The situation

Refrigeration Attack Expands to Copeland Dixell

OT refrigerations compromise ~700 stores; patch and isolate impacted controllers now.

Composed by SitRep’s AI editors from 5 sources — SecurityWeek, BleepingComputer, The Hacker News, Breaches.net, Help Net Security

Refrigeration Attack Expands to Copeland, Dixell Controllers

SecurityWeek reports the supermarket refrigeration attack widened to Copeland XWEB and Dixell XWEB controllers, impacting roughly 700 stores and triggering spoilage and reported fires. CERT-FR issued coordinated alerts; older Danfoss AK‑SM/AK‑SC controllers remain at elevated risk.

Context

Operational impact is immediate: compromised controllers caused spoilage and fire risk across multiple chains, elevating legal and safety exposure for retailers. OT networks and IT products such as firewalls and backups are under active targeting, enlarging the blast radius from IT to physical operations and consumer impact.

The move

5 things to do today

Isolate OT segments and apply network segmentation controls for Copeland XWEB and Dixell XWEB controllers; coordinate with facilities for immediate safety checks and incident response.
Update or remove Collabora CODE Server to 26.4.303 to mitigate CVE-2026-110447; hunt for proxy[.]php access, PHP webshell files, and abnormal credential exfiltration.
Patch PAN-OS to 12.2.4+, 12.1.4-h12+, or applicable fixed builds to remediate CVE-2026-0322 and restrict management interfaces to trusted IPs while monitoring for unauthorized admin sessions.
Upgrade AhsayCBS to the fully patched releases addressing CVE-2026-105133 and CVE-2026-105134, reboot per vendor guidance, and scan for web shells and XMRig artifacts.
Audit and close public‑facing database endpoints, force credential resets where exposure is confirmed (Vibetech ~13.7M records, CenterPoint ~1,062,060 records), and accelerate breach notification and forensic review.

On the wire

P0OT

Widespread Refrigeration Controller Compromises Causing Physical Harm

Copeland XWEB and Dixell XWEB controllers across ~700 stores; immediate safety-focused IR and OT isolation required.

SECURITYWEEK · Supermarket Refrigeration Attack Expands to Copeland, Dixell Controllers

P1Exploit

Collabora CODE Server RCE (CVE-2026-110447) Active Against Nextcloud

Mid-Sept onward: attackers backdoor CODE Server, plant PHP webshells, and scan for credentials; update to 26.4.303 or remove CODE Server and hunt for proxies and shells.

BLEEPINGCOMPUTER · Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers

P1Patch

PAN-OS CVE-2026-0322 Authenticated RCE: Kev-listed

Patch to PAN-OS 12.2.4+, 12.1.4-h12+; limit management interfaces to trusted IPs; monitor admin sessions and config changes.

THE HACKER NEWS · Palo Alto PAN-OS Patch for Authenticated RCE (CVE-2026-0322)

P1Ransomware/Backdoor

AhsayCBS Flaws (CVE-2026-105133 / CVE-2026-105134) Used to Drop Web Shells and Miners

Upgrade to patched AhsayCBS releases (10[.]3[.]4[.]45/9[.]15[.]2[.]70 or later); reboot after patch; hunt for web shells and XMRig indicators.

THE HACKER NEWS · AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes

P2Data Exposure

Mass Database Exposures and Breaches Increase Credential Risk

Unprotected Vibetech DB (~13.7M records) and CenterPoint breach affecting 1,062,060 Texans raise credential risk; close public endpoints, reset credentials, and accelerate breach response.

BREACHES.NET · Vibetech Exposes 13.7 Million Records via Unprotected Database

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-110447	Collabora Online CODE Server RCE exploited against Nextcloud proxy[.]php and used to deploy PHP webshells.
CVE	CVE-2026-0322	Authenticated RCE in Palo Alto PAN-OS management interface; KEV-listed.
CVE	CVE-2026-76519	Cisco Secure Email Gateway relative path traversal added to KEV.
CVE	CVE-2026-105133	AhsayCBS improper authentication used as initial entry in chained exploit.
CVE	CVE-2026-105134	AhsayCBS command injection enabling RCE and web shell deployment.

Elsewhere in the edition

Thoma Bravo's Proofpoint to Acquire Varonis Systems in $6.3 Billion Cash Deal

Thoma Bravo's Proofpoint to acquire Varonis Systems in a $6.3 billion all-cash deal. The article provides basic deal terms but does not include closing date, conditions, or other metrics; no CVEs or further financial details are disclosed.

3 reports

PROOFPOINT NEWSThoma Bravo's Proofpoint to Acquire Varonis Systems in $6.3 Billion Cash Deal
PROOFPOINT NEWSProofpoint to Acquire Varonis in $6.3 Billion Cybersecurity Deal
PROOFPOINT NEWSProofpoint to Acquire Varonis in a $6.3 Billion Cash Deal

UK Legal Aid Agency Hack Expands After Forensic Review

The UK Legal Aid Agency (LAA) says a April 2025 breach exposed records dating back to 1978, with most data from applications, claims, and payments between 2007 and 2025. About 250,000 records predate 2007. Exposed data include names, addresses, dates of birth, National Insurance Numbers, and CCMS entries; also affected are practitioners and probation service data. Investigation delayed by unstruc…

3 reports

SECURITYWEEKUK Legal Aid Agency Hack Expands After Forensic Review
BLEEPINGCOMPUTERUK Legal Aid Agency Data Breach Stole Records Back to 1978
BREACHES.NETLegal Aid Agency cyberattack reveals breach dates back to 1978

Cohere to Acquire European AI Cybersecurity Startup Aisle

Cohere Inc. plans to acquire European AI cybersecurity startup Aisle to bolster its cybersecurity capabilities amid AI-driven threats and defenses. The Globe and Mail covered the plan, dating Oct. 15, 2026, as Cohere moves to strengthen its security product stack against sophisticated exploits.

3 reports

NEWSAPI CYBER INSIGHTSCohere to Acquire European AI Cybersecurity Startup Aisle
NEWSAPI CYBER INSIGHTSCohere Seeks Acquisition of AISLE to Bolster Enterprise Security
NEWSAPI CYBER INSIGHTSCohere to Acquire Aisle, AI-Driven Cybersecurity Startup

Microsoft Leads Global Takedown Of Phishing Network

Microsoft helped dismantle a Chinese-language cybercrime marketplace, YAM Store, that sold phishing tools, accounts, and templates (CoGUI and Iron Man) used in large-scale campaigns. The operation generated over a billion phishing messages targeting 75,000 organizations, with Microsoft customers receiving more than 750 million messages this year; 20,000 accounts were disabled and 100,000+ domains…

3 reports

NEWSAPI CYBER INSIGHTSMicrosoft Leads Global Takedown Of Phishing Network
NEWSAPI CYBER INSIGHTSMicrosoft and Japan Dismantle Scam Message Marketplace Network
HELP NET SECURITYMicrosoft Disrupts Phishing Kits Marketplace YAM Store

Citizen Lab Traces Zero-Click Candiru Spyware at Al Jazeera

Citizen Lab linked Candiru spyware to targeted online ads that infected Al Jazeera devices without user interaction. Discover-Tech ads carried device-check code and delivered attack payload only if targeted, with at least 45 devices affected in 2024–2025. Ads appeared on roughly 75,000 apps and 120,000 websites; Google and IAB Europe removed Discover-Tech from vendor lists. Candiru’s ownership an…

2 reports

THE HACKER NEWSCitizen Lab Traces Zero-Click Candiru Spyware at Al Jazeera
NEWSAPI CYBER INSIGHTSAdFection: Ad-Delivered Spyware Exposed by Citizen Lab

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell

Silent Lynx targets CIS governments from June 2025 to Aug 2026 using four infection chains: macro-enabled documents, PS2EXE downloaders, GitHub PowerShell, and WinRAR archives exploiting CVE-2025-8088. Custom reverse shells FoalShell, Chvost, Laplas, PickleShell enable remote access. Attacks span nine countries; tracked as UAT-6275 and TAG-193 by Cisco Talos and Insikt Group.

2 reports

THE HACKER NEWSSilent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell
NEWSAPI CYBER INSIGHTSSilent Lynx Targeting Orsk Refinery and Russian Government

Cisco Warns Exploited Secure Email Gateway Vulnerability CVE-2026-76519

Cisco warns of active exploitation of a critical Secure Email Gateway flaw, CVE-2026-76519 (9.8/10). It affects AMP, allows unauthenticated remote attackers to write arbitrary OS files and run root commands. Fixes released in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780; CISA lists KEV, with remediation guidance and IoCs.

2 reports

SECURITYWEEKCisco Warns Exploited Secure Email Gateway Vulnerability CVE-2026-76519
NEWSAPI CYBER INSIGHTSCisco Urges Patch for Email Gateway Flaw CVE-2026-76519

KGB RAT Malware Offering Jump Scares via MaaS

Group-IB researchers reveal KGB RAT, a malware-as-a-service toolkit enabling remote access, credential theft, and crypto hijacking. Subscriptions start at $150/month or $800/year, with features like multi-client management, plugin support, and a $500 Network Spreading add-on. Distinctive psychological harassment includes fake BSODs, jump scares, and screamer functions, plus anti-detection and Tel…

2 reports

NEWSAPI CYBER INSIGHTSKGB RAT Malware Offering Jump Scares via MaaS
HELP NET SECURITYKGB RAT Trojan Packs Webcam Spying and Harassment Features

Also reported

SANS INTERNET STORM CENTERCrypto Mining Malware and Worm Detected by DShield Honeypot
UNIT 42AI-Powered Espionage Campaign Targets Government Linux Infrastructure Using AI
THE HACKER NEWSPwnEscape CVE-2026-99999 Lets Guest VMs Read Host Memory
BLEEPINGCOMPUTERAndroid Gains AI Defenses Against Messaging Scams and Fake Calls
THE HACKER NEWSThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape
BLEEPINGCOMPUTERHackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth
SECURITYWEEKContext Is King in the Fight Against Modern Cyberattacks
BLEEPINGCOMPUTERFake Arch Linux Packages Impersonate AUR Tools to Gain Root
SECURITYWEEKZero Trust Strategies Summit On-Demand Sessions Now Available
AWS SECURITY BLOGAWS Security Agent Exploits 33 of 37 Real-World CVEs

End of the Thursday, October 15, 2026 edition.