Big Stories This Week
ICS Attack — European Supermarket Refrigeration Systems
Hackers took control of industrial refrigeration controllers across French supermarkets, cranking temperatures to 50°C and causing fires and widespread food spoilage. Ahold Delhaize (Stop & Shop, Giant, Food Lion) also disconnected systems following a separate cyberattack disrupting stores in the US, Netherlands, and Belgium. TFG London, parent of Hobbs and Whistles, confirmed a third retail cyberattack in the same week.
Ledger Hardware Wallet Spy Chip — $86 Million Stolen
Researchers confirmed an $86 million cryptocurrency theft via a hardware implant discovered inside Ledger signing devices. Ledger confirmed the finding — a supply chain attack at the physical level, challenging the assumption that hardware wallets provide stronger security than software alternatives.
Vulnerabilities and Patches
Microsoft October 2026 Patch Tuesday — Record 1,413 Vulnerabilities
The largest Patch Tuesday in Microsoft's history: 1,413 vulnerabilities patched including 3 actively exploited zero-days. Prioritise the Windows elevation of privilege zero-day and RCE vulnerabilities in Windows NTFS, DNS Server, and DHCP Server. Adobe patched 176 vulnerabilities across 11 products in the same cycle.
Ivanti Connect Secure Zero-Day — Root Access on Patched VPNs
A new zero-day in Ivanti Connect Secure is being actively exploited. A chained exploit was confirmed giving attackers root access to fully patched VPN appliances. CISA issued an emergency directive. This is a drop-everything situation for Ivanti administrators.
GitLab — Maximum Severity RCE
GitLab patched a maximum severity remote code execution vulnerability. Self-hosted GitLab instances should be updated immediately.
SAP Patches Critical NetWeaver and S/4HANA Vulnerabilities
SAP patched a maximum severity OAuth2 SSRF flaw in NetWeaver and a set of critical S/4HANA vulnerabilities on 14 October.
Docker Hub Impersonation Flaw
A flaw in Docker Hub allowed attackers to impersonate users and tamper with container images. Patched this week.
Intelligence and Geopolitics
Spy device found at OpenAI — A Saudi national was charged after the FBI discovered a listening device planted in an OpenAI executive conference room. OpenAI and the FBI worked together on the investigation.
North Korean hackers targeting Ukraine — Confirmed intelligence gathering campaign targeting Ukrainian military and government experts, assessed as monitoring Russia's war operations.
Ukraine strikes Russian infrastructure — A third Yandex data centre struck, disrupting Russian cloud services. Russian travel booking platform also offline following cyberattack.
Microsoft disrupts Chinese phishing market — Coordinated takedown of a Chinese-language phishing-as-a-service platform responsible for over 1 billion phishing messages.
Ransomware — Physical Threats Emerge
Multiple reports this week document ransomware gangs escalating from digital extortion to physical intimidation — threatening family members and showing up at victims' homes. Researchers are calling this a new operational phase for the most aggressive groups.
Notable victims this week include: AT&T (INC Ransom), Pengurusan Aset Air Berhad (Malaysian national water authority — Qilin), SMIC US Company (US arm of China's SMIC semiconductor manufacturer — N0n), Finzly Corp (US fintech payments, payment infrastructure access keys exposed — N0n), American Campus Communities and Southwire and Rheem Global (Helix), and Storm Ransomware's three transport/maritime targets: Baltimore Tank Lines, Merit Financial Advisors, and Patriot Maritime.
UK and Critical Infrastructure
UK Housing Ombudsman Service — Investigating a security incident involving unusual activity on its systems.
TFG London / Hobbs and Whistles — Parent company Foschini Group confirms cyberattack disrupting the UK fashion retail brands.
Denmark-Germany tunnel construction — Cyberattack halted construction operations on the Fehmarnbelt tunnel project.
Municipality of Ovar, Portugal — Cyberattack knocked systems offline, forcing closure of civic services until 21 October.
HaveIBeenPwned — Week Additions
- Crunchbase — 559,908 accounts (January 2026 breach)
- Sharecare (digital health) — 318,185 accounts (ShinyHunters, August 2026)
- Gites de France (holiday rentals) — 117,574 accounts (May 2026 breach)
Industry Notes
Let's Encrypt — Cutting default certificate validity from 90 days to 64 days this quarter, ahead of the 45-day industry standard. Automate your renewals now.
Zod 4.6.6 — The popular JavaScript/TypeScript schema validation library flagged as potentially compromised. Developers should verify their dependency versions.
Anthropic self-replicating AI warning — Anthropic published research warning that small AI models on IoT devices could theoretically self-replicate across connected infrastructure.