The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Ahold Delhaize takes systems offline after cyberattack
Company confirmed a "cybersecurity incident" and took some systems offline. Stores stay open. Websites, apps and customer service were reported down at Albert Heijn, Etos and Gall & Gall (Netherlands) and Delhaize (Belgium). Stop & Shop staff could not reach schedules and pay stubs. A Food Lion…
-
CyberXero uses Claude Code agents and PentAGI in a campaign that stole 628,000+ Ukrainian records
A Russian-speaking access broker active since July ran 51 specialized agents plus PentAGI tied to Cobalt Strike. One automated run scanned 4,708 targets, reached 429 WordPress admin panels and dropped 32 web shells in 61 seconds. Targeted work hit Ukrainian energy and critical infrastructure…
-
GitLab patches maximum-severity unauthenticated RCE (CVE-2026-97229)
Integer overflow in the CI/CD regular expression compiler lets an unauthenticated user run code on self-managed GitLab CE/EE via a crafted pattern in a pipeline config. Fixed in 19.2.8, 19.3.4 and 19.4.2. GitLab.com and Dedicated are already patched. No exploitation reported yet. Tech Jacks…
-
IonQ to acquire zero trust firm Elisity for up to $1.3 billion
All-stock deal adding Elisity's least-privilege access technology to IonQ. Quantum company buying into network security.
-
Bricksforge WordPress plugin flaw (CVE-2026-85097, CVSS 9.8) exploited
Unauthenticated arbitrary file upload leading to code execution. Versions 3.1.8.9 and earlier; fixed in 3.1.8.10. Patchstack saw automated exploitation attempts from Oct 7. No actor attributed.
-
Daiichi Kosho (Big Echo) supplier breach exposes about 8.7 million customers
Malware on an employee PC at supplier Nippon Columbia Group on Oct 1 to 2; supplier reported it Oct 5; Daiichi Kosho disclosed Oct 8. About 8,724,000 customers' names, genders, birth dates, emails and phone numbers may be exposed. NCG is still investigating whether data was actually taken.
-
FBI arrests Canadian ransomware negotiation executive in ShinyHunters probe
Reported as Edward Dubrovsky (court records spell "Dobrovsky") of Toronto-based CyberSteward, arrested after traveling to a Philadelphia conference. Charges include extortion conspiracy; case moved to the Eastern District of Texas. Third ShinyHunters arrest in weeks (Netherlands Sep 15, Jordan Sep…
-
Luna Moth (Silent Ransom Group) internal files leak, showing a scripted help-desk impersonation operation
Leaked files show a social engineer calming the victim while a technical operator runs remote access software. Attackers follow scripts for victim objections. Authenticity of the files is unconfirmed. Defenses: call back on a known number, restrict which remote tools staff can install.
-
iRhythm breach affects at least 360,000 patients
Attackers took data from third-party-hosted business applications June 3 to 8. Stolen: names, contact details, dates of birth, plus account, device serial, insurance numbers and service dates. Extortion demand came June 9. State filings show 360,000+ (298,647 in Texas, 69,526 in South Carolina)…
-
Palo Alto GlobalProtect flaw (CVE-2026-0257), patched in May, still used by Qilin and Settra ransomware
Auth bypass in PAN-OS GlobalProtect and Prisma Access. Rapid7, Unit 42 and Arctic Wolf also report exploitation attempts. Five months after the fix, unpatched firewalls are still a ransomware entry point.
-
Critical SonicWall SMA1000 flaw (CVE-2026-102255, CVSS 10) exploited days after disclosure
Pre-auth SSRF in the SMA1000 Work Place interface (models 6210, 7210, 8200v). Fixed in 12.5.0-03082 and 12.4.3-03670. Disclosed Oct 6; Defused saw first exploitation attempts against decoys on Oct 8. Successful compromises are not confirmed. Horizon3.ai warns of device takeover.
-
Cyberattack on supermarket refrigeration controllers hits stores across France and neighboring countries
Starting Oct 11, attackers hit refrigeration systems at Coopérative U, Intermarché, Carrefour and Monoprix, with reports of Leclerc and stores in Belgium and the Netherlands. Intermarché says 150 stores were affected; two stores in Haguenau reportedly lost €270,000 in stock. Reporting says…
-
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell…
-
CISA adds CVE-2015-3306 to KEV: ProFTPD Improper Access Control Vulnerability
Federal patch deadline 2026-10-11. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
-
CISA adds CVE-2021-3199 to KEV: ONLYOFFICE Docs Server Path Traversal Vulnerability
Federal patch deadline 2026-10-11. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
-
CISA adds CVE-2023-22894 to KEV: Strapi Cleartext Storage of Sensitive Information Vulnerability
Federal patch deadline 2026-10-11. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service…
-
CISA adds CVE-2016-3081 to KEV: Apache Struts Command Injection Vulnerability
Federal patch deadline 2026-10-11. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
-
CISA adds CVE-2015-5477 to KEV: ISC BIND Data Processing Errors Vulnerability
Federal patch deadline 2026-10-11. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
-
ICSA-25-259-02: Hitachi Energy RTU500 Series
Highest CVSS 7.5. Affects RTU500 series CMU Firmware. Hitachi Energy is aware of multiple vulnerabilities that affect the RTU500 versions that are listed below. An attacker successfully exploiting these vulnerabilities could potentially cause Denial of Service (DoS) impact on RTU500. Please refer…
-
ICSA-26-069-02: Lantronix EDS3000PS and EDS5000 (Update B)
Highest CVSS 9.8. Affects EDS5000 series, EDS3000PS series, G520 series and 3 more. Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.
-
ICSA-26-281-02: Grid Protection Alliance openPDC and openHistorian
Highest CVSS 9.8. Affects openPDC, openPDC (Docker image), openHistorian.
-
ICSA-26-281-03: Satel Netco Design
Highest CVSS 8.8. Affects Netco Design. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code.
-
ICSMA-26-223-02: Pulsetto Vagus Nerve Stimulator (Update A)
Highest CVSS 8.1. Affects Vagus Nerve Stimulator (Lite), Vagus Nerve Stimulator (Fit). Successful exploitation of this vulnerability could allow an attacker to use could use undocumented commands to modify certain stimulation settings.
-
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey,"…
-
Anthropic folds cyber verification and Project Glasswing into a 3-tier access program
Vetted security teams get tiered access to AI models. The Hacker News reports Project Glasswing has discovered 129,000 software vulnerabilities. I did not retrieve the full article text, so tier details are not summarized here.