue on October 6, and the vendor has not updated its advisory to confirm exploitation. Administrators should upgrade SMA1000 appliances to 12.4.3-03670 or 12.5.0-03082 or later, review logs for requests that make the appliance reach internal services, and treat exposed management interfaces as compromised until proven otherwise, because SonicWall lists no workaround.
Sources The Hacker News|SecurityWeek|DarkReading|SonicWall PSIRT
Ledger confirms hardware implant in wallets sold by reseller CryptoBilis as traced losses near 93 million dollars Confirmed
Ledger says an unauthorised hardware implant was found in at least one device sold by CryptoBilis, a Southeast Asian reseller, after users reported funds stolen from wallets bought through that channel. The company paused sales through the reseller and says its own systems and direct sales are unaffected, while tracing has followed about 93 million dollars of losses and roughly 10 million dollars has been frozen. Anyone who bought a Ledger device from a third-party reseller should move funds to a wallet whose recovery phrase was generated on a device they trust, and treat any pre-printed or supplied seed phrase as compromised.
🟠 HIGH (4)
Cyberattack on refrigeration controllers disrupts hundreds of French supermarkets Under investigation
Between October 11 and 12, attackers remotely manipulated refrigeration systems at major French grocery chains, reportedly by targeting Danfoss controllers, forcing units into continuous defrost and in some cases pushing them towards 50 degrees Celsius. Reported victims include Coopérative U, Intermarché and Carrefour stores, with two supermarkets in Alsace reporting roughly 270,000 euros in spoiled stock, and French prosecutors and the national agency ANSSI are investigating. Retail, logistics and facilities teams running internet-exposed refrigeration or building controllers should inventory those devices, remove them from public reach and rotate any default or shared credentials.
Ahold Delhaize takes systems offline after cybersecurity incident hits store and online services Under investigation
Ahold Delhaize, one of the world’s largest food retail groups, said on October 12 that it was dealing with a security issue in its network and had taken some systems offline as a precaution, while stores remained open and serving customers. Websites and online services at several of its United States and Benelux brands, including Stop and Shop, Giant, Food Lion and Hannaford, were reported down or degraded, and no ransomware group has claimed the incident. The company has not said whether data was accessed, so customers should expect disrupted online ordering and loyalty services and watch for phishing that references the outage.
Sources Ahold Delhaize|BleepingComputer
Attackers exploit maximum-severity Bricksforge WordPress flaw CVE-2026-85097 for unauthenticated remote code execution Confirmed
Patchstack reports active exploitation of CVE-2026-85097, a critical unauthenticated arbitrary file upload in the Bricksforge add-on for the Bricks site builder that lets attackers place and execute PHP code on affected WordPress sites. Attempts began on October 7 and affect versions up to and including 3.1.8.9, roughly 6,000 sites by Patchstack’s count, with the fix available in version 3.1.8.10. Administrators should update immediately, then hunt for unexpected PHP files in upload directories such as those named login_admin_*.php, and review recently created administrator accounts and web server logs for the bricksforge form submission endpoint.
Sources Patchstack|The Hacker News|SecurityWeek
GitLab patches CVSS 10.0 unauthenticated code execution flaw in CI/CD regex compiler (CVE-2026-97229) Confirmed
GitLab’s October 8 patch releases fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that GitLab rates CVSS 10.0 and says could allow an unauthenticated user to execute arbitrary code on a self-managed server, and CERT-EU published its own advisory on October 12. Affected are self-managed Community and Enterprise Edition instances from 19.1 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2, and GitLab has published no workaround. No exploitation has been reported, so administrators should upgrade to 19.4.2, 19.3.4 or 19.2.8, starting with internet-facing instances, and consider restricting access in the meantime.
Sources CERT-EU|BleepingComputer
🟡 MEDIUM (6)
Norway fines Microsoft-owned Xandr 9.6 million dollars over Grindr user data sharing Confirmed
Norway’s data protection authority Datatilsynet fined Xandr, the Microsoft-owned advertising technology company, NOK 92 million, about 9.6 million dollars, for unlawfully processing and sharing sensitive personal data belonging to Grindr users in the country. The case concerns ad technology data flows that exposed location and other sensitive inferences without a valid legal basis. Advertisers and app publishers that buy or sell audience data through ad exchanges should re-check their consent flows and legal bases for sharing app usage and location signals.
Sources BleepingComputer
Ransomware negotiator charged with conspiracy to extort in FBI probe tied to ShinyHunters breach Under investigation
Edward Dubrovsky, a Canadian cybersecurity executive who ran a ransomware negotiation firm, has been charged in Pennsylvania with conspiracy to extort money, according to reports linking the case to the FBI investigation of the September breach of its own jobs portal. He was arrested while visiting the United States for a conference, and a second suspected ShinyHunters member was arrested in the same investigation. The case is a reminder to verify the conduct and incentives of third-party negotiators and incident response vendors before handing them access to a live intrusion.
Sources DarkReading|SecurityWeek
AvisLoader malware loader hides command and control in encrypted peer-to-peer traffic Confirmed
Varonis researchers documented AvisLoader, a new Windows malware loader that carries command and control over encrypted peer-to-peer communications so that taking down individual servers does not stop the botnet. It is delivered through ClickFix style fake verification pages, persists via shortcut files and supports remote command execution on infected hosts. Defenders should block the lure pages, alert on new shortcut files and startup or registry modifications, and watch for unusual outbound peer-to-peer traffic from user workstations.
Sources BleepingComputer
Canonical websites disrupted in second DDoS attack this year Confirmed
Canonical confirmed that its main Ubuntu websites, including the blog and developer portal, were disrupted by a distributed denial of service attack, the second such incident against the company this year. The attack interrupts access to documentation and downloads for users and developers, and Canonical has not reported any compromise of the operating system or package build integrity. Teams that mirror Ubuntu content internally or depend on Canonical services for build pipelines should plan for intermittent availability and verify package sources independently.
Sources SecurityWeek
Cardiac monitor maker iRhythm reports breach affecting at least 360,000 people Confirmed
iRhythm Technologies, which provides wearable cardiac monitoring devices and services, disclosed that hackers accessed patient personal information including names, addresses, email addresses, dates of birth and phone numbers for at least 360,000 people. The company has notified affected individuals and regulators, and no exposure of clinical monitoring records has been described. Patients should treat unexpected messages that reference iRhythm or their cardiac care as potential phishing, and healthcare providers reviewing vendor risk should note the pattern of medical device and service suppliers being targeted for patient contact data.
Sources SecurityWeek
CyberXero used Claude Code agents in campaign that stole more than 628,000 Ukrainian records Confirmed
Researchers disclosed a Russian-speaking initial access broker tracked as CyberXero that used dozens of Claude Code agents alongside commodity tooling such as Cobalt Strike to attack WordPress sites, e-commerce platforms and critical infrastructure entities in Ukraine. The campaign is reported to have reached hundreds of WordPress admin panels and exfiltrated more than 628,000 records from four Ukrainian organisations. WordPress operators should patch plugins and themes promptly, remove unused administrator accounts, and review logs for high-volume automated credential testing from proxy networks.
Sources The Hacker News|eSecurity Planet
⚪ WATCH (5)
Drone strikes damage Yandex data centres and cut access to cloud files Confirmed
Yandex said drone attacks damaged three of its data centres, forcing it to shut down two facilities and partially disable a third, which left users without access to cloud files and some services. The company has not reported data loss or a security compromise in the incident. It is a reminder that physical and regional concentration risk, not only cyberattacks, drives cloud availability planning for teams with workloads in a single provider region.
Sources BleepingComputer
Personal AI agents already logged into enterprise apps complicate identity controls
An analysis of the personal AI agent rollout describes how assistants such as Meta’s Muse and similar products browse and act inside a user’s existing sessions, and notes that Amazon now blocks Muse because it does not identify itself as a bot. Because these agents inherit logged-in sessions and stored credentials, security teams have limited visibility into the data they reach and the actions they take. Organisations should set expectations for acceptable agent use, monitor user sessions for unusual automated activity, and shorten token lifetimes for sensitive applications.
Sources The Hacker News
Global financial watchdog urges cross-border planning for stablecoin stress
The Financial Stability Board called for cross-border information sharing and pre-agreed crisis plans for stablecoin failures, warning that coins issued jointly across jurisdictions can trap reserves in one country while redemption demands arrive in another. The recommendations matter for exchanges, custodians and payment firms that hold or settle stablecoin reserves. Firms with cross-border stablecoin exposure should map where reserves sit and how quickly they could be mobilised in a stress event.
Sources CoinDesk
UK freezes 12 million dollar London penthouse linked to alleged Prince Group finance chief Confirmed
British authorities froze a London penthouse worth about 12 million dollars belonging to Thet Li, accused of running the finances of a scam compound empire connected to 14 billion dollars in Bitcoin that the United States has moved to seize. The action widens enforcement against Southeast Asian fraud operations that launder proceeds through property and cryptocurrency. Firms with exposure to such networks, including payment processors and crypto businesses, should expect continued asset freezes and sanctions designations.
Sources Decrypt
Let's Encrypt cuts default certificate validity to 64 days ahead of 45-day switch
Let’s Encrypt will reduce the default validity period for newly issued certificates to 64 days from February 2027, ahead of an eventual move to 45 days. The change follows industry ballots to shorten certificate lifetimes and increase reliance on automation. Teams that still renew certificates by hand or hold certificates in inventory systems with manual approvals should move to automated issuance and renewal now, and check that monitoring reflects the shorter lifetimes.
Sources SecurityWeek
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.