InfoSec News 20261013
Publicada em: 13/10/2026
TOP NEWS
GitLab Patches Max-Severity Vulnerability CVE-2026-97229
GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers.
GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in.
Link
TLP1: Green
Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.
Tracked as CVE-2026-104935, this high-severity authentication bypass zero-day was reported by cybersecurity firm Volexity and affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
Link
TLP1: Green
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services.
Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
Link
TLP1: Green
Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism
Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stock
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions.
Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.
Link
TLP1: Green
Cyber incident hits grocery stores in US, Netherlands and Belgium
Ahold Delhaize, the Dutch multinational retailer, announced Monday it was taking precautionary measures following a cybersecurity incident, with stores in the U.S., Netherlands and Belgium reportedly impacted.
Distribution centers, online grocery orders and in-store pricing have been disrupted, although it is unclear whether this was due to the incident itself or the precautionary measures.
The company said its teams “are taking steps to assess and mitigate the issue,” including “taking some systems offline to help protect them.”
“At this time, our stores are open and serving customers,” they said.
Ahold Delhaize operates across nine countries including the U.S. and several states in Europe, and employs more than 400,000 people. Its American brands include Food Lion and Stop & Shop.
Link
TLP1: Green
Yandex confirms service outage as users lose access to cloud files
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third.
Yandex customers are experiencing service outages, some of them reporting inability to access files stored on the company’s cloud infrastructure.
The attacks are believed to have been carried out by Ukrainian forces trying to cause widespread operational disruptions. Yandex reported no injuries related to these incidents
Link
TLP1: Green
Breaches: Data Breaches and Hacks
Claire's Data Breach on October 13, 2026
Description Claire’s is a specialty retail company based in the USA (Illinois), offering fashion accessories, jewelry, cosmetics, and ear-piercing services primarily for teens, tweens, and young women. Leak Size: 1.71TB
Link
TLP1: Green
Vulnerabilities: Vulnerability Advisories, Zero-Days, Patches and Exploits
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT).
Docker Hub is an online registry for storing, sharing, and downloading container images - templates that package everything needed for an application to run in an isolated environment.
In Docker Hub, a PAT serves as a secret used to authenticate tools and workflows. It allows you to pull, push, or delete container images.
Link
TLP1: Green
The MFA Gaps Attackers are Still Exploiting
An Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN. Around seven minutes later, one attempt succeeded. The credentials were valid, and the VPN account had no multi-factor authentication (MFA) protecting it. Roughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.
The ransomware deployment ultimately failed, but by then the attacker had already stolen credentials and file-share data.
It highlights an issue that is still common in 2026, where an organization might require MFA for Microsoft 365 and other SaaS applications while leaving certain access paths protected only by passwords. It’s this gap that attackers are regularly exploiting.
Link
TLP1: Green
Incident Response: Infrastructure, Training, SIEM and Incident Handling
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Anthropic researchers show how small AI models could autonomously replicate across IoT devices, raising concerns about adaptive, AI-powered botnets.
he team ran a 26 billion parameter model, Gemma4-26B-A4B, distributed across 15 off-brand Android TV boxes networked together. It worked. The boxes collectively ran inference at 0.39 tokens per second, slow by any normal standard, but functional, and that’s the point.
The researchers broke autonomous replication into four steps: finding devices on a network, gaining access, setting up the AI model on a new device, and repeating the process.
Link
TLP1: Green
Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
What the Critical Flaws Allow: Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.
Flaws That Depend on Configuration: Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.
Link
TLP1: Green
1Traffic Light Protocol (TLP) [1] for information sharing:
- Red: Not for disclosure, restricted to participants only.
- Amber: Limited disclosure, restricted to participants organizations.
- Green: Limited disclosure, restricted to the community.
[1]https://www.first.org/tlp