All Articles

The week in one line: Edge and remote-access appliances were the way in again, and a patched device was not a clean one. Attackers reached root on a fully patched Ivanti VPN, a China-nexus group used a BeyondTrust zero-day 47 days before it was disclosed, and Cisco and Palo Alto Networks both reported exploited flaws with the same federal deadline. Meanwhile Ahold Delhaize and French supermarkets showed that the cost of an incident is often an outage, not a data theft.

The week's most significant incidents

1. Ivanti's zero-day chain gave attackers root on a fully patched VPN

Volexity found three Ivanti Connect Secure zero-days chained for unauthenticated, root-level code execution during an incident response at one customer, whose appliance ran a fully patched 22.8R2.4 build. Activity dates to at least October 3. The actor, tracked as UTA0576, took domain credentials stored on the appliance, queried Active Directory, searched for LAPS passwords and BitLocker recovery keys and sprayed passwords. Volexity found no backdoor or web shell, and the exploit evaded Ivanti's Integrity Checker Tool. Two flaws are fixed, tracked together as CVE-2026-104935. A privilege escalation flaw is still unpatched, with a fix promised in the coming weeks. Ivanti says exploitation is limited, and Shadowserver counts more than 5,500 exposed instances. CISA's listing carries an October 16 deadline, per SC Media. Sources differ on the fixed-build list, so check your build against Ivanti's advisory. The practical lesson is that a VPN appliance is a credential store. Treat anything it holds as exposed if it was reachable.

Re-verified against SecurityWeek, which matches the details above and carries no corrections. See the October 13 edition for the full checklist. Sources: SecurityWeek, The Hacker News, BleepingComputer

2. BeyondTrust zero-day used for 47 days before disclosure

BeyondTrust says CVE-2026-102764 in Remote Support was first exploited on August 29 against one BeyondTrust-hosted instance and one self-hosted appliance. Its own threat hunt found the SaaS intrusion on September 28, and it contained that incident 27 minutes after detection. A patch followed on October 8 and coordinated disclosure on October 15. BeyondTrust assesses with moderate to high confidence that a China-nexus espionage group is responsible, which Mandiant tracks as UNC5221 (ARMORY CASTLE) and CrowdStrike as WARP PANDA. The actor reportedly deleted system, web server and application logs on the appliance. For that reason BeyondTrust advises forwarding appliance logs off the box in near real time. Privileged Remote Access shares the affected code, and BeyondTrust patched it as a precaution after finding no way to exploit it. Technical detail is being withheld until self-hosted appliances are patched. Sources date the SaaS patch to October 8 or 9.

Re-verified against the vendor advisory page. The October 15 edition is awaiting approval, so see the Breach Intelligence hub for it. Sources: BeyondTrust, The Hacker News, Cyber Security News

3. Cisco and Palo Alto Networks report exploited edge flaws with the same federal deadline

Cisco confirmed active attacks on CVE-2026-76519 (CVSS 9.8), where a crafted email attachment lets an unauthenticated attacker write files and run commands as root on Secure Email Gateway. Exposure requires File Reputation to be enabled and Content Scanner Tools earlier than 25.3.0.5525. Fixes shipped September 14 in 15.5.5-014 and 16.5.0-780, release 16.0 has no fixed build, and Cisco lists no workaround. It is the second exploited flaw in this product since mid-September. Separately, Palo Alto Networks disclosed CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface that gives root on PA-Series, VM-Series and Panorama. The vendor reports very limited exploitation and lists no workaround beyond restricting management access to trusted internal addresses. Both flaws carry an October 17 CISA deadline. For Cisco, a fix available for a month before exploitation was reported is the time to ask whether anyone reviewed the device, not only whether it was updated.

Cisco re-verified against SecurityWeek (October 15). See the October 14 edition for the checklist. Sources: SecurityWeek, Palo Alto Networks advisory, The Hacker News

4. Ahold Delhaize takes systems offline across U.S. and European banners

On October 12 Ahold Delhaize said it had taken some systems offline as a precaution after a security issue in its network, and that all stores remained open. The group runs more than 9,400 stores and serves about 60 million customers a week. Grocery Dive reports the websites of all five U.S. banners (Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company) were down, and NL Times reports online ordering and loyalty programs offline for Albert Heijn, Etos and Gall & Gall. The cause, the attacker, any data access and the restoration timeline had not been confirmed. The company chose containment over availability, and the public record shows that supplier, online and employee tools failed while stores traded. Whether your business can run in that reduced state is a question to test before an incident forces it.

Re-verified against Grocery Dive after the BleepingComputer page could not be fetched. See the October 12 edition. Sources: BleepingComputer, Grocery Dive, NL Times

5. French supermarket refrigeration controllers were reportedly overheated

Overnight on October 11 and 12, attackers reportedly raised defrost and temperature settings on Danfoss refrigeration controllers, spoiling food. SecurityWeek, citing Reuters, names Auchan, Carrefour, E.Leclerc, Intermarche and Monoprix. Store counts range from 250 to 350 (BleepingComputer, citing French outlets) to more than 300 (SecurityWeek, citing BFM TV), and neither is independently verified. Danfoss said most affected equipment was legacy hardware that no longer receives security updates, and Intermarche pointed to a service provider that manages its refrigeration. If that holds, the common point across competing chains is a shared third party and a shared device family. The Paris prosecutor has opened an investigation. The entry method and the attacker are not confirmed.

Not re-verified separately this week. See the October 12 edition. Sources: BleepingComputer, SecurityWeek, Security Boulevard

6. Meta says a stolen employee credential opened its GitHub repositories

Meta told SecurityWeek that an outside group used a stolen employee credential to reach some of its GitHub repositories. About 99 percent of the data was business data, mainly code tied to some products. The remaining 1 percent was personal data on about 1,500 people, mostly U.S. employees, which Meta says was placed in the repositories by mistake against policy, much of it synthetic or anonymized test data. Meta says this was not a product vulnerability and its internal systems were not breached. It shut down the access with GitHub and law enforcement, rotated secrets in the affected repositories and is adding scanning for user data uploaded in error. How the credential was stolen, and whether the code was altered, have not been disclosed. This is one primary disclosure, republished by a second outlet.

Re-verified against SecurityWeek (October 13). See the October 13 edition. Sources: SecurityWeek, Cyber Security News

Also across the week

• SonicWall SMA1000: CVE-2026-102255 (CVSS 10.0), a pre-authentication SSRF flaw patched October 6. Two threat intelligence firms logged probing on honeypots from October 8. It is the product line's third fix this year, and the July and September flaws were exploited. Whether any attempt succeeded is unconfirmed.
• Nextcloud Collabora CODE: CVE-2026-110447, unauthenticated command injection in the richdocumentscode app. The first logged attack was September 10, the fix shipped September 11 and the advisory followed October 14. Three administrators reported compromises, and older Nextcloud versions can still be served an affected build.
• GitLab: CVE-2026-97229 (CVSS 10.0) in the CI/CD regular expression compiler, fixed in 19.2.8, 19.3.5 and 19.4.2. GitLab.com is already patched, and neither source reports exploitation.
• Ledger: the company confirmed a hardware implant in devices sold through one reseller, with analysts estimating losses of $72 million to more than $86 million. Those totals are analyst estimates, not Ledger figures.
• P7 DarkSword and GhostAction: a new iPhone spyware variant adds keychain and wallet theft, and a credential-stealing GitHub workflow campaign returned, with Socket counting more than 500 accounts since October 7 (its own count).
• Microsoft Patch Tuesday: a record 1,411 flaws (BleepingComputer) or 1,413 (SecurityWeek), including an exploited Windows Shell bypass, CVE-2026-96951, with an October 16 federal deadline.
• Microsoft and Health-ISAC disrupted three phishing kits and a marketplace tied to more than one billion messages sent to more than 75,000 organizations since January. DPRK laptop farms: 14 people charged and more than 40 farms reportedly shut down.
• AhsayCBS: two exploited flaws, with Ahsay confirming on October 10 that its first fix was inadequate and issuing a second hotfix. Also in the hub: TFG London, iRhythm (360,000 people), Park Dental Partners' SEC filing, Citizen Lab's report on spyware delivered through ads, Docker Hub, SAP, curl and H&M's unverified ShinyHunters claim.

What to watch next week

FAQ

What was the biggest breach story of the week?
Ivanti Connect Secure, where Volexity found three zero-days chained for root access on a fully patched VPN appliance. One flaw is still unpatched, and Ivanti says exploitation is limited.

Which edge products had reported exploitation this week?
Ivanti Connect Secure, Cisco Secure Email Gateway, PAN-OS, BeyondTrust Remote Support and AhsayCBS, plus probing of SonicWall SMA1000. Ivanti, Cisco and PAN-OS carry CISA deadlines of October 16 or 17.

Does a patched appliance mean a clean appliance?
No. The Ivanti victim was fully patched, BeyondTrust's zero-day was used 47 days before disclosure, and Cisco's fix was available a month before exploitation was reported. Ask whether the device was reviewed for compromise, not only whether it was updated.

What did Ahold Delhaize and the French supermarket attacks show?
That the cost can be an outage. Both involved shared systems or a shared provider, and neither had a confirmed data theft at the time of reporting. Test how much of the business runs when central identity, ordering or facilities systems are offline.

What should a CISO do first on Monday?
Inventory internet-facing remote access, email and management appliances, restrict management interfaces, forward their logs off the device, and treat credentials stored on any exposed appliance as candidates for rotation.

More from the community: the CISO Platform Breach Intelligence hub, and peer resources on vulnerability management, third-party risk, and ransomware.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.