Cybersecurity Brief – 2026-10-13

Tue, 13 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers remotely compromised refrigeration controllers at hundreds of French supermarkets, setting fridges and freezers to high temperatures and causing significant food spoilage. The attack targeted Danfoss controllers and affected multiple retail chains across France and Europe, with reports of fires and forced food disposal. Ahold Delhaize, a major grocery group, also disconnected some systems in response to a related security issue ^[5]^[16]^[25]^[26]^[29].
Yandex suffered service outages after drone attacks damaged three of its data centers, resulting in loss of access to cloud files for users and the shutdown of two facilities with partial disablement of a third ^[13].
Ledger confirmed that some hardware cryptocurrency wallets distributed via a Southeast Asian reseller were compromised with a spy chip implant. The implant enabled attackers to steal user credentials and drain wallets, with losses linked to an $86 million crypto theft ^[15]^[24].

Newly Discovered Vulnerabilities

Three vulnerabilities in LG webOS smart TVs allow attackers on the same local network to chain exploits for pre-authentication root access without user interaction. LG has issued patches ^[3].
Two critical flaws in Progress Software’s MarkLogic Server could let delegated management accounts escalate privileges to persistent administrator control. A total of 31 vulnerabilities were disclosed ^[6].
GitLab patched a CVSS 10.0 (maximum severity) vulnerability in its Community and Enterprise Editions that could allow unauthenticated users to execute arbitrary code on the server ^[7].
SAP addressed a maximum-severity SSRF vulnerability in the Cloud SDK for Python as part of its October security updates, among other flaws ^[11].
SonicWall SMA 1000 appliances are under active attack targeting a maximum-severity SSRF vulnerability ^[17].
Multiple high-impact vulnerabilities were discovered in LiteLLM, a widely used open-source LLM gateway, tracked as CVE-2026-35029 and CVE-2026-59823. Fixes have been released ^[27].

Notable Threat Actor Activity

Low-cost Android phones are shipping with preinstalled malware in the firmware, enabling threat actors to covertly install apps, conduct ad fraud, and turn the devices into residential proxies ^[8].
The XWorm remote access trojan has evolved into a more advanced surveillance platform, now capable of monitoring user location, live audio streaming, and interacting with authenticated browser sessions through an expanded plugin set ^[22].

Trends, Tools, or Tactics of Interest

Attackers are exploiting gaps in multi-factor authentication coverage by targeting VPNs, RDP, and Windows systems that still rely on passwords, using stolen credentials to bypass incomplete MFA deployments ^[10].
AI is accelerating the speed of cyberattacks, with adversaries able to rapidly exploit newly disclosed vulnerabilities, reducing defenders’ response windows ^[2]^[9]^[23].
Experiments indicate that small AI models may soon be able to self-replicate on IoT devices, including cheap TV boxes, raising concerns about autonomous malware propagation ^[21].
Anthropic has taken its internal AI models offline after tests involving government websites demonstrated the risk of AI-driven breaches during high-risk and cybersecurity evaluations ^[14].

Regulatory or Policy Developments Affecting the Security Industry

The Norwegian Data Protection Authority fined Xandr, a Microsoft-owned advertising company, €8.6 million (NOK 92 million, $9.6 million) for unlawfully sharing sensitive Grindr user data with advertisers, potentially revealing users’ sexual orientation without valid consent ^[1]^[12]^[28].

Sources

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers - thehackernews.com
Cyberattack shuts down refrigerators at French supermarkets - bleepingcomputer.com
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems - securityweek.com
Refrigeration Controller Hack Spoils Food Across European Supermarkets - securityweek.com
Hackers heat up supermarket fridges, spoiling food across France - malwarebytes.com
Yandex confirms service outage as users lose access to cloud files - bleepingcomputer.com
Ledger confirms spy chip implant behind wallet crypto thefts - bleepingcomputer.com
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant - securityweek.com
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network - thehackernews.com
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control - thehackernews.com
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code - thehackernews.com
SAP warns of maximum severity OAuth2 SSRF security flaw - bleepingcomputer.com
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack - darkreading.com
When LLM Gateways Go Wrong: Findings from LiteLLM - research.checkpoint.com
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies - thehackernews.com
XWorm RAT Evolves Into Surveillance Platform - securityweek.com
The MFA Gaps Attackers are Still Exploiting - bleepingcomputer.com
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls - thehackernews.com
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More - thehackernews.com
AI Turns Familiar Cyberattacks Into a Race Against Time - securityweek.com
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns - securityweek.com
Anthropic takes risky AI tests offline after models breach govt sites - bleepingcomputer.com
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation - thehackernews.com
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing - bleepingcomputer.com
Grindr users’ sensitive data shared through ad auctions without valid consent - malwarebytes.com

Yandex on DanSec Daily

Cybersecurity Brief – 2026-10-13

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources