Ivanti zero-day exploited, French fridges hijacked, npm trust flaw

Ivanti warns of actively exploited Connect Secure zero-day

Ivanti is urging customers to immediately patch an actively exploited zero-day in its Connect Secure remote access gateway, tracked as CVE-2026-104935. The high-severity authentication bypass affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Unprivileged remote attackers can exploit it in low-complexity attacks requiring no user interaction to execute arbitrary commands on targeted appliances. Ivanti said it is aware of limited exploitation in the wild and is working directly with affected organizations. Volexity, which found and reported the flaw, said a previously unknown threat actor tracked as UTA0576 has chained the bug since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices, tampering with logs to evade Ivanti’s Integrity Checker Tool. Shadowserver tracks over 5,500 ICS instances exposed online.

Ivanti warns of Connect Secure zero-day exploited in attacks →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

Cyberattack hijacks French supermarket refrigeration, causing fires

A cyberattack targeted hundreds of French supermarkets overnight on October 11 to 12, remotely hijacking refrigeration systems to trigger intense defrost cycles, spoiling food and sparking fires. The Paris Prosecutor’s Office confirmed its cybercrime section opened a national criminal investigation, entrusted to the Anti-Cybercrime Office, to identify victims and establish links between the incident and reported damage. Hackers gained remote control by exploiting internet-connected controllers, manipulating temperatures to reach 50 degrees Celsius. The Mousquetaires Group told OCCRP that 300 of its French stores were compromised, with millions of euros in losses; full systems recovery could take two to three weeks. Other impacted chains include Carrefour, Monoprix and E.Leclerc. CERT-FR confirmed compromises of Danfoss AK-SM and AK-SC series controllers, as well as Copeland XWEB and Dixell XWEB monitoring systems, warning campaigns are likely ongoing.

Hackers Turn French Supermarket Refrigerators Into Furnaces →

npm Trusted Publishing flaw exposed 1,500 packages to takeover

Bloom Security found that npm Trusted Publishing originally identified a package’s authorized GitHub repository by its human-readable slug rather than binding trust to GitHub’s permanent repository identifier. When a repository is renamed, transferred or deleted, its old address can be claimed by another party. If the package’s Trusted Publisher binding still relies on that address and the repository has not yet successfully published a version, an attacker who reclaims the slug can inherit the publishing trust. The attack required no compromised npm or GitHub account and no maintainer credentials. A registry-wide scan identified more than 1,500 vulnerable packages with over 10 million total downloads and over one million downloads per month. The vulnerability remained exploitable for more than 120 days after disclosure. npm confirmed a fix and apologized for communication delays.

Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover | HackerNoon →

Topics: npm supply-chain attacksSupply chain attacks

Fox-IT releases Cobalt Strike Beacon Corpus of 56,843 samples

Fox-IT has publicly released its full Cobalt Strike Beacon Corpus, comprising 56,843 raw beacons and their parsed configurations drawn from 190,182 sightings collected from 30,604 unique IP addresses running a Team Server between 4 July 2018 and 29 September 2026. The corpus is hosted on Hugging Face as two Parquet files: beacons.parquet with 190,182 rows and payloads.parquet with 56,843 rows containing raw beacon payloads wrapped in CaRT so samples remain neutered until deliberately unpacked. All beacons were downloaded directly from internet-facing Team Servers, mostly on TCP ports 80 and 443 and UDP port 53. Servers active in the last 30 days are excluded. The median Team Server was reachable for 14 days, and volume has dropped to around 200 beacons a month.

Releasing the Cobalt Strike Beacon Corpus – Fox-IT International blog →

Flock becomes CVE Numbering Authority for its own products

Flock has gained authority to assign CVE IDs to vulnerabilities in its own products and grade those defects as a CVE Numbering Authority. The manufacturer of automated license plate readers and AI-powered cameras said it joined more than 550 CNAs to assess, coordinate and prioritize response to vulnerabilities internally. Flock published its vulnerability disclosure policy in August and created a security advisories page. The policy disallows testing against live customer deployments, accessing law enforcement data, physical attacks, denial-of-service testing or social engineering. Flock does not run a paid bug bounty program. Researchers last year reported multiple defects in Flock’s license-plate reader and gunshot detection system, which the company deemed not material because the vulnerabilities require physical access to the device. Critics note CNAs essentially grade their own homework.

Flock can now issue CVEs for its own products. Should we trust it? | CyberScoop →

Topics: Flock Safety