Today’s briefing covers 10 security issues reported in the last 24 hours, grouped by type: 3 actively exploited, 1 breaches and data exposure, 3 ransomware and attacks, 3 patches and advisories. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
SonicWall SMA 1000 SSRF flaw CVE-2026-102255 under active attack
Who is affected: Organisations running the SonicWall Secure Mobile Access (SMA) 1000 appliance.
Threat actors are actively exploiting CVE-2026-102255, a maximum-severity server-side request forgery flaw in the SonicWall SMA 1000 WorkPlace portal that could let a remote unauthenticated attacker direct the appliance to issue requests on their behalf and reach internal functionality. SonicWall published the advisory on October 6, and two security vendors observed exploitation attempts against their honeypot devices within days.
What to do: Apply the SonicWall patch referenced in SNWLID-2026-0017 for the SMA 1000 appliance without delay and review logs for unauthenticated SSRF traffic.
Sources: darkreading.com
Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)
Who is affected: Organisations running Ivanti Connect Secure. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-13, which means attacks are confirmed.
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-16.
Sources: CISA KEV / NVD
Microsoft Windows: Microsoft Windows Command Injection Vulnerability (CVE-2026-96951)
Who is affected: Organisations running Microsoft Windows. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-13, which means attacks are confirmed.
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-16.
Sources: CISA KEV / NVD
Breaches and data exposure
BYOD group leaks data of 3,615 Trump Mobile customers
Who is affected: 3,615 Trump Mobile prospective customers, including names, email addresses, phone numbers, home addresses and order details, plus abandoned sign-ups and the Trump Organization’s CIO.
A cybercrime group calling itself BYOD published the records on its dark web leak site in late September 2026 after claiming it compromised a Liberty Mobile employee’s device with an infostealer or remote access trojan. The Trump Organization and Liberty Mobile have not responded to requests for comment, and the Register describes BYOD as a newly observed ransomware-as-a-service operation.
What to do: Treat any details you submitted to Trump Mobile as exposed, monitor for phishing using the leaked contact data, and watch for any official notification from Liberty Mobile or Trump Mobile.
Sources: techradar.com
Ransomware and attacks
Danfoss refrigeration controller hack hits European supermarkets
Who is affected: Hundreds of supermarket locations across France, with food retailers also affected in Belgium, Germany, the Netherlands, Poland, Portugal and Spain; Les Mousquetaires alone runs 150 stores hit.
Unknown attackers exploited a vulnerability in Danfoss refrigeration controllers, remotely raising fridge and freezer temperatures to about 50 degrees Celsius (122 degrees Fahrenheit), in some cases for six hours before being noticed. Affected chains include Auchan, Carrefour, E.Leclerc, Intermarche, Monoprix and Cooperative U, with Monoprix reporting roughly 5% of its stores hit. The two controller series implicated, the AK-SM 800 and AK-SC 355, are end-of-life or phased out, with some current AK-SM 800A units running outdated firmware.
What to do: Disconnect or tightly access-filter any affected Danfoss AK-SM 800 or AK-SC 355 controllers, and update firmware on AK-SM 800A units to a supported version.
Sources: gizmodo.com, securityweek.com, thehackernews.com
Low-cost Android phones ship with preinstalled Midnight Mimosa malware
Who is affected: Buyers of low-cost Android smartphones built on MediaTek platforms across several brands; Bitdefender also found 13 related apps on Google Play.
Bitdefender is tracking a campaign called Midnight Mimosa in which firmware shipped on certain low-cost MediaTek Android phones contains a system-level component called com.android.system.lite that installs disguised apps, conducts ad fraud, and turns devices into residential proxy nodes for botnets. Related dropper apps on Google Play, which provide real functionality such as weather or QR-code scanning, also load ads outside the app, including when the phone is not in use.
What to do: Check Bitdefender’s published list of affected app names and uninstall any that match, keep Android devices updated, and review installed apps for unfamiliar utilities requesting accessibility, notification or SMS permissions.
Sources: thehackernews.com
Cyberattack prompts Ahold Delhaize to disconnect systems; stores stay open but deliveries and online orders disrupted
Who is affected: Customers and associates of Ahold Delhaize grocery brands in the Netherlands, Belgium and the United States, including Albert Heijn, Delhaize, Giant Food, Hannaford, Food Lion, The Giant Company and Stop Shop.
Ahold Delhaize detected a security issue inside its network, took some systems offline to contain it, and is carrying out a controlled re-launch of affected systems. Local media reported that the preventive measures impacted deliveries and online orders at Albert Heijn and Delhaize in Belgium and the Netherlands, and stores in the US also experienced issues. The company says it has notified relevant authorities and stakeholders and has no evidence that customer or associate data was stolen. The incident follows a 2024 attack on Ahold Delhaize that the INC Ransom group later claimed, with data theft confirmed in April 2025.
What to do: If you shop with affected Ahold Delhaize brands, expect delays with deliveries and online orders and confirm orders in store; monitor official brand channels for service updates.
Sources: securityweek.com
Patches and advisories
GitLab patches maximum-severity RCE flaw CVE-2026-97229
Who is affected: Self-managed GitLab Community Edition and Enterprise Edition installations running versions from 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2.
CVE-2026-97229 is an integer overflow in GitLab’s CI/CD Regular Expression Compiler that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regex in a CI/CD configuration. GitLab released patches in versions 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026, and Rapid7 has reproduced RCE against an unpatched 19.4.1 image. GitLab.com is already patched and GitLab Dedicated customers do not need to act.
What to do: Upgrade self-managed GitLab CE or EE instances to 19.4.2, 19.3.5 or 19.2.8 immediately.
Sources: thehackernews.com, helpnetsecurity.com
Two critical flaws in Progress Software MarkLogic Server let delegated managers gain admin control
Who is affected: Users of MarkLogic Server 11.x before 11.3.7 and MarkLogic 12.x before 12.1.0, including the 11.3 long-term support line; the 12.0 line has no patched release.
Progress Software disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, and rated five as critical. Two (CVE-2026-85947 and CVE-2026-85948, both CVSS 9.9) let an account with forest-management or manage-user-level privileges obtain persistent administrative control of the server. The others (CVE-2026-85955 at 9.9, CVE-2026-85956 and CVE-2026-9191 at 9.6) allow code execution at higher permissions and access to security-critical backup data. Patches were issued on September 10 in MarkLogic 11.3.7 and 12.1.0; the earlier 11.3.6 and 12.0.3 releases that fixed 10 prior flaws remain affected. No exploit activity has been confirmed and no workaround is available.
What to do: Upgrade MarkLogic Server to 11.3.7 or 12.1.0 as soon as possible, since no workaround is offered for those who cannot yet upgrade.
Sources: thehackernews.com
npm Trusted Publishing flaw left more than 1,500 packages open to hijack via freed GitHub repo names
Who is affected: Maintainers using npm’s Trusted Publishing feature whose bound GitHub repository or owner account was renamed, transferred, or deleted, exposing more than 1,500 npm packages with over 10 million total downloads.
Bloom Security found that npm did not verify GitHub’s permanent numeric IDs for repositories or owner accounts, only the repository slug name. Anyone who re-registered the freed slug could add a workflow with the expected filename and receive a short-lived publish credential for the original package, including a valid provenance attestation pointing to the attacker’s repo. A hijacked package can deliver malicious code via a postinstall script. GitHub acknowledged the report, validated it on June after Bloom submitted it on June 6, and shipped fixes; GitHub also retires names of repositories with more than 100 clones in the week before an owner rename or deletion.
What to do: Review Trusted Publishing bindings for npm packages you maintain, re-bind any linked to renamed, transferred, or deleted repositories or owners, and watch for unexpected new versions of those packages.
Sources: helpnetsecurity.com