Attackers switched supermarket fridges to defrost overnight across France and six other countries, and the EU agency ENISA confirmed its product law makes makers report flaws in old controllers but not fix them. A new extortion group listed 38 companies, most of them port and shipping operators, in one batch, six agencies traced SafePay ransomware to flaws from 2020 to 2024, and PHP shipped fixes that skip every version below 8.2.
Attackers hit the management layer and unsupported kit, where a patch alone does not end the incident.
Attackers switched supermarket refrigeration controllers to defrost overnight around 11 to 12 October, spoiling chilled food in seven European countries. CERT-FR named Danfoss and Copeland units, and the EU's product law will not force either maker to fix the old ones.
Attackers set supermarket refrigeration controllers to defrost around 11 to 12 October, spoiling food in seven European countries. France took most of the damage, and CERT-FR named Danfoss and Copeland units.
Many of those controllers are end-of-life. ENISA says the Cyber Resilience Act obliges makers to report exploited flaws in them, not to fix them, so grocers carry the cost of replacement.
The PHP project shipped fixes on 21 October for two flaws that let anyone run commands on a web server, scored 9.2. Versions 8.1 and older get nothing, and a Detectify researcher puts roughly half of PHP websites there.
The PHP project shipped fixes on 21 October for two flaws, scored 9.2, that let anyone run commands on a web server. Hundreds of sites, including Nintendo and Berlin's Charité, went offline beforehand.
Versions 8.1 and older get no fix. Detectify's Joviane Jardim says roughly half of PHP websites run them, so their only route is a full upgrade.
The data-theft group N0n listed 38 companies from 18 countries and territories in one batch on 12 October, most of them port and shipping operators, nearly all on the same deadline. The batch put a newcomer on top of October's leak-site board.
The data-theft group N0n listed 38 companies, mostly port and shipping operators, on its leak site on 12 October. The claims span 18 countries and territories, and 37 share one 19 October deadline.
One batch, one clock and one data shape suggest a shared supplier, though nobody has confirmed it. N0n now leads October's leak-site count with 122 claims.
Volexity found an unknown actor exploiting three chained Ivanti Connect Secure flaws from 3 October, ten days before Ivanti disclosed the first. The last link still has no patch, and Ivanti's own checker saw nothing.
Volexity found an unknown actor, UTA0576, exploiting three chained Ivanti Connect Secure flaws from 3 October. Ivanti disclosed the first on 13 October, and the final link still has no patch.
The intruder worked only in memory, so Ivanti's checker saw nothing. It took directory and administrator passwords, which stay valid after any upgrade until someone changes them.
BeyondTrust says a 9.3-rated flaw in its Remote Support help-desk tool was exploited as a zero-day from 29 August. It fixed its hosted customers by 9 October and told self-hosted operators on 15 October.
BeyondTrust disclosed on 15 October that a 9.3-rated flaw in its Remote Support help-desk tool was exploited from 29 August. Google's Mandiant ties it to ARMORY CASTLE, a suspected China-linked espionage group.
BeyondTrust patched its cloud customers by 9 October. Self-hosted operators learnt of the flaw six days later, from the public advisory.
Ahold Delhaize's chief executive said on 19 October that the previous week's outages at its grocery brands "was caused by the malicious actions of others". Stores stayed open, but US online shopping had not returned.
Ahold Delhaize confirmed on 19 October that outages across its US and European grocery brands were deliberate. Chief executive Frans Muller blamed "the malicious actions of others"; stores stayed open.
US online shopping was still down on 19 October, and Albert Heijn expects deliveries back by 23 October. Ahold Delhaize says it has found no sign that data was taken.
A joint advisory from agencies in the US, Germany and the UK credits SafePay with at least 600 victims and names five entry flaws dated 2020 to 2024. All five were already on CISA's exploited list.
Six agencies from the US, Germany and the UK published a joint advisory on 20 October crediting the SafePay ransomware group with at least 600 victims. It names five entry flaws dated 2020 to 2024.
All five had sat on CISA's exploited-flaw list for two to three years. Two are in Veeam backup servers, the systems victims would restore from.
Attackers exploited a flaw in EG Secure Solutions' SiteGuard web firewall, prompting a JPCERT/CC emergency alert on 14 October. A day later Qilin posted files it says came from Tokyo rail group Keio Corporation.
EG Secure Solutions confirmed on 14 October that attackers were exploiting a flaw in its SiteGuard web firewall. JPCERT/CC issued an emergency alert, and Qilin posted Keio Corporation files on 15 October.
Japanese police count 53 Qilin victims in Japan since April 2023. Operators patching SiteGuard must save diagnostic data first, because the update may erase attack traces.
ESET says a Russia-aligned espionage group phished a Ukrainian grain logistics firm in July 2025 and apparently handed the access to Sandworm, which wiped the company's data that September.
ESET reported on 21 October that a Ukrainian grain logistics firm lost its data to a wiper in September 2025. It says UAC-0099 phished the company, then apparently handed its access to Sandworm.
The intruders steered their implants through Yggdrasil, a peer-to-peer network with no central server. ESET calls it the first documented abuse of Yggdrasil by a state-aligned actor.
Russian host FirstVDS says attackers used a flaw in ISPsystem's VMmanager 6 to open customers' server disks and copy passwords, cloud credentials and crypto wallets. The servers themselves show no trace.
Russian host FirstVDS said on 17 to 18 October that attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and crypto wallets. ISPsystem's fix was incomplete on 19 October.
The copying ran from the management layer, so customers' own servers show no trace. Travel agency Anywayanyday separately halted bookings on 14 October after an attack.
São Paulo's Hospital Sírio-Libanês disclosed on 16 October that a September attack reached a reporting system tied to its social projects, possibly exposing patients' and staff's health and identity data.
São Paulo's Hospital Sírio-Libanês disclosed on 16 October that a 21 September attack reached a reporting system tied to its social projects. Names, identity numbers and health data may be exposed.
Its main patient database was untouched, the hospital said on 16 October, and care continued. The hospital notified Brazil's data-protection authority and federal police, and it appears on a criminal leak site.
Attacks on Atlassian Data Center flaw CVE-2026-21589 began within hours of watchTowr Labs publishing its analysis on 6 October. CISA listed the flaw as exploited on 15 October.
Attacks on Atlassian Data Center flaw CVE-2026-21589 began within hours of WatchTowr Labs publishing its analysis on 6 October. Data Center is the self-hosted edition of Atlassian's software.
CISA, the US cyber-defence agency, listed the flaw as exploited on 15 October. Organisations running their own Atlassian servers had faced attacks since the week before that listing.
Microsoft's own October security update document lists 1,456 Microsoft-assigned flaws, one of them exploited. September's document holds 998.
Microsoft's October security update document lists 1,456 flaws it assigned in its own software. One of them carries Microsoft's exploited flag.
September's document now holds 998 entries, so October's count is far larger. The figure comes from Microsoft's own data rather than from press tallies of the monthly release.
South Africa's The Foschini Group found an attack on 11 October that disrupted IT systems at its British fashion arm, TFG London. Stores stayed open.
South Africa's The Foschini Group found an attack on 11 October that disrupted IT systems at its British fashion arm, TFG London. It disclosed the attack on 13 October.
Stores stayed open and no attacker has been named. The discovery came five days after ASOS customers received a rogue alert through the retailer's app.
France's CERT-FR reviewed nearly 200 web-application data breaches from 2025 and found that many needed no technical vulnerability, only low-complexity attacker actions.
France's national computer emergency response team, CERT-FR, published a review on 20 October of nearly 200 web-application data breaches it tracked in 2025.
Many of those breaches needed no technical vulnerability, only low-complexity actions by the attacker. Patching alone would not have stopped them, so the report points at basic web-application hygiene.
Police in North Macedonia, working with the FBI, arrested the alleged administrator of OLVX, a stolen-data market with over 1,500 seller accounts.
Police in North Macedonia, working with the FBI, arrested the alleged administrator of OLVX in mid-October. The market, OLVX, hosted over 1,500 seller accounts trading stolen data.
North Macedonian police say the suspect ran it. Arresting the alleged administrator goes after the platform those sellers relied on, rather than any single seller.
Up in the near term, on two named triggers. Ivanti has promised a fix for the Connect Secure privilege-escalation link only in the coming weeks, so agencies that met CISA's 16 October deadline for CVE-2026-104935 still run an exploitable chain, and published details of the unpatched link before that fix would widen use beyond UTA0576. PHP2Shell is the second: WatchTowr Labs has seen attempts but no success, and a working exploit would hit sites on 8.1 or older, which have no patch at all, a pool that grows when 8.2 reaches end of life on 31 December 2026.
