Major Incidents or Breaches

  • Attackers remotely compromised refrigeration controllers at hundreds of French supermarkets, setting fridges and freezers to high temperatures and causing significant food spoilage. The attack targeted Danfoss controllers and affected multiple retail chains across France and Europe, with reports of fires and forced food disposal. Ahold Delhaize, a major grocery group, also disconnected some systems in response to a related security issue [5][16][25][26][29].
  • Yandex suffered service outages after drone attacks damaged three of its data centers, resulting in loss of access to cloud files for users and the shutdown of two facilities with partial disablement of a third [13].
  • Ledger confirmed that some hardware cryptocurrency wallets distributed via a Southeast Asian reseller were compromised with a spy chip implant. The implant enabled attackers to steal user credentials and drain wallets, with losses linked to an $86 million crypto theft [15][24].

Newly Discovered Vulnerabilities

  • Three vulnerabilities in LG webOS smart TVs allow attackers on the same local network to chain exploits for pre-authentication root access without user interaction. LG has issued patches [3].
  • Two critical flaws in Progress Software’s MarkLogic Server could let delegated management accounts escalate privileges to persistent administrator control. A total of 31 vulnerabilities were disclosed [6].
  • GitLab patched a CVSS 10.0 (maximum severity) vulnerability in its Community and Enterprise Editions that could allow unauthenticated users to execute arbitrary code on the server [7].
  • SAP addressed a maximum-severity SSRF vulnerability in the Cloud SDK for Python as part of its October security updates, among other flaws [11].
  • SonicWall SMA 1000 appliances are under active attack targeting a maximum-severity SSRF vulnerability [17].
  • Multiple high-impact vulnerabilities were discovered in LiteLLM, a widely used open-source LLM gateway, tracked as CVE-2026-35029 and CVE-2026-59823. Fixes have been released [27].

Notable Threat Actor Activity

  • Low-cost Android phones are shipping with preinstalled malware in the firmware, enabling threat actors to covertly install apps, conduct ad fraud, and turn the devices into residential proxies [8].
  • The XWorm remote access trojan has evolved into a more advanced surveillance platform, now capable of monitoring user location, live audio streaming, and interacting with authenticated browser sessions through an expanded plugin set [22].

Trends, Tools, or Tactics of Interest

  • Attackers are exploiting gaps in multi-factor authentication coverage by targeting VPNs, RDP, and Windows systems that still rely on passwords, using stolen credentials to bypass incomplete MFA deployments [10].
  • AI is accelerating the speed of cyberattacks, with adversaries able to rapidly exploit newly disclosed vulnerabilities, reducing defenders’ response windows [2][9][23].
  • Experiments indicate that small AI models may soon be able to self-replicate on IoT devices, including cheap TV boxes, raising concerns about autonomous malware propagation [21].
  • Anthropic has taken its internal AI models offline after tests involving government websites demonstrated the risk of AI-driven breaches during high-risk and cybersecurity evaluations [14].

Regulatory or Policy Developments Affecting the Security Industry

  • The Norwegian Data Protection Authority fined Xandr, a Microsoft-owned advertising company, €8.6 million (NOK 92 million, $9.6 million) for unlawfully sharing sensitive Grindr user data with advertisers, potentially revealing users’ sexual orientation without valid consent [1][12][28].

Sources#

  1. Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers - thehackernews.com
  2. Cyberattack shuts down refrigerators at French supermarkets - bleepingcomputer.com
  3. Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems - securityweek.com
  4. Refrigeration Controller Hack Spoils Food Across European Supermarkets - securityweek.com
  5. Hackers heat up supermarket fridges, spoiling food across France - malwarebytes.com
  6. Yandex confirms service outage as users lose access to cloud files - bleepingcomputer.com
  7. Ledger confirms spy chip implant behind wallet crypto thefts - bleepingcomputer.com
  8. $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant - securityweek.com
  9. LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network - thehackernews.com
  10. Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control - thehackernews.com
  11. GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code - thehackernews.com
  12. SAP warns of maximum severity OAuth2 SSRF security flaw - bleepingcomputer.com
  13. Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack - darkreading.com
  14. When LLM Gateways Go Wrong: Findings from LiteLLM - research.checkpoint.com
  15. Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies - thehackernews.com
  16. XWorm RAT Evolves Into Surveillance Platform - securityweek.com
  17. The MFA Gaps Attackers are Still Exploiting - bleepingcomputer.com
  18. [Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls - thehackernews.com
  19. ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More - thehackernews.com
  20. AI Turns Familiar Cyberattacks Into a Race Against Time - securityweek.com
  21. Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns - securityweek.com
  22. Anthropic takes risky AI tests offline after models breach govt sites - bleepingcomputer.com
  23. Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation - thehackernews.com
  24. Norway fines Microsoft ad firm $9.6 million over Grindr data sharing - bleepingcomputer.com
  25. Grindr users’ sensitive data shared through ad auctions without valid consent - malwarebytes.com