|
🛒 Cyberattack knocks Ahold Delhaize offline
LINK
|
- Ahold Delhaize, the Dutch grocery owner of US chains Food Lion, Giant Food, and Stop & Shop, pulled many IT systems offline after a cyberattack first disclosed on October 12 that hit most of its brands in Europe and the United States.
- CEO Frans Muller called the shutdown of websites and apps a precaution against "malicious actions of others," and the company said it has found no sign that attackers stole sensitive customer, worker, or partner data, with physical stores staying open.
- Albert Heijn's site and app are back, with home deliveries expected to resume on Friday, while US brands like Hannaford and Martin's should return within days; the company has told Dutch authorities and filed a police report.
|
⛏️ Hackers hijack Plex servers to mine crypto
LINK
|
- Hackers are breaking into internet-exposed Plex Media Server systems and installing crypto-mining software, striking just one day after a researcher published a working exploit for a group of four flaws called Plex2Shell.
- Chained together, the bugs (lead flaw CVE-2026-96652) let attackers run code on a vulnerable server without login details; a honeypot caught the first in-the-wild attacks on Saturday, using the public proof-of-concept.
- Plex fixed the flaws and told owners to upgrade back in September, well before the attacks; intruders planted an XMRig miner and later proxy software that could route traffic through home internet connections.
|
🔓 Ransomware crews exploit Palo Alto VPN flaw
LINK
|
- Ransomware crews are exploiting a Palo Alto Networks GlobalProtect VPN flaw to skip multi-factor authentication and break into corporate networks, in one case stealing credentials straight from a domain controller's virtual disk on VMware systems.
- The bug, CVE-2026-0257, affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access setups that enable authentication override cookies; devices fail to verify who made the cookie, so attackers can forge one and connect without logging in.
- Unit 42 tied the active exploitation to the Qilin and Inc ransomware groups, with investigations running since early June across healthcare, finance, and government; fixes include upgrading affected devices, disabling override, or using a dedicated override certificate.
|
🔧 F5 rushes emergency fix for NGINX flaws
LINK
|
- F5 has shipped emergency, out-of-schedule patches for three critical flaws in its NGINX web traffic software, each scored near the top of the severity scale, that could let attackers crash servers, run code, or knock sites offline.
- The bugs, led by CVE-2026-15176, hit NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager; F5 found no sign they are being exploited yet and urges customers to upgrade to fixed versions.
- Remote code execution becomes far likelier when ASLR memory protection is off, so F5 suggests keeping it on and offers config workarounds such as disabling asynchronous file I/O and server-side includes, and using named regex captures.
|
📌 Hackers hijacked AOMEI updates for backdoors
LINK
|
- Hackers tracked as UNC7017 hijacked AOMEI's update system between April and July 2026, briefly swapping download settings to push hidden backdoors to users of the AOMEI Backupper and AnyViewer tools.
- Rather than altering binaries, the attackers edited two config files to point downloads at malware and supply a matching checksum, slipping it past the app's checks without needing any CVE or exploit.
- Victims spanned IT, telecom and university targets across eleven countries, receiving the CROSSROAD downloader and SHINYROAD backdoor; AOMEI says it fixed its servers, but that cleanup does not remove backdoors already installed on infected machines.
|
|
