‹Tue · 13 Oct 2026

Daily brief · UTC day

Tuesday, 13 October 2026

2 verified findings from 1 run · 3 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

Criticality

Kind

Topic

Region

TL;DR · the day in one read

01GitLab's CVSS 10.0 CI regex flaw now has a public PoC; the demonstrated path needs push access to a public project. GitLab's critical patch release of 2026-10-12 fixes CVE-2026-97229 (CVSS 3.1 10.0), an integer overflow in the CI/CD regular-expression compiler that lets code run on the server as the git user through a crafted expression in a CI/CD configuration; Rapid7 reported on 2026-10-13 that it reproduced it on 19.4.1 and published a proof of concept, and reports no confirmed exploitation in the wild. The demonstrated path needs push access to a public project (an ordinary account where users may create public projects), followed by a request to the CI lint API that carries no credentials. Self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected, and NCSC Switzerland and CERT-EU both published advisories on 2026-10-12. →
02CERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates the attacks exploited. Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026, which BFMTV reports as a remotely forced defrost at hundreds of stores. CERT-FR's alert, revised on 2026-10-13, reports numerous compromises of Danfoss AK-SM and AK-SC controllers and now also of Copeland xweb and Dixell xweb, says campaigns are probably still running and that a factory reset alone does not protect an unpatched end-of-life unit, and NCSC Switzerland rates the activity actively exploited. Danfoss says most affected units are legacy products or current AK-SM800A units on outdated firmware; no source names an actor, the flaw or how the attackers got in, and the Paris prosecutor is investigating. →

01Active threats, incidents & disclosures1 item

HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026; AFP reports from the retailers' statements at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets, and the Paris prosecutor opened an investigation (AFP, 2026-10-12). BFMTV puts the Intermarché and Netto count at 300, which it says is twice the first estimates of 150 points of sale, and Coopérative U below 100 stores, while Infosecurity quotes 150 Intermarché and 30 Netto stores (BFMTV, 2026-10-12; Infosecurity Magazine, 2026-10-12). BFMTV, writing in the conditional, reports that the attackers are said to have imposed a forced, continuous defrost with the setpoint at 50 degrees, on software older than version 4, heating the equipment for hours (translated from French) (BFMTV, 2026-10-12). CERT-FR's alert, in its revision of 2026-10-13, says it knows of numerous compromises of the remote refrigeration controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb, and that exposing a management interface to the internet is contrary to good practice (CERT-FR, 2026-10-13). Danfoss told AFP that most affected units are legacy products that no longer receive software or security updates, naming the AK-SM800 and AK-SC355 regulators, and a person close to the Prime Minister said ANSSI had identified a vulnerability in software from a Danish company and that other countries may be affected (AFP, 2026-10-12). Intermarché told BleepingComputer that the attack reportedly affected a service provider that manages refrigeration systems in stores (BleepingComputer, 2026-10-12), and E. Leclerc told AFP that a cyberattack affected one of its refrigeration equipment suppliers (AFP, 2026-10-12). Infosecurity says the affected stores include those running vulnerable consoles with remote control and no adequately secured communication channel (Infosecurity Magazine, 2026-10-12). No source names an actor or the flaw or states how the attackers got in, and none confirms a tie to the 2025 AK-SM 8xxA vulnerabilities that Claroty found: BleepingComputer reports no tie (BleepingComputer, 2026-10-12) and NCSC Switzerland lists three of them only as alleged to be potentially related (NCSC Switzerland, 2026-10-13).

Exposure

A Danfoss AK-SM or AK-SC refrigeration controller, or a Copeland or Dixell xweb unit, whose management interface is reachable from the internet, above all legacy units; Danfoss says the current AK-SM800A units that were affected ran outdated firmware (Cooling Post, 2026-10-12), and CERT-FR names no models, flaw or entry vector for the Copeland and Dixell units (CERT-FR, 2026-10-13). Infosecurity reports, without naming them, that supermarkets in Belgium and the Netherlands were also reportedly affected (Infosecurity Magazine, 2026-10-12); Blick reports that Migros confirms using, in a limited number of its Swiss stores, the same Danfoss refrigeration systems that were targeted and says nothing indicates an attack on them, while Aldi and Lidl say they are not concerned and Coop says it was not affected and declines to say whether it uses Danfoss (Blick, 2026-10-13); no source reports a Swiss victim, so ask whoever manages your refrigeration and building services whether a controller sits in your estate.

Detection

On the controller, defrost, setpoint and account changes outside a maintenance window; in firewall, provider VPN or ISP logs, inbound connections to the management interface from addresses other than the refrigeration contractor's; CERT-FR accepts filtering to the contractors' source addresses only as an emergency measure and wants access restored through a secure VPN or protected network (CERT-FR, 2026-10-13). For a controller that may have been taken over, CERT-FR's sequence is to remove the internet exposure, factory-reset the unit, restore access only through a secure VPN or protected network, reconfigure it and apply the maker's practices, which for Danfoss means updating the firmware, setting the security level to Strict and confirming the default passwords were changed (CERT-FR, 2026-10-13).

Triage: a defrost cycle is normal; BFMTV quotes sector professionals saying installations can be programmed for two hours of defrost per 24 hours, whereas the reported attack is said to be a continuous forced defrost at a 50-degree setpoint held for hours (translated from French) (BFMTV, 2026-10-12).

CERT-FR is aware of numerous compromises of the remote refrigeration-installation controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb. (translated from French)

In an emergency, simply filtering the source IPs of the refrigeration contractors on a firewall is possible, but this solution must not be considered lasting. (translated from French)

the persistence of a compromised instance will be removed but the equipment will remain vulnerable and will certainly be compromised again. (translated from French)

CERT-FR (alert CERTFR-2026-ALE-012) 2026-10-12

most of the affected equipment was "legacy" products which "no longer receive software or security updates"

AFP 2026-10-12

the hackers would have hijacked this function by imposing a forced and continuous defrost, with a temperature setpoint fixed at 50 degrees (translated from French)

BFMTV 2026-10-12

Affected stores include those operating vulnerable Danfoss consoles with remote-control capabilities that lacked an adequately secured communication channel.

Infosecurity Magazine 2026-10-12

the majority of units affected were legacy products or current products running outdated firmware

Cooling Post 2026-10-12

Update14 Oct 2026 03:44 UTCrun 2026-10-14T0255Z-inteltitleheadlinesummaryregionsentitiesaffected_productssourcesevidencesourcing_notereferencesactionsbody

CERT-FR revised its alert on 2026-10-13: the list of compromised remote controllers now includes Copeland xweb and Dixell xweb besides Danfoss AK-SM and AK-SC, campaigns against these devices are probably still ongoing, and an unpatched end-of-life unit kept on the internet is very likely to be compromised, so a factory reset alone is insufficient (CERT-FR, 2026-10-13). NCSC Switzerland published advisory 13054 on 2026-10-13 with the exploitation status Actively Exploited. It lists the Danfoss AK-SM 800 (end of life, no longer patched), the AK-SC 355 (phased out, no longer patched) and the current AK-SM 800A series when it runs outdated firmware, says no fixes exist for the two older models and that Danfoss urges replacing them, and says the attack could affect other sectors, such as healthcare for specialized cooling equipment, so organisations should check whether affected devices are in use (NCSC Switzerland, 2026-10-13). Danfoss told Cooling Post that the AK-SM800 was declared end of life in 2021, that the AK-SC355 was phased out in 2016, and that the affected AK-SM800A systems ran outdated firmware (Cooling Post, 2026-10-12). Blick reports that Migros uses the same Danfoss refrigeration systems in a limited number of Swiss stores and sees no sign they were targeted, and that Aldi, Lidl and Coop say they are not affected (Blick, 2026-10-13); no source reports a Swiss victim. The advisory relays a six-step CERT-FR sequence (limit access to trusted addresses, factory reset, apply all fixes, rotate passwords and secrets, review accounts, reconfigure) and lists filtering to trusted addresses as a temporary measure (NCSC Switzerland, 2026-10-13), whereas the revised CERT-FR page puts removal of internet exposure first, accepts source-address filtering only as an emergency stop-gap and lists no secret rotation or account review (CERT-FR, 2026-10-13).

Builds on: A hidden authentication mechanism discloses internal network layout before an attacker even… · An attacker can reconstruct admin credentials for an exposed refrigeration controller offline…

incident13 Oct 03:41Zmulti-sourceOpen finding →

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick

HIGHCVE-2026-97229updatedNATOA2

CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows code execution on self-managed servers and now has a public proof of concept; fixed in 19.4.2, 19.3.5 and 19.2.8, and 19.4.1 does not close it (CVSS 10.0)

GitLab's critical patch release of 2026-10-12 (19.4.2, 19.3.5 and 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that, "under certain conditions", could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration; GitLab scores it CVSS 3.1 10.0 with no privileges required (GitLab, 2026-10-12). Affected are self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2; GitLab.com already runs the patched version and Dedicated customers need no action (GitLab, 2026-10-12). CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, but GitLab's page names 19.3.5 and says 19.3.4 had a merge-request page bug, so the GitLab figure governs (CERT-EU, 2026-10-12; BleepingComputer, 2026-10-12). The 19.4.1 release of 2026-09-23 fixed two flaws from the same reporter in the same component, a double free in the regular-expression parser and an integer overflow in the compiler, both rated for an authenticated user (GitLab, 2026-09-23); CVE-2026-97229 is rated without that requirement, and 19.4.1 is still affected. NCSC Switzerland and CERT-EU both published advisories on 2026-10-12 (NCSC Switzerland, 2026-10-12; CERT-EU, 2026-10-12); NCSC lists the exploitation status as unknown (NCSC Switzerland, 2026-10-12); Rapid7 reproduced the code execution on 19.4.1, published a proof of concept, and reports no confirmed exploitation in the wild (Rapid7, 2026-10-13). GitLab publishes the issue detail for a security fix 90 days after the release that carries it (GitLab, 2026-10-12).

Exposure

Self-managed GitLab CE or EE on 19.2.x below 19.2.8, 19.3.x below 19.3.5 or 19.4.x below 19.4.2; GitLab's table starts at 19.2 and lists no earlier branch (GitLab, 2026-10-12). NCSC Switzerland states the prerequisites as network access to the instance and delivery of a crafted regular expression through CI/CD configuration (NCSC Switzerland, 2026-10-12); Rapid7 found the conditions: an attacker must first commit a malicious CI/CD configuration file and a repository path containing UTF-8 characters to a branch in a public project, which an ordinary account can do by creating a public project where the instance allows it (Rapid7, 2026-10-13), and on instances where new users can self-register and create projects that constraint is removed (Rapid7, 2026-10-13). An instance with open sign-up, or with public projects that untrusted users can write to, is the case to prioritise.

Detection

GitLab and NCSC publish no indicators, so this is a hunt for the mechanism: in process-creation telemetry, shells, interpreters or network tools started as children of the GitLab application server processes, and in GitLab's audit and application logs, recently created or changed CI/CD configurations that carry unusual regular expressions, from accounts or addresses that have not used the instance before. Rapid7's proof of concept delivers the code through the public CI lint API without credentials, after pushing to a public project (Rapid7 proof-of-concept README, 2026-10-13): look for unauthenticated GET requests to /api/v4/projects/:id/ci/lint against a project that an account has just pushed to, and for application worker crashes that follow them, which the README says end the request with HTTP 502 while the worker is replaced (Rapid7 proof-of-concept README, 2026-10-13). A server where that turns up needs its CI/CD variables, runner registration tokens and deploy keys treated as exposed.

Triage: ordinary CI jobs run shells under the runners; only a shell spawned by the GitLab application server processes themselves matches this flaw, not one started inside a runner job; an anonymous CI lint request is ordinary on its own, and the signal is one aimed at a project that a newly created or little-used account has just pushed a CI configuration to.

Defender takeaway

Upgrade to 19.4.2, 19.3.5 or 19.2.8 now, starting with internet-facing instances as CERT-EU advises (CERT-EU, 2026-10-12); GitLab's release page lists no workaround as of 2026-10-13 (GitLab, 2026-10-12), Rapid7's interim controls (restrict anonymous access to public projects and stop untrusted users creating or writing to public projects) reduce exposure only to the path it demonstrated and do not fix the compiler flaw (Rapid7, 2026-10-13), and the proof of concept is tuned to one build while its author says analysis of additional reachable paths is ongoing (Rapid7 proof-of-concept README, 2026-10-13), so an instance that cannot be upgraded this week should be kept off untrusted networks; on a single-node instance the upgrade causes downtime, because migrations must finish before GitLab can start, so schedule the window now (GitLab, 2026-10-12).

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2

GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8) 2026-10-12

Network access to an affected self-managed instance and delivery of a crafted regular expression through CI/CD configuration

NCSC Switzerland (Security Hub advisory) 2026-10-12

CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.

CERT-EU 2026-10-12

As of this writing, there is no confirmed in-the-wild exploitation of CVE-2026-97229.

Rapid7's testing found that an attacker must first be able to commit a malicious CI/CD configuration file .gitlab-ci.yml, and a repository path containing UTF-8 characters to a branch in a public project.

Rapid7 2026-10-13

An attacker with permission to push to a public project supplies a CI regular expression and a specially named path.

Rapid7 researcher repository (proof-of-concept README) 2026-10-13

Update14 Oct 2026 03:43 UTCrun 2026-10-14T0255Z-inteltitleheadlinesummarytagscvessourcesevidencesourcing_noteactionsbody

Rapid7 reports that it independently reproduced arbitrary code execution on the official GitLab CE 19.4.1 image with address space layout randomization enabled, that the same input did not execute on the patched 19.4.2 image, and that it found no confirmed exploitation in the wild (Rapid7, 2026-10-13). Its testing shows the unauthenticated label needs a qualifier: the attacker must first push a malicious CI/CD configuration and a UTF-8 repository path to a branch in a public project, which an ordinary account can do where users may create public projects (Rapid7, 2026-10-13); the proof of concept then triggers it with a request without credentials (Rapid7 proof-of-concept README, 2026-10-13). A proof of concept went public the same day; its README says the included offsets were tested only against the 19.4.1 CE Linux amd64 image, that other builds need adjusted offsets, and that the generated payload is slightly larger than 2 GiB, needing about 9 GiB of memory on the test host (Rapid7 proof-of-concept README, 2026-10-13). The affected and fixed versions are unchanged.

vulnerability13 Oct 03:42Zmulti-sourceOpen finding →

Sources: GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8) · CERT-EU · NCSC Switzerland (Security Hub advisory) · BleepingComputer · GitLab (Critical Patch Release 19.4.1, 19.3.3, 19.2.7) · Rapid7 · Rapid7 researcher repository (proof-of-concept README)

03Updates to prior coverage3 items

NOTABLEupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Improvement13 Oct 2026 03:38 UTCrun 2026-10-13T0256Z-intelsummarysourcesevidencesourcing_noteactionsbody

Publica's own page of 2026-10-08 lists civil status and the IBAN among the data that could be affected and says its investigation indicates personal data of insured persons has presumably left. The AWP agency relays the software firm's position that it knows data left but not yet whether personal data is among it, that it may be business data, and that the volume is rather small.

Publica's own page, dated 2026-10-08, lists civil status, details of the spouse or partner and the IBAN among the data that could be affected, besides name, date of birth, AHV number, address, contact details and pension data, and Publica says its investigation indicates that personal data of insured persons has presumably left, while it cannot rule out that an individual member's data left (Publica, 2026-10-08). The AWP report, which relays the software firm's position, says the firm knows that data left but not yet whether personal data is among it, that it could also be business data unrelated to member files, and that the volume is rather small (cash.ch, 2026-10-09). Publica's wording is stronger than the supplier's, and which data left is still open; a request that quotes an IBAN deserves the same call-back as one that quotes an AHV number.

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP)

HIGHCVE-2026-102255 +3updatedNATOA2

CVE-2026-102255, SonicWall SMA1000: a third unauthenticated CVSS 10.0 Work Place SSRF this year, affecting the hotfix builds that closed the September zero-days, with exploitation attempts reported that SonicWall has not confirmed

First published 2026-10-08 · open finding →

Update13 Oct 2026 03:37 UTCrun 2026-10-13T0256Z-intelheadlinesummarysourcesevidencesourcing_notebody

NCSC Switzerland edited its advisory on 2026-10-12 to record the flaw as actively exploited, citing two honeypot operators: Defused, which saw attempts against its decoys from 2026-10-08, and Previdian, from 2026-10-09 (135 attempts from two US addresses). Previdian has not established that an attempt would have compromised a system, and SonicWall's advisory still says it has no evidence of exploitation.

NCSC Switzerland edited its advisory on 2026-10-12 and now records the exploitation status as actively exploited, citing two honeypot operators: Defused, which observed exploitation attempts against its honeypots from 2026-10-08, and Previdian, from 2026-10-09 (NCSC Switzerland, 2026-10-12). SecurityWeek relays Defused's statement that the first attempts reached its SMA decoys on October 8, two days after disclosure (SecurityWeek, 2026-10-12), and The Hacker News relays Previdian's count of 135 attempts from two unique US addresses (The Hacker News, 2026-10-12). These are attempts against decoys: Previdian has not established whether any would have compromised a system (BleepingComputer, 2026-10-09), no source reports a compromised appliance, and SonicWall's advisory, read again on 2026-10-13, still says there is currently no evidence of exploitation (SonicWall PSIRT, 2026-10-06). The Hacker News dates both operators' first detection to 8 October, while Previdian's own page gives 9 October as its first observation (The Hacker News, 2026-10-12; Previdian, 2026-10-12). The fixed builds remain 12.4.3-03670 and 12.5.0-03082.

Sources: SonicWall PSIRT (advisory SNWLID-2026-0017) · The Hacker News · CERT-FR · BleepingComputer · NCSC Switzerland (Security Hub advisory) · Canadian Centre for Cyber Security (AV26-1017) · Previdian · SecurityWeek

ROUTINECVE-2026-84411updatedNATOA2

CVE-2026-84411, MikroTik RouterOS: one unauthenticated request to the web management service can run code as root; fixed in 7.24 (v7 stable), 7.23.8 (v7 long-term) and 6.49.23 (v6 long-term) (CVSS 3.1 9.8)

First published 2026-10-10 · open finding →

Correction13 Oct 2026 03:36 UTCrun 2026-10-13T0256Z-inteltitleheadlinesummarycvessourcesevidencesourcing_noteactionsbody

Earlier text said the v7 long-term and v6 long-term releases were still pending, as MikroTik's notice of 2026-10-06 does; that was wrong. MikroTik's own changelogs show both had already shipped: 7.23.8 on 2026-10-08 and 6.49.23 on 2026-10-07 each list the CVE-2026-84411 fix, so owners of long-term and v6 devices can upgrade instead of only restricting the web service.

Earlier text said the v7 long-term and v6 long-term releases were still pending, as MikroTik's notice of 2026-10-06 does; that was wrong. MikroTik's own changelogs show both had already shipped: RouterOS 7.23.8 (2026-10-08) and 6.49.23 (2026-10-07) each list the line "system - improve stability (includes CVE-2026-84411);" (MikroTik, 2026-10-08; MikroTik forum, 2026-10-09; MikroTik forum, 2026-10-09). The notice itself was unchanged when read on 2026-10-13 and still reads "v7 long-term - release pending" (MikroTik, 2026-10-06). Owners of long-term and v6 devices can therefore upgrade rather than only restrict the web service.

Sources: MikroTik (security notice) · MikroTik (RouterOS 7.23.8 changelog) · MikroTik forum (6.49.23 long-term release announcement) · MikroTik forum (7.23.8 long-term release announcement) · CISA (ICSA-26-272-06) · BleepingComputer · CISA Known Exploited Vulnerabilities Catalog

04Action items5 items

Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.
FindingCERT-FR adds Copeland and Dixell xweb to the…
Tell the helpdesk, HR and payroll teams of every body whose staff are insured with Publica (including the federal administration and the ETH domain) that AHV number, date of birth, address, salary and IBAN may now be known to criminals and must not count as proof of identity, and route requests that quote them, a request to change a payout account included, to a call-back on a known number; for staff insured with the Bernische Pensionskasse or the Bernische Lehrerversicherungskasse apply the same rule until those funds report the scope, because the Bernische Pensionskasse says it has no indication of theft but cannot exclude it and the Bernische Lehrerversicherungskasse is still checking whether and to what extent its data is affected.
FindingPK Softech breach widens: Bernese cantonal funds…
If your organisation's pension administration, HR or payroll runs on PK Softech software, or your staff are insured with Pensionskasse Post, ask the supplier or the fund in writing whether your data was in the affected environment and what it holds: the Bernische Pensionskasse says it sees no indication of theft, the Bernische Lehrerversicherungskasse and Pensionskasse Post say the scope is under review, Publica says personal data has presumably left, and the supplier says data must be assumed to have left.
FindingPK Softech breach widens: Bernese cantonal funds…
Upgrade every self-managed GitLab CE and EE instance on 19.2, 19.3 or 19.4 to 19.2.8, 19.3.5 or 19.4.2 now, internet-reachable instances and instances that allow open sign-up or public projects first, because a public proof of concept exists; 19.4.1 and 19.3.4 remain affected, and until each instance is upgraded, restrict anonymous access to public projects and stop untrusted users from creating or writing to public projects, which reduces exposure only to the path Rapid7 demonstrated.
FindingCVE-2026-97229
Find every RouterOS device whose www or www-ssl service answers from a network you do not trust and upgrade it to the fixed build for its channel: 7.24 or later on v7 stable, 7.23.8 on v7 long-term, 6.49.23 on v6 long-term; where an upgrade has to wait, restrict www and www-ssl under IP > Services to trusted addresses or disable them and manage the router over WinBox, SSH or a VPN.
FindingCVE-2026-84411

Verification & coverage notes1 run

2026-10-13T0256Z-intel · Sonnet 5.5 · window 26 h · 2 entries published

Verification & coverage notes

Standard 26 h window (2026-10-12T00:57Z to 2026-10-13T02:57Z), following the 2026-10-12 fire that published one entry. The mechanical KEV diff found no CISA KEV addition inside the window (catalog 2026.10.08) and no RANSOMWARE-flag flip on a covered CVE, and S1 read the catalogue itself and agrees. The four sub-agents returned 20 candidate items (S1 four, S2 eight, S3 four, S4 four); two ship as new entries, three become changelog records, and the rest are dropped below. No deep dive and no critical: the Danfoss incident and the GitLab flaw are high, since neither is shown to be exploited against, or deployed in, the constituency. The Patch Tuesday cycles of 2026-10-13 (Microsoft, Adobe, Fortinet, Ivanti, SAP's own page, the ICS sets) were not yet published when S1 checked at about 03:20Z (Microsoft publishes about 17:00 UTC), so the next fire must read them first (msrc cvrf 2026-Oct, the SAP page, Adobe and Fortinet bulletins); SAP's October CVE records were already public through its CNA and S1 found no pre-auth code execution, no exploited and no publicly disclosed flaw among them.

Published (2):

2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack (incident, high): CERT-FR alert CERTFR-2026-ALE-012 reports numerous compromises of an internet-exposed controller class, with physical damage in hundreds of French stores and ANSSI saying other European countries may be affected. Relevance ground, stated here and not in the entry: a shared target profile (internet-exposed building and refrigeration controllers, often contractor-managed) under PD-11(c); no Swiss victim is named in any source, so the priority stays at high. It carries the 2026-08-28 Claroty entry in references[]; no source ties the attack to those CVEs, so no record was added there. S2 and S4 both returned it.
2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce (vulnerability, high): an unauthenticated CVSS 10.0 code-execution flaw in self-managed GitLab, an out-of-band critical patch release, NCSC-CH and CERT-EU advisories within hours; PD-11(b) on the flaw's own mechanics (anonymous path to full control of a build server, 19.4.1 still affected), no exploitation reported. S1 and S2 both returned it.

Updated (3), each one record on the existing entry:

2026-10-08/cve-2026-102255-sonicwall-sma1000-workplace-ssrf (update, priority stays high): NCSC Switzerland edited its advisory on 2026-10-12 to record the flaw as actively exploited, citing two honeypot operators (Defused from 2026-10-08, Previdian from 2026-10-09); SonicWall's advisory still says no evidence. The CVE status is not moved to exploited because the evidence is attempts against decoys.
2026-10-10/cve-2026-84411-mikrotik-routeros-web-management-preauth-rce (correction, no float): the entry said the long-term releases were pending; MikroTik's own changelogs show 7.23.8 (2026-10-08) and 6.49.23 (2026-10-07) already carry the fix, so the entry was imprecise when published. A correction rather than an update because the releases predate the entry; the vendor notice still reads pending.
2026-10-09/publica-pk-softech-supplier-malware-intrusion-data-outflow (improvement, no float): Publica's own page of 2026-10-08 lists civil status and the IBAN among the data that could be affected, and the AWP wire relays the supplier's "rather small volume" and "may be business data" framing; the entry carried neither and the action now names the IBAN.
borderline-drop: P7 DarkSword iOS 18.4-18.7 exploit-kit variant (S3; iVerify 2026-10-08, Report URI 2026-10-09; lookback items); the exploited flaws have been fixed since 2025 and Apple extended iOS 18.7.7 to more devices on 2026-04-01, the kit leaked publicly in March and the 2026-10-10 fire already dropped the chain; the new facts (on-device keychain and wallet theft, delivery through a re-registered analytics domain and brokered traffic) change no decision for a managed fleet on current iOS. One source conflict is left for the audit: Apple's iOS 18.7.7 note does not name CVE-2026-20700, which GTIG says was fixed in iOS 26.3.
borderline-drop: Ghostscript CVE-2026-39919 (S3, Wordfence, CVSS 9.8); the exploit chain is build-specific (Wordfence's own exploits failed in 10,240 attempts across ten other environments), no exploitation, not in KEV, EPSS 0.0078, upstream fix 2026-09-08 and distribution advisories since September: regular patch cycle, and no Swiss deployment is established.
borderline-drop: ((OTRS)) Community Edition 6 and Znuny CVE-2026-93582 (S1, CVSS 9.4), needs an HTTP Basic backend plus header-to-environment mapping, 6.x is end of life, no exploitation, Znuny listed a matching advisory on 2026-09-16 (its body was not fetched), no Swiss deployment is established.
borderline-drop: Magecart fake-Stripe skimmer with a Sepolia smart-contract dead drop, and a ClickFix kit delivering a trojanised Fileside Electron app (S3, Report URI), one self-interested script-integrity vendor, indirect nexus, on-chain C2 resolution and ClickFix already covered.
borderline-drop: Anthropic's report on unintended model actions on US government sites (S4, primary 2026-10-09, outside the window), no constituency victim, ordinary web weaknesses, and the AI-agent incident family is already covered by the OpenAI and earlier Anthropic entries.
borderline-drop: Ahold Delhaize outage (S4; company release, NOS, BleepingComputer), no vector, actor or behaviour public (incident floor), no Swiss or public-sector nexus; BleepingComputer finds no link to the French refrigeration attack.
borderline-drop: FortiBleed Swiss exposure census, 4,313 FortiGate interfaces reachable in Switzerland (S2 and S4; Inside IT, Netzwoche, Risikomonitor; the primary report was not found); an exposure count adds no operational fact to the covered entry.
borderline-drop: FTAPI dataset published on The Gentlemen's leak site (S2; heise, 2026-10-12), single source, mostly marketing material plus an apparent customer list; the entry stays routine.
borderline-drop: Qilin core-member arrest (S2; NRW, Japan's NPA, lookback); a law-enforcement action that changes nothing defenders do; Ricardo (Swiss Marketplace Group) 890,000-account disclosure (S2, S4), no vector, no actor, no public-sector nexus (incident floor); N0n claim against about 50 maritime and port operators (S4), claim-only.
borderline-drop: S1 candidates held below the gate, IBM Guardium siblings, HPE Aruba AOS-S and ClearPass (2026-10-06), AnyDesk Linux CVE-2026-109390 (fixed in June), SAP October rows (CVE-2026-89111 library-level, 89110 and 89107 authenticated, 89108 administrator), ZITADEL, WinBox, HAProxy Data Plane API, phpMyFAQ, SmarterMail, Metasploit msf-ws, Veeam, ILIAS, Cisco Nexus and License bundles, authenticated, administrator-only, library-level or already patched, none exploited, no established constituency exposure.

Backlog (state/coverage_backlog.md): all four open rows were re-gated on today's facts and none changed state, so nothing is appended and each stays held on its named condition with its expiry unchanged. IBM Guardium Data Protection CVE-2026-85542 and its four unauthenticated siblings: none is in CISA KEV (catalog 2026.10.08), IBM's bulletin of 2026-10-08 lists CVE-2026-85542 as authenticated with no exploitation statement, ACN's alert is unchanged, no public proof of concept and no constituency deployment surfaced (expires 2026-10-14). SafePay claim on ARA-Region Lyss-Limpachtal and Payload claim on Netech: ransomware.live shows no press confirmation, S2 and S4 found no Swiss press report and neither victim site carries an incident notice (both expire 2026-10-14). Beyond Gravity: every public account still traces to the single 2026-10-02 company release as relayed by AWP, Inside IT and Netzwoche, with no vector, actor or data class named (expires 2026-10-20). The three rows that expire on 2026-10-14 are struck by the next fire if their conditions are still unmet.

Contradictions and discrepancies carried in the entries: (1) GitLab: CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, the vendor page names 19.3.5 and says 19.3.4 had a merge-request page bug; the entry uses the vendor figure. (2) SonicWall: NCSC Switzerland says actively exploited, the vendor advisory says no evidence; both statements are in the entry, with the evidence limited to attempts against decoys. (3) Danfoss: Infosecurity quotes Intermarché at 150 stores while AFP and BFMTV give 300 Intermarché or Netto shops; BFMTV says 300 is twice the first estimate of 150, so the entry says the counts moved during the day. Single-source facts: the forced 50-degree defrost and the "older than version 4" scope are BFMTV's reporting alone.

Rotation: ranking used the derived cursor; 78 standard or candidate records (S1 12, S2 24, S3 42) were set aside as attempted in the previous two fires, and S4's pool of 19 breach and ransomware sources was entirely inside those two fires, so its 14 oldest-cursor records were swept anyway.

Coverage gaps: prodaft (no dated listing reachable on any transport; WebSearch only); zaufana-trzecia-strona (undated listing); ransomware-live (recentvictims capped at 100); sap-security-notes (October page 404 until later on 2026-10-13); hadrian-labs, depthfirst, esentire, socradar, msft-ti and proofpoint (listing or extract quirks, no in-window item). Reader credit: extract fell through to the metered reader on 404 and 403 responses (a not-yet-published SAP page, a GitHub advisory, anydesk.com, fortiguard.fortinet.com and psirt.global.sonicwall.com).

For the next audit: (1) tools/fetch_source.py extract falls back to the metered reader on any 404 or 403, spending credit on URLs that merely do not exist yet; S1 suggests url --direct first for such URLs, and a flag to disable the fallback would remove the cost; (2) CERT-FR ALERT bulletins are not in cert-fr avis-recent: the Danfoss alert was found only through the alert feed, now recorded in the anssi-fr notes, and a recipe subcommand would make it routine; (3) S2 suggests a Swiss-press lookback through the cash.ch sitemaps (recorded in the source notes) and notes that the Zug cantonal ISG consultation runs to 2026-11-09 and that CRA manufacturer reporting applied from 2026-09-11 (ENISA); (4) the Apple iOS 18.7.7 note versus GTIG on CVE-2026-20700 (see the DarkSword drop) if the kit resurfaces.

Source health and verification: the probe covered 242 records (241 relevant, 1 stale) and its UNSOLVED list held one record, ico-uk [needs-demote], a false alarm: the recipe downloads a 5 MB sitemap and a cold fetch passed the 45 s probe budget twice, while the same recipe returned in 3 s once cached. tools/source_health.py now honours a per-source probe_timeout (set to 120 on ico-uk) and tools/test_source_health.py covers it; the snapshot in state/source_health.json still shows the false alarm until the next sweep. Verification so far: iteration 1 (truth 9, editorial 5, advisory 4) found hedges missing from the Danfoss title and summary, an unsupported "no security updates" claim, a MikroTik headline that overstated the changelogs, attribution slips in the SonicWall and Publica records and a missing downtime note; all were fixed or declined with a reason. Iteration 2 (truth 4, advisory 4) found one false negative in the Danfoss Exposure line, a registry summary stating the defrost as fact, and two more hedges; all were fixed except one declined F11, the CISA citation date on the MikroTik entry, which iteration 3 raised again and which is now corrected (the advisory's own number, ICSA-26-272, dates it 2026-09-29). Iteration 3 (truth 1, advisory 4) found two stale statements in these notes and wording slips, all fixed. Iteration 4 (truth 5) found a clause in an older SonicWall update section that Defused contradicted, an affected-version range on the MikroTik entry that ignored the long-term builds, an action line on the Publica entry that overlooked Publica's own statement, a Previdian citation date that was the last-observed date, and an off-by-one source count in these notes; all were fixed. Iteration 5 (truth 0, editorial 1, advisory 5) found no wrong claim: it added the retailers' own framing of the attack as hitting a refrigeration service provider or supplier, which the Danfoss entry now carries with a takeaway asking the contractor whether its own remote access was affected, and four wording and consistency points. The low-residual early exit applies (truth plus editorial is 1, no F1 or F4), so the remediations were applied and the run published without a sixth pass; the provider sentences were checked by hand against the AFP and BleepingComputer pages read this run. Residual: the Danfoss changes made after iteration 5 (headline, provider sentences, trims) have had no independent pass, and the SonicWall status stays patch-available on evidence limited to decoys, which a reader may weigh differently from the Atlassian entry.