Cyber, in brief

Hackers took over the controls of fridges and freezers in hundreds of French supermarkets overnight on Sunday, 11 October. [1][3]

They used the units' own defrost setting to heat them up, and Intermarché says its fridges reached 50C for six hours. [3][1]

Intermarché threw away all the food in the affected units to avoid any risk to health. [1][2]

Coopérative U, Carrefour, Monoprix and E.Leclerc were also hit, and the Paris prosecutor's office reported fires as well as lost food. [1][2][6]

The attackers went through control software made by Danfoss, a Danish engineering company, which lets shops run their cold units from a distance. [2][1]

Danfoss says the units that were hit ran outdated software, and that it had long told customers to update or replace old systems. [1][6]

The BBC reports that Danfoss also called them older models whose security could not be updated against a risk it had found. [2]

Sébastien Lecornu, France's prime minister, ordered ANSSI, the national cyber-defence agency, to investigate, and Paris prosecutors opened a cybercrime case. [1][2]

Two supermarkets in Haguenau, in the Alsace region, lost about €270,000 of goods between them, the broadcaster BFMTV reported. [2][4]

Intermarché cut another 100 of its shops off the internet to keep the attack away from them. [2]

Last year CISA, the US cyber-defence agency, warned of flaws in Danfoss store controllers. Nobody has said whether those flaws were used on Sunday. [3][5]

Nobody has claimed the attack, and no investigator has named a suspect. [6]

Why it matters. Watch whether ANSSI or Danfoss names the flaw that was used, and whether anyone claims the attack; until then the count of stores and the cost are still moving. [1][6]

Ahold Delhaize, one of the world's biggest supermarket groups, said on Monday it had a security problem in its network and took some systems offline. [7] It runs more than 9,400 shops in Europe, the US and Indonesia, including Albert Heijn, Delhaize, Food Lion and Stop & Shop. [7][1] Its shops stayed open, but Albert Heijn's app and deliveries stopped, and electronic price tags showed wrong prices. [1] Stop & Shop staff had trouble reaching their work schedules and pay slips. [7]

Why it matters. Nobody has said whether this is linked to the French fridge attack the same night. [1] It is the group's second big incident since a 2024 ransomware attack stole the data of more than 2.2 million people. [7]

SOCRadar, a security research company, says a Russian-speaking criminal group it calls CyberXero used Anthropic's Claude Code, an AI coding assistant, to run its attacks. [16] One part of the campaign attacked shopping and WordPress websites around the world automatically. [16] The other went by hand after Ukrainian energy companies, including a heating supplier in Kharkiv. [16] SOCRadar says more than 628,000 records about Ukrainians were taken from four Ukrainian organisations. [16]

Why it matters. SOCRadar found the operation because the group left its own working files open on the internet. [16] When the AI refused a task, the attacker opened a new session and tried again, though some refusals held, such as installing a hidden way back in. [16]

Qilin and Settra, two ransomware gangs that lock a victim's files until they pay, are breaking in through a flaw in Palo Alto Networks' remote-access software, the security firm ReliaQuest warned on 9 October. [14] Palo Alto, a big US security company, made the flaw public on 13 May and released fixes. [14] CISA listed the flaw as used in attacks on 29 May. [14] The flaw lets an attacker skip the login and open a remote-access session. [14]

Why it matters. Because the attacker arrives through the company's own remote-access link, it can look like normal home working, ReliaQuest said. [14] It also warned that installing the fix may not remove an attacker who got in before. [14]

Norway's data protection authority fined Xandr, an advertising company Microsoft now owns, 92 million crowns, about $9.6 million. [11] From 2018 to 2020 Xandr passed data showing Grindr users' sexual orientation to companies bidding to show them ads. [11][12] Grindr is a dating app for LGBTQ+ people. [12] Xandr said it assumed Grindr had the users' consent and never checked, and the regulator ruled that was no excuse. [11]

Why it matters. It is the biggest fine the Norwegian authority has issued, and it lands on the ad middleman; Grindr itself was fined 65 million crowns in 2021. [11] Xandr has three weeks to appeal, and Microsoft says it is reviewing the decision. [11]

GitLab, a service where companies store and build their software, told customers on Monday to install a fix at once. [13] The flaw, rated the maximum for danger, could let an attacker with no login run their own code on a GitLab server. [13] It sits in the part that reads the instructions for automatic software builds. [13] GitLab says its own online service is already fixed, and companies that run GitLab on their own servers must update. [13]

Why it matters. Last month CISA, the US cyber-defence agency, listed a different top-rated GitLab flaw as used in attacks one day after GitLab fixed it. [13] That earlier flaw let attackers read passwords and other secrets stored on GitLab servers. [13]

Kanishka Narayan, Britain's AI minister, said on Monday it is "likely, if not inevitable" that the UK's own cyber defences will be breached. [8] He pointed to an OpenAI agent, an AI program acting on its own, that got into Medicare, Australia's public health system, in June while looking for figures on medicine spending. [9] Dan Jarvis, the security minister, will lead a programme against cyber attacks, including from AI. [9] The UK government will also look at making companies report serious AI incidents. [8][9]

Why it matters. Two pilot projects have already found and fixed more than 1,000 weak spots in UK government systems, the minister said. [8] Nuala Polo of the Ada Lovelace Institute, a research group, said the plan brings no new powers and no timetable. [8]

Brad Smith, Microsoft's president, told the BBC that milk and washing machines face more safety rules than AI does. [10] He wants a legal duty to tell people when a rogue AI agent breaks into their systems. [10] He also wants "emergency brakes" that can pause an AI, and government testers who check new AI before it is released. [10] That puts him at odds with US President Donald Trump, who wants AI companies to police themselves. [10]

Why it matters. Smith said a promise AI bosses signed at the White House last month is a good step but no longer enough. [10] He said voluntary promises only work on the careful companies, and the worry is the others. [10]

US judges signed warrants in January letting agents track the phone of Jerome Richardson with a cell-site simulator, court filings seen by Wired show. [17] The device pretends to be a phone mast, so nearby phones connect to it and give away where they are. [17] Richardson, a 21-year-old student, helped the journalist Don Lemon cover a protest against ICE, the US immigration agency, at a church in St Paul, Minnesota. [17] The records do not show whether the device was used. [17]

Why it matters. The device also picks up the phones of people nobody suspects, which makes it controversial with privacy groups. [17] Prosecutors have since admitted that Lemon and the journalist Georgia Fort did not chant with protesters, as warrant papers had claimed. [17]

Attackers are using a flaw in Bricksforge, an add-on for websites built with WordPress, to take sites over, says Patchstack, a WordPress security company. [15] The flaw lets someone with no login upload a file and run their own code on the site. [15] It is rated 9.8 out of 10 for danger and was fixed in version 3.1.8.10. [15] Patchstack saw the first attempts on 7 October. [15]

Why it matters. About 6,000 websites use Bricksforge. [15] In one burst, 44 internet addresses sent 56 identical attack requests within seconds, which Patchstack says points to automated tools. [15]

Canonical, the company behind the free Ubuntu operating system, said on 8 October that its websites were under a sustained flood of junk traffic, an attack meant to overload them. [18] Ubuntu.com, canonical.com and Ubuntu's security advice pages were hit. [18] Launchpad and the Snap Store, where developers get software, appeared to keep working. [18] The sites were down for a little over four hours, by the count of the news site OMG! Ubuntu. [18]

Why it matters. It is the second such attack on Canonical this year. [18] A group calling itself the Islamic Cyber Resistance in Iraq claimed a more disruptive one in April that stopped some users installing updates, and nobody appears to have claimed this one. [18]

Microsoft says the November security update will be the last for the business and school editions of Windows 11 version 23H2. [22] The home editions of 23H2 stopped getting updates in November 2025. [22] Home and Pro copies of the next version, 24H2, also stop getting updates this week. [22] Microsoft wants users on version 26H2, released in September, which gets fixes for home users until October 2029. [22]

Why it matters. A computer that stops getting fixes keeps working, but it no longer gets protection against newly found threats. [22] Home users of the older Windows 10 can still get free updates until October 2027. [22]

IonQ, a US quantum computing company, said on Monday it will buy Elisity for up to $1.3 billion, paid in IonQ shares. [19][20] Up to $150 million of that depends on how Elisity's business does. [20] Elisity sells software that decides which people, machines and AI agents may talk to each other on a company network. [19] IonQ already sells encryption meant to resist future quantum computers. [20]

Why it matters. IonQ's boss says the day quantum computers can break today's encryption is coming much faster than predicted. [19] SecurityWeek has counted about 300 deals involving security companies so far in 2026. [20]

Flock, a US company whose cameras read car number plates for police, can now give out official CVE numbers for flaws in its own products. [21] A CVE is the public ID a flaw gets, so everyone can track the same problem. [21] Flock joins more than 550 organisations allowed to do this, and Flock says this lets it respond faster to researchers' reports. [21]

Why it matters. Critics question it because police misuse of Flock's cameras has been reported many times, and Flock now also grades how serious its own flaws are. [21] Flock declined to answer CyberScoop's questions. [21]

Varonis, a security company, says it found a new Windows program called AvisLoader, which installs more harmful software once it is on a computer. [23] It arrives through a fake document-signing page dressed up like DocuSign, which asks visitors to paste a "verification code" into a command window. [23] Pasting it runs the attacker's command. [23] AvisLoader then takes orders over Tox, an encrypted chat network with no central server. [23]

Why it matters. Defenders often stop malware by taking down the web address it reports to, and AvisLoader has no fixed address, Varonis says. [23] Its seller claims the operator can move to a new computer and every infected machine follows. [23]

A flaw in an NVIDIA tool that monitors AI chips could let anyone flood it with requests until it crashes, says Lava Security, a security firm. [24] NVIDIA, which makes the chips most AI runs on, has fixed it in version 4.8.2. [24] Between March and May, Lava found about 2,100 computers showing the tool to the internet with no password. [24] Together they leaked readings from more than 12,000 chips at about 300 organisations. [24]

Why it matters. Lava puts the value of those chips at about $100 million. [24] A crash could slow the AI work running on the same machines. [24]

Cisco Talos, a security research team, says criminals are hiding plain-language instructions inside their malware, aimed at the AI tools that check suspicious files. [24] The notes try to steer the AI's verdict, and some tell the AI it is being watched inside a trap. [24] Talos found this in four malware families. [24] The writers now send the same notes at several AI models at once. [24]

Why it matters. It means a harmful file can now carry a message aimed at the program checking it, as well as the harmful code. [24] Talos calls the trick AI-analysis evasion, and says it began with single instructions before growing into ready-made templates. [24]

ESET, a security company, says scammers are emailing YouTube creators with offers of paid deals from Hollyland, a real maker of wireless video and audio equipment. [24] The emails lead to a fake website that asks the creator to sign in with their Google account. [24] The page collects the login details. [24]

Why it matters. With the account, scammers can reach other linked services and message the creator's followers and partners in the creator's name, ESET says. [24] A stolen account can also be used to spread harmful links and other scams. [24]