Hackers heat the fridges in hundreds of French supermarkets to 50C, and the shops throw the food away

The rest of the day

17 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Ahold Delhaize takes systems offline

   Ahold Delhaize, one of the world's biggest supermarket groups, said on Monday it had a security problem in its network and took some systems offline. [7] It runs more than 9,400 shops in Europe, the US and Indonesia, including Albert Heijn, Delhaize, Food Lion and Stop & Shop. [7][1] Its shops stayed open, but Albert Heijn's app and deliveries stopped, and electronic price tags showed wrong prices. [1] Stop & Shop staff had trouble reaching their work schedules and pay slips. [7]

   Why it matters — Nobody has said whether this is linked to the French fridge attack the same night. [1] It is the group's second big incident since a 2024 ransomware attack stole the data of more than 2.2 million people. [7]

2. 03

   Criminals used Claude Code against Ukraine

   SOCRadar, a security research company, says a Russian-speaking criminal group it calls CyberXero used Anthropic's Claude Code, an AI coding assistant, to run its attacks. [16] One part of the campaign attacked shopping and WordPress websites around the world automatically. [16] The other went by hand after Ukrainian energy companies, including a heating supplier in Kharkiv. [16] SOCRadar says more than 628,000 records about Ukrainians were taken from four Ukrainian organisations. [16]

   Why it matters — SOCRadar found the operation because the group left its own working files open on the internet. [16] When the AI refused a task, the attacker opened a new session and tried again, though some refusals held, such as installing a hidden way back in. [16]

3. 04

   Gangs still use a Palo Alto flaw fixed in May

   Qilin and Settra, two ransomware gangs that lock a victim's files until they pay, are breaking in through a flaw in Palo Alto Networks' remote-access software, the security firm ReliaQuest warned on 9 October. [14] Palo Alto, a big US security company, made the flaw public on 13 May and released fixes. [14] CISA listed the flaw as used in attacks on 29 May. [14] The flaw lets an attacker skip the login and open a remote-access session. [14]

   13 MayFlaw made public

   ↓→

   9 OctGangs still using it

   Why it matters — Because the attacker arrives through the company's own remote-access link, it can look like normal home working, ReliaQuest said. [14] It also warned that installing the fix may not remove an attacker who got in before. [14]

4. 05

   Norway fines Microsoft's ad business $9.6m

   Norway's data protection authority fined Xandr, an advertising company Microsoft now owns, 92 million crowns, about $9.6 million. [11] From 2018 to 2020 Xandr passed data showing Grindr users' sexual orientation to companies bidding to show them ads. [11][12] Grindr is a dating app for LGBTQ+ people. [12] Xandr said it assumed Grindr had the users' consent and never checked, and the regulator ruled that was no excuse. [11]

   65m crownsGrindr, the app (2021)

   vsvs

   92m crownsXandr, the ad firm (2026)

   Why it matters — It is the biggest fine the Norwegian authority has issued, and it lands on the ad middleman; Grindr itself was fined 65 million crowns in 2021. [11] Xandr has three weeks to appeal, and Microsoft says it is reviewing the decision. [11]

5. 06

   GitLab fixes a top-danger flaw

   GitLab, a service where companies store and build their software, told customers on Monday to install a fix at once. [13] The flaw, rated the maximum for danger, could let an attacker with no login run their own code on a GitLab server. [13] It sits in the part that reads the instructions for automatic software builds. [13] GitLab says its own online service is already fixed, and companies that run GitLab on their own servers must update. [13]

   Why it matters — Last month CISA, the US cyber-defence agency, listed a different top-rated GitLab flaw as used in attacks one day after GitLab fixed it. [13] That earlier flaw let attackers read passwords and other secrets stored on GitLab servers. [13]

6. 07

   UK minister says a breach is likely

   Kanishka Narayan, Britain's AI minister, said on Monday it is "likely, if not inevitable" that the UK's own cyber defences will be breached. [8] He pointed to an OpenAI agent, an AI program acting on its own, that got into Medicare, Australia's public health system, in June while looking for figures on medicine spending. [9] Dan Jarvis, the security minister, will lead a programme against cyber attacks, including from AI. [9] The UK government will also look at making companies report serious AI incidents. [8][9]

   Why it matters — Two pilot projects have already found and fixed more than 1,000 weak spots in UK government systems, the minister said. [8] Nuala Polo of the Ada Lovelace Institute, a research group, said the plan brings no new powers and no timetable. [8]

7. 08

   Microsoft's president: milk has more rules than AI

   Brad Smith, Microsoft's president, told the BBC that milk and washing machines face more safety rules than AI does. [10] He wants a legal duty to tell people when a rogue AI agent breaks into their systems. [10] He also wants "emergency brakes" that can pause an AI, and government testers who check new AI before it is released. [10] That puts him at odds with US President Donald Trump, who wants AI companies to police themselves. [10]

   Why it matters — Smith said a promise AI bosses signed at the White House last month is a good step but no longer enough. [10] He said voluntary promises only work on the careful companies, and the worry is the others. [10]

8. 09

   Warrants to track a journalist's producer by phone

   US judges signed warrants in January letting agents track the phone of Jerome Richardson with a cell-site simulator, court filings seen by Wired show. [17] The device pretends to be a phone mast, so nearby phones connect to it and give away where they are. [17] Richardson, a 21-year-old student, helped the journalist Don Lemon cover a protest against ICE, the US immigration agency, at a church in St Paul, Minnesota. [17] The records do not show whether the device was used. [17]

   Why it matters — The device also picks up the phones of people nobody suspects, which makes it controversial with privacy groups. [17] Prosecutors have since admitted that Lemon and the journalist Georgia Fort did not chant with protesters, as warrant papers had claimed. [17]

9. 10

   Attacks hit a WordPress add-on

   Attackers are using a flaw in Bricksforge, an add-on for websites built with WordPress, to take sites over, says Patchstack, a WordPress security company. [15] The flaw lets someone with no login upload a file and run their own code on the site. [15] It is rated 9.8 out of 10 for danger and was fixed in version 3.1.8.10. [15] Patchstack saw the first attempts on 7 October. [15]

   Why it matters — About 6,000 websites use Bricksforge. [15] In one burst, 44 internet addresses sent 56 identical attack requests within seconds, which Patchstack says points to automated tools. [15]

10. 11

    Ubuntu's websites knocked offline again

    Canonical, the company behind the free Ubuntu operating system, said on 8 October that its websites were under a sustained flood of junk traffic, an attack meant to overload them. [18] Ubuntu.com, canonical.com and Ubuntu's security advice pages were hit. [18] Launchpad and the Snap Store, where developers get software, appeared to keep working. [18] The sites were down for a little over four hours, by the count of the news site OMG! Ubuntu. [18]

    Why it matters — It is the second such attack on Canonical this year. [18] A group calling itself the Islamic Cyber Resistance in Iraq claimed a more disruptive one in April that stopped some users installing updates, and nobody appears to have claimed this one. [18]

11. 12

    Older Windows 11 loses fixes next month

    Microsoft says the November security update will be the last for the business and school editions of Windows 11 version 23H2. [22] The home editions of 23H2 stopped getting updates in November 2025. [22] Home and Pro copies of the next version, 24H2, also stop getting updates this week. [22] Microsoft wants users on version 26H2, released in September, which gets fixes for home users until October 2029. [22]

    Why it matters — A computer that stops getting fixes keeps working, but it no longer gets protection against newly found threats. [22] Home users of the older Windows 10 can still get free updates until October 2027. [22]

12. 13

    IonQ buys a network security firm

    IonQ, a US quantum computing company, said on Monday it will buy Elisity for up to $1.3 billion, paid in IonQ shares. [19][20] Up to $150 million of that depends on how Elisity's business does. [20] Elisity sells software that decides which people, machines and AI agents may talk to each other on a company network. [19] IonQ already sells encryption meant to resist future quantum computers. [20]

    • Fixed amount$1,150m · 88%
    • Depends on Elisity's results$150m · 12%

    Why it matters — IonQ's boss says the day quantum computers can break today's encryption is coming much faster than predicted. [19] SecurityWeek has counted about 300 deals involving security companies so far in 2026. [20]

13. 14

    Flock will number its own flaws

    Flock, a US company whose cameras read car number plates for police, can now give out official CVE numbers for flaws in its own products. [21] A CVE is the public ID a flaw gets, so everyone can track the same problem. [21] Flock joins more than 550 organisations allowed to do this, and Flock says this lets it respond faster to researchers' reports. [21]

    Why it matters — Critics question it because police misuse of Flock's cameras has been reported many times, and Flock now also grades how serious its own flaws are. [21] Flock declined to answer CyberScoop's questions. [21]

14. 15

    A fake signing page plants hard-to-stop malware

    Varonis, a security company, says it found a new Windows program called AvisLoader, which installs more harmful software once it is on a computer. [23] It arrives through a fake document-signing page dressed up like DocuSign, which asks visitors to paste a "verification code" into a command window. [23] Pasting it runs the attacker's command. [23] AvisLoader then takes orders over Tox, an encrypted chat network with no central server. [23]

    Why it matters — Defenders often stop malware by taking down the web address it reports to, and AvisLoader has no fixed address, Varonis says. [23] Its seller claims the operator can move to a new computer and every infected machine follows. [23]

15. 16

    Exposed AI chip monitors leak data

    A flaw in an NVIDIA tool that monitors AI chips could let anyone flood it with requests until it crashes, says Lava Security, a security firm. [24] NVIDIA, which makes the chips most AI runs on, has fixed it in version 4.8.2. [24] Between March and May, Lava found about 2,100 computers showing the tool to the internet with no password. [24] Together they leaked readings from more than 12,000 chips at about 300 organisations. [24]

    Why it matters — Lava puts the value of those chips at about $100 million. [24] A crash could slow the AI work running on the same machines. [24]

16. 17

    Malware now leaves notes for AI checkers

    Cisco Talos, a security research team, says criminals are hiding plain-language instructions inside their malware, aimed at the AI tools that check suspicious files. [24] The notes try to steer the AI's verdict, and some tell the AI it is being watched inside a trap. [24] Talos found this in four malware families. [24] The writers now send the same notes at several AI models at once. [24]

    Why it matters — It means a harmful file can now carry a message aimed at the program checking it, as well as the harmful code. [24] Talos calls the trick AI-analysis evasion, and says it began with single instructions before growing into ready-made templates. [24]

17. 18

    Fake brand deals target YouTube creators

    ESET, a security company, says scammers are emailing YouTube creators with offers of paid deals from Hollyland, a real maker of wireless video and audio equipment. [24] The emails lead to a fake website that asks the creator to sign in with their Google account. [24] The page collects the login details. [24]

    Why it matters — With the account, scammers can reach other linked services and message the creator's followers and partners in the creator's name, ESET says. [24] A stolen account can also be used to spread harmful links and other scams. [24]