🍟 Hackers force hundreds of French supermarket fridges into defrost via Danfoss controllers, 🏬 Ahold Delhaize disconnects systems across three continents, 🔌 Ledger confirms hardware implant in reseller-channel wallets, 🛩️ Yandex loses three data centers to drone strikes, 🔧 GitLab ships 19.4.2 for CVSS 10.0 unauthenticated RCE, 🧴 Rapuncel infostealer hides behind a Microsoft-signed EDR-killer driver

[NEW] The day's defining story is a physical-world one: overnight from Saturday, attackers pushed forced defrost cycles into the refrigeration controllers at hundreds of French supermarkets, raising fridge and freezer temperatures to as much as 50C and spoiling fresh and frozen stock across roughly 250 to 350 stores, with AFP counting more than 250 Intermarche and Coopérative U locations alone alongside Carrefour Market, Monoprix, Leclerc and Super U. The Paris prosecutor's office has confirmed the attack, and Danfoss, whose controllers were hijacked, says the intruders exploited a previously known vulnerability, tracked as CVE-2025-41450, that none of the affected controllers had patched. Today's follow-ups quantify the cost: supermarkets spent the weekend discarding spoiled food, and a Sekoia Threat Detection and Research analyst told Reuters the controller exposure extends beyond France. This is an unpatched-known-flaw story at the food-critical-infrastructure layer, so the remediation is firmware patching and network isolation for refrigeration estates, and the watch item is copycat activation against retailers running the same Danfoss stack.

[NEW] Ahold Delhaize separately confirmed a cybersecurity incident that pushed it to disconnect some systems, disrupting deliveries and online orders at Albert Heijn in the Netherlands and Delhaize in Belgium while US Stop & Shop employees lost access to schedules and pay stubs; stores stayed open. The grocer, which runs more than 9,400 stores and serves about 60 million customers weekly, was hit in November 2024 and again in April 2025, the latter attributed to INC Ransom, so a third network-level incident in under a year reads as persistent adversary interest rather than opportunism. No attribution yet, and the company has not connected its incident to the French refrigeration attacks over the same weekend; both remain open questions rather than evidence of a coordinated campaign.

[NEW] Ledger confirmed the rarest thing in this business, a hardware rather than software supply chain: units distributed through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia, carried physical implants that drained customers' crypto wallets, and the company ties all reported fund losses to devices sold through that channel. Researchers had been showing the implant on Ledger devices since mid-September, and Ledger's confirmation closes the loop between tampering and theft. Channel purchases of hardware wallets now need provenance controls like any other security-sensitive hardware, and devices acquired through the affected reseller should be treated as compromised regardless of firmware state.

[NEW] Bricksforge, a WordPress plugin, carries CVE-2026-85097, a CVSS 10.0 unauthenticated RCE in which arbitrary PHP upload becomes immediate code execution, and reporting from SecurityWeek, The Hacker News and offseq's radar says it is already being exploited in the wild days after the October 8 disclosure. Internet-facing WordPress sites running the plugin are direct targets, and the upload-then-execute pattern leaves a signature: block the plugin's upload handlers at the WAF until the vendor's fixed build is confirmed, and hunt for fresh PHP files in the uploads directory plus POST-then-GET pairs against the same path.

[UPDATE] GitLab has now published the vendor advisory that yesterday's coverage flagged as missing: fixed builds 19.2.8, 19.3.4 and 19.4.2 shipped October 12 for CVE-2026-97229, the CVSS 10.0 unauthenticated RCE triggered by a crafted regex in CI/CD pipeline configuration, and GitLab.com is confirmed patched, so self-managed instances can now upgrade against official fixed versions.

[NEW] Yandex confirmed that drone strikes damaged three of its Russian data centers between October 8 and 11, at Sasovo, Kaluga and Vladimir, with two facilities shut down and a third partially disabled, cutting customer access to cloud-stored files and degrading ride-hailing, delivery and streaming services. This is the physical end of the continuity spectrum: no CVE, no patch, blast radius set by where the machines sit, and remediation limited to backups held outside Yandex-controlled regions plus status-page tracking for restoration timelines. It is also the clearest signal yet that data-center geography, not just configuration, now belongs on the risk register.

[NEW] SAP's October patch day fixes six CVEs led by CVE-2026-89107, a CVSS 9.9 scripting-injection flaw in S/4HANA that lands in full system compromise, alongside 9.9 bugs in Visual Compose (CVE-2026-89108 and CVE-2026-89110) and a Cloud SDK flaw the advisory titles at 10.0. No exploitation is reported, so this is a scheduling item, but S/4HANA script injection earns a fast patch window and internet-facing admin interfaces earn segmentation.

[NEW] New DDoSia target lists this week trace the volunteer DDoS tool's rotation across Europe: an October 11 configuration aimed at Polish hosts including Grupa Azoty, PZU, Netia and Bondspot, and today's dominated by French state and municipal domains such as knds.fr, rungis.fr, brest.fr and bordeaux.fr. These are target-list updates rather than confirmed outages, and the overlap with the week's French supermarket disruption is timing, not established coordination, but the same-day French civic targeting is context worth holding onto. Watch whether any listed domain actually degrades.

[NEW] Norway's data protection authority Datatilsynet fined Xandr, Microsoft's advertising arm, NOK 92 million, about $9.6 million, its largest penalty ever, for running real-time ad auctions inside Grindr between July 2018 and April 2020 that exposed users' profiling data including sexual orientation to thousands of bidding companies while Xandr never verified consent in its joint-controller role. Going after the ad-tech intermediary rather than the app is the notable move, and it hands other EU regulators a template for sensitive-data enforcement down the programmatic chain.

[NEW] A cache of internal Luna Moth files surfaced on an onion site with no claimant and no explanation of origin, and the twist is the response: Silent Ransom Group calls the material fake and says it suffered no breach, while DataBreaches.net says the files are authentic and has put that denial to the group directly. When a ransomware crew disputes the authenticity of its own leaked internals, actor self-reporting stops being evidence in either direction, and leak-site claims cannot be treated as verified. The actionable step is intelligence work: mine the exposed files for Tor infrastructure, tooling and communication patterns, and watch whether the group doubles down or walks back the denial.

[NEW] Discourse patched two flaws, CVE-2026-55674 and CVE-2026-55420, that chain malicious image uploads into server-side file reads and cache-poisoning XSS on self-hosted forums. Upgrade promptly and audit recent image uploads plus logs for unexpected file-access patterns.

[WILDCARD] LastPass and Delphos Labs documented Rapuncel, a previously unknown infostealer pushed through SEO-tuned GitHub repositories impersonating LastPass Authenticator and at least 39 other brands. The payload is nastier than the lures: a Microsoft-signed kernel driver, Alinubx.sys disguised as nvfsflt64.sys, that acts as an EDR killer with a hardcoded kill list of 145 antivirus and endpoint products, plus 148MB ZIPs hiding a renamed Visual Studio debugger that sideloads a malicious DLL. Developers searching GitHub for tooling are the target, so block the driver, audit for the sideload pattern and treat lookalike repositories as hostile regardless of how legitimate they look.

[WILDCARD] Varonis Threat Labs' AvisLoader analysis, recovered from an exposed staging server next to the campaign's own tools, describes a Windows loader with a ClickFix entry point, a fake document-signing page that talks visitors into pasting and running a command, and a command-and-control channel built on the Tox encrypted peer-to-peer network that stays reachable even when the hosting behind it is seized or taken down. The resilient C2 is the new part: sinkholing the usual infrastructure does not kill this loader's channel, so hunt Tox-based egress and click-fix social engineering rather than waiting for domain indicators to age in.

Watchlist: whether CVE-2025-41450 lands in the CISA KEV catalog and whether any retailer outside France reports Danfoss controller interference; attribution for the Ahold Delhaize incident, including any link to the French refrigeration attacks or another INC Ransom run; further tampered hardware batches or channels beyond CryptoBilis; exploitation attempts against CVE-2026-97229 now that fixed GitLab builds are out; the Bricksforge vendor fixed version and whether its in-wild activity widens; and further strikes on Russian data centers.

Generated by opencode-go/mimo-v2.6-flash. Input tokens: 138,920, output tokens: 44,088, cache read: 4,645,184, cache write: 0.