Cyber Threat Intel Daily Briefing — 2026-10-13

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-13 12:15 UTC · REPORT BRIEF-20261013-121533

OPEN // LE

01

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available

SRC: The Hacker News Tue, 13 Oct 2026 14:14:01 +0530 https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html

02

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to exe

SRC: The Hacker News Tue, 13 Oct 2026 14:13:37 +0530 https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html

03

Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stock

Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions. Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equi

SRC: Security Affairs Tue, 13 Oct 2026 07:50:08 +0000 https://securityaffairs.com/200863/hacking/hackers-cranked-french-supermarkets-freezers-up-to-50-degrees-causing-hundreds-of-stores-to-lose-their-stock.html

04

Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.

SRC: DarkReading Mon, 12 Oct 2026 21:42:42 GMT https://www.darkreading.com/vulnerabilities-threats/max-severity-ssrf-flaw-sonicwall-sma-devices-under-attack

05

Prominent Ransomware Negotiator Faces Extortion Charges

Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.

SRC: DarkReading Mon, 12 Oct 2026 20:00:53 GMT https://www.darkreading.com/insider-threats/prominent-ransomware-negotiator-extortion-charges

06

ShinyHunters arrest number three: a Canadian ransomware negotiator

A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion c

SRC: Security Affairs Mon, 12 Oct 2026 21:26:12 +0000 https://securityaffairs.com/200847/cyber-crime/shinyhunters-arrest-number-three-a-canadian-ransomware-negotiator.html

07

IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion

The acquisition pairs Elisity's zero-trust access controls with IonQ's post-quantum cryptography business as federal agencies and major companies accelerate timelines for quantum-ready encryption. The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared fir

SRC: CyberScoop Mon, 12 Oct 2026 18:12:10 +0000 https://cyberscoop.com/ionq-acquires-elisity-1-3-billion-quantum-security/

08

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean

SRC: The Hacker News Mon, 12 Oct 2026 20:46:26 +0530 https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html

09

AI Turns Familiar Cyberattacks Into a Race Against Time

IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses. The post AI Turns Familiar Cyberattacks Into a Race Against Time appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 11:00:00 +0000 https://www.securityweek.com/ai-turns-familiar-cyberattacks-into-a-race-against-time/

10

Yandex confirms service outage as users lose access to cloud files

Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. […]

SRC: BleepingComputer Mon, 12 Oct 2026 15:23:01 -0400 https://www.bleepingcomputer.com/news/security/yandex-confirms-service-outage-as-users-lose-access-to-cloud-files/

11

Ledger confirms spy chip implant behind wallet crypto thefts

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. […]

SRC: BleepingComputer Mon, 12 Oct 2026 12:27:23 -0400 https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/

12

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers. The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 10:36:05 +0000 https://www.securityweek.com/86-million-crypto-heist-linked-to-ledger-signer-hardware-implant/

13

Anthropic takes risky AI tests offline after models breach govt sites

Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. […]

SRC: BleepingComputer Mon, 12 Oct 2026 14:51:59 -0400 https://www.bleepingcomputer.com/news/security/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites/

14

XWorm RAT Evolves Into Surveillance Platform

Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 11:13:10 +0000 https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/

15

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on

SRC: The Hacker News Tue, 13 Oct 2026 16:39:10 +0530 https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html

16

Product Walkthrough: Bitdefender AI Visibility and Control

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine inst

SRC: The Hacker News Tue, 13 Oct 2026 16:00:00 +0530 https://thehackernews.com/2026/10/product-walkthrough-bitdefender-ai.html

17

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

The company says it took some of its systems offline to contain a security issue within its network. The post Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 09:37:12 +0000 https://www.securityweek.com/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/

[ SOURCE ] OpenPhish (18 indicator(s))