Monday, October 12, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Danfoss Refrigeration Outage from Exploited Legacy Controllers

Danfoss controllers caused outages at 250–350 stores; patch now, isolate, and hunt lateral movement.

Composed by SitRep’s AI editors from 2 sources — BleepingComputer, SecurityWeek

Danfoss Refrigeration Attack Impacts French Supermarkets

The incident involved a cyberattack that remotely defrosted refrigerators across an estimated 250–350 French stores by exploiting legacy Danfoss AK‑SM 8xxA Series controllers. Approximately 2,752 Danfoss systems are publicly exposed (1,590 in France) and over 4,500 devices are reachable overall, disrupting refrigerated goods, deliveries, and pricing systems.

Context

Attackers weaponize internet‑facing legacy controllers and widely used enterprise services within days of disclosure, producing real‑world outages and data theft. Retail and enterprise environments exposing OT, CI/CD, or popular web plugins to the internet without segmentation or rapid patching face the largest blast radius.

The move

5 things to do today

  1. Inventory: Query internet‑exposed Danfoss AK‑SM 8xxA devices (and other OT controllers) and remove remote admin access or place behind VPNs and jump hosts — prioritize devices counted in the 2,752 exposure figure.
  2. Patch: Upgrade SonicWall SMA1000 appliances to 12.5.0-03082 or 12.4.3-03670 to mitigate CVE-2026-102255, and block administrative interfaces at the perimeter until patched.
  3. Update: Patch Bricksforge to 3[.]1[.]8[.]10 immediately and scan web roots and upload directories for newly created PHP files or web shells.
  4. Hunt: Audit GitLab CI pipelines for untrusted regexes and apply CE/EE 19.2.8 / 19.3.4 / 19.4.2; hunt for unusual runner launches, new CI jobs, and indicators of post‑exploit persistence.
  5. Segment: Enforce network segmentation between OT and corporate networks, apply strict egress filtering, and log OT control plane traffic for anomaly detection.

On the wire

P0OT

Legacy Danfoss Controllers Remotely Manipulated, Causing Store Outages

Danfoss AK‑SM 8xxA Series controllers were exploited to remotely defrost refrigerators across ~250–350 French stores; ~2,752 systems are publicly exposed with 1,590 in France. Immediately isolate OT from corporate networks, identify internet‑facing Danfoss devices, and apply network filtering or vendor mitigations while coordinating incident response with facilities teams.

BLEEPINGCOMPUTER · Danfoss Refrigeration Attack Impacts French Supermarkets

P0Exploit

SonicWall SMA1000 CVE-2026-102255 Actively Exploited Days After Disclosure

CVE-2026-102255 (pre‑auth SSRF, CVSS 10) was exploited within days; affected SMA1000 models include 6210, 7210, and 8200v. Patch to 12.5.0-03082 or 12.4.3-03670 immediately, block access to SMA administrative interfaces from the internet, and search logs for suspicious Work Place interface requests and SSRF indicators.

SECURITYWEEK · Critical SonicWall SMA1000 Vulnerability CVE-2026-102255 Exploited Within Days

P1WebApp

Bricksforge WordPress Plugin CVE-2026-85097 Exploited in the Wild

CVE-2026-85097 (CVSS 9.8) allows unauthenticated arbitrary file upload and code execution; exploitation observed since Oct 7 across sites using Bricksforge (~6,000 instances). Update Bricksforge to 3[.]1[.]8[.]10, scan for newly created PHP files and web shells, and restrict plugin install/update privileges for web admins.

SECURITYWEEK · Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

P1CI/CD

GitLab Regex Compiler CVE-2026-97229 Max‑Severity RCE in Ci/cd

CVE-2026-97229 is an integer overflow in GitLab's CI/CD regex compiler that can allow unauthenticated code execution; GitLab[.]com patched and self‑hosted versions fixed in CE/EE 19.2.8, 19.3.4, 19.4.2. Patch self‑hosted instances immediately, audit CI pipelines for untrusted regex inputs, and monitor for unexpected runner activity or new CI jobs.

BLEEPINGCOMPUTER · GitLab Warns of Maximum Severity RCE in Regex Compiler

Indicators named in this edition

KindValueNote
CVECVE-2025-41450Danfoss AK-SM 8xxA Series referenced in exploit chain.
CVECVE-2025-41451Danfoss AK-SM 8xxA Series referenced in exploit chain.
CVECVE-2026-102255SonicWall SMA1000 pre‑auth SSRF; patch to 12.5.0-03082 or 12.4.3-03670.
CVECVE-2026-85097Bricksforge WordPress plugin critical RCE; update to 3[.]1[.]8[.]10.
CVECVE-2026-97229GitLab regex compiler integer overflow RCE; fixed in CE/EE 19.2.8, 19.3.4, 19.4.2.
VERSION12.5.0-03082SonicWall SMA1000 patched version.
VERSIONCE/EE 19.2.8, 19.3.4, 19.4.2GitLab patched releases for CVE-2026-97229.

Elsewhere in the edition

Ledger Confirms Hardware Implant in Ledger X Wallets

Ledger confirms a hardware implant in some Ledger X devices sold via Southeast Asia reseller CryptoBilis, linked to crypto wallet drains. Investigations began Oct 9; researchers found at least one tampered device. Implant enables seed-phrase theft via LTE/eSIM with an advanced MCU. Ledger warns against unauthorized resellers and notes Genuine Check cannot detect implants.

3 reports

Quantum-Resistant Signing on AWS Part 2: Enforcing ML-DSA Policy

Explains converting a cryptographic algorithm policy into preventive and detective controls using SCPs and IAM to enforce ML-DSA variants (ML-DSA-65/87) while excluding ML-DSA-44. Scope covers AWS KMS, Private CA, and ACM; not applicable to third-party crypto on EC2 or OpenSSH implementations.

2 reports

Ransomware Response Expert Arrested in ShinyHunters FBI Probe

A Canada-based cybersecurity executive, reportedly Edward Dubrovsky, was arrested in the U.S. amid ShinyHunters investigations. The FBI alleges involvement in ShinyHunters attacks, including targeting FBI systems, with charges of conspiracy to threaten to impair information confidentiality for extortion. Dubrovsky is tied to CyberSteward; case moved to the Eastern District of Texas as the probe c…

2 reports

Let’s Encrypt Reduces Default Certificate Validity to 64 Days

Let’s Encrypt will issue certificates with a 64-day default lifetime starting Feb 10, 2027, as preparation for 45-day lifetimes planned for 2028. The last 90-day certificate should expire May 11, 2027. Staging environment testing will begin, ARI (ACME Renewal Info) is available, and authorization reuse will drop to 10 days next year, then seven hours in 2028. Production endpoints, issuance chains…

2 reports

CyberXero Uses Claude Code in Campaign to Steal Ukrainian Records

CyberXero conducts a two-pronged AI-augmented campaign targeting WordPress and e-commerce sites globally, plus a focused assault on Ukrainian energy and utilities. Using Claude Code with 51 AI agents, the operation exfiltrated over 628,000 Ukrainian records and is linked to multiple CVEs, active since July 2026.

2 reports

Also reported

End of the Monday, October 12, 2026 edition.