Cyber Threat Brief — October 13 2026
1. Danfoss refrigeration controllers abused in French supermarket attack — CVE-2025-41450 / CVE-2025-41451 / CVE-2025-41452
TL;DR: Attackers remotely forced defrost cycles on internet-exposed Danfoss AK-SM refrigeration controllers across hundreds of French supermarkets overnight on Oct 11–12, spoiling food and causing small fires. Get every Danfoss StoreView interface off the public internet now, then inventory and patch to R4.3.1.
What’s New:
- Intermarché/Netto, Coopérative U, Carrefour, and Monoprix were hit; reporting puts the total around 250–400+ stores, almost all in France, with food losses in the millions of euros. ANSSI and French prosecutors are investigating.
- No vendor, agency, or retailer has named the exploited flaw. Danfoss told AFP most affected gear was “legacy” hardware that no longer gets updates, which may point at the older AK-SM 800 line rather than the 8xxA.
- The three documented AK-SM 8xxA CVEs are the suspected — not confirmed — set: a code-of-the-day auth bypass (CVE-2025-41450), an alarm-to-mail OS command injection (CVE-2025-41451), and an nginx config-injection DoS (CVE-2025-41452). Claroty Team82 counted ~2,765 StoreView interfaces exposed on Censys.
- R4.2 fixes only the auth bypass; the RCE and nginx injection need R4.3.1, so a fleet sitting at R4.2.x is still remotely exploitable post-auth.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Internet-reachable Danfoss AK-SM 8xxA StoreView interface below firmware R4.3.1 | Vulnerable version | T1190 | External attack-surface scan (Censys/Shodan) / perimeter firewall inbound | Inventory every AK-SM 8xxA and its firmware build; anything below R4.3.1 is remotely exploitable, and R4.2 fixes only CVE-2025-41450. Remove the StoreView web interface from all public IPs — no port-forward, UPnP, or NAT exceptions — and reconcile a post-patch version inventory against your install base. |
HTTP request to xml.cgi?action=getauth that returns an admin session without the configured password | Exploit traffic (auth bypass) | T1190 | Controller nginx/web access log / network IDS | Alert on getauth requests that yield an authenticated session when the submitted password is not the configured one. This is the code-of-the-day bypass (CVE-2025-41450); on firmware below R4.2 it grants full admin with no credentials. |
Shell metacharacters (', ;, $(), backtick) in the alarm-to-mail SMTP password config item 0x1be1 | Command injection | T1059 | Network IDS / WAF on StoreView save requests | Alert on any save of config item 0x1be1 whose value carries shell metacharacters. The value is formatted unsanitized into an OS command and runs as the web-service user (CVE-2025-41451 RCE); the fix is R4.3.1. |
Multipart upload to xml.cgi?action=load_nginx_headers | Exploit traffic (config injection / DoS) | T1190 | Controller web access log / network IDS | Alert on every action=load_nginx_headers call — benign volume is near zero. It replaces headers.conf on the internet-facing nginx (CVE-2025-41452); a follow-on request to an injected route crashes sm_app for a repeatable DoS and can plant persistent routes. Fix is R4.3.1. |
sm_app or sm_fcgi_app process spawning sh/bash or a system utility | Process behavior | T1059.004 | Controller host logs / OT EDR (where collectable) | Where you can collect process telemetry from the controller, alert when sm_app/sm_fcgi_app spawns a shell or utility — the web service should never do this. Also alert on headers.conf modification immediately followed by a web-service-triggered nginx -s reload. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No Danfoss, AK-SM, or ICS-refrigeration analytic in ESCU. |
| Elastic | None — verified | No rule references Danfoss, StoreView, or the headers.conf abuse; these are embedded ICS appliances outside the Linux endpoint ruleset’s scope. |
| Sigma | None — verified | No Danfoss/AK-SM rule; the generic Linux web-shell rules key on nginx/apache/node parents, not the controller’s sm_app/sm_fcgi_app. |
Detection index: ESCU a3936a0 (2026-10-13) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ b4ba1f2 (2026-10-12).
Hunt hint: Start on the wire, because these controllers rarely run host agents. Pull perimeter and proxy logs for any inbound hit on a StoreView interface, then alert on action=load_nginx_headers and getauth anomalies. For command injection, grep IDS/WAF capture for shell metacharacters in 0x1be1 save requests. Where you can reach the controller OS, hunt sm_app/sm_fcgi_app spawning a shell and headers.conf writes paired with nginx -s reload. Matt Suiche’s public FROMAGEGATE PoC repo ships adaptable Suricata/Sigma rules (sids 4414500–4414530), but the definitive code-of-the-day attributes stay redacted, so tune against real firmware before production.
Sources: Claroty Team82 — Freeze the Controller, Defrost the Food · Danfoss DSA-2025-08-01 · CISA ICSA-25-140-03 · Matt Suiche — FROMAGEGATE detection writeup/PoC · Reuters · BleepingComputer · BBC
2. GitLab CI/CD regex compiler — unauthenticated RCE — CVE-2026-97229
TL;DR: GitLab shipped an emergency patch for CVE-2026-97229, a CVSS 10.0 unauthenticated remote-code-execution flaw in the CI/CD regular-expression compiler. Upgrade self-managed CE/EE now, and keep the instance off the public internet until you do.
What’s New:
- GitLab released fixed builds on Oct 12; CERT-EU and Help Net Security advisories followed Oct 12–13. GitLab.com and Dedicated are already patched.
- A crafted regular expression in a CI/CD configuration triggers an integer overflow in the regex compiler and executes code as the GitLab service account — no authentication or user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N).
- Affected: self-managed CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab has no workaround — upgrading is the only fix.
- Early advisories listed 19.3.4; GitLab re-released 19.3.5 after a regression, so land 19.3.5 (not 19.3.4) on the 19.3 line. No public PoC or confirmed exploitation reported as of Oct 13.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Self-managed GitLab CE/EE below 19.2.8, 19.3.5, or 19.4.2 | Vulnerable version | T1190 | GitLab /help version page / asset inventory | Check each self-managed instance’s version at /help or via gitlab-rake gitlab:env:info, then upgrade 19.2.x→19.2.8, 19.3.x→19.3.5, 19.4.x→19.4.2. 19.1 has no separate release — move it to 19.2.8 or later. |
| Crafted regular expression in a CI/CD pipeline configuration processed by the regex compiler | Exploit input | T1190 | GitLab production_json.log / Puma application logs | GitLab has not published the precise unauthenticated trigger or a PoC, and no exploitation is confirmed yet. Until patched, restrict network access to the instance and watch production_json.log/Puma logs for pipeline-config processing errors or worker crashes. |
GitLab Puma worker (ruby process, parent command line contains puma) spawning sh/bash or a network tool | Process behavior | T1059.004 | Linux EDR / auditd execve on the GitLab host | The RCE runs in-process as the git service account, so the most reliable host signal is a ruby/puma parent on the GitLab box spawning a shell or network tool. Alert on that lineage — it indicates post-exploitation. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No GitLab or Puma analytic in ESCU. |
| Elastic | Partial — Suspicious Child Execution via Web Server; Unusual Command Execution via Web Server | Both match a ruby* parent whose command line contains puma/rails/passenger spawning a shell, so they catch a reverse or web shell from a GitLab Puma worker. Neither sees the regex payload itself or in-process Ruby execution that spawns no child, and both need Linux endpoint/auditd telemetry. |
| Sigma | None — verified | Linux Webshell Indicators lists nginx/apache/node/java parents, not ruby/puma; Webshell Remote Command Execution keys on euid=33 (www-data) while GitLab Puma runs as the git user. |
Hunt hint: Inventory first — hit /help on every self-managed instance and upgrade anything below 19.2.8/19.3.5/19.4.2. Because the RCE runs in-process as git, your strongest host signal is a ruby/puma parent on the GitLab server spawning a shell or network tool, so hunt that lineage in EDR or auditd. There is no public PoC or confirmed exploitation yet, so patch speed and network exposure are what to fix first; keep the instance off the public internet until it is upgraded.
Sources: GitLab critical patch release 19.4.2 · CVE-2026-97229 (MITRE) · CERT-EU advisory 2026-016 · Help Net Security · Beazley Security BSL-A1226
Status Updates
- CVE-2026-85097 (Bricksforge WordPress): Now actively exploited. Patchstack logged the first attempts on Oct 7 and tracks 63 source IPs hitting
/wp-json/bricksforge/v1/form_submitwith craftedtemporaryFileUploadsto drop GIF/PHP polyglots; Wordfence corroborates. Fixed in 3.1.8.10 (now 4.0.1) — audit that endpoint and for new PHP in/wp-content/uploads/bricksforge/tmp/. The Hacker News, original brief. - CVE-2026-102255 (SonicWall SMA1000): Exploitation of the pre-auth SSRF (CVSS 10) is now confirmed — SecurityWeek and Horizon3.ai report takeover attempts, with Previdian and Defused sensors seeing the first hits Oct 8, two days after disclosure. Still not in KEV; patch to 12.5.0-03082 or 12.4.3-03670. SecurityWeek, original brief.
- CVE-2026-107406 (Citrix NetScaler ADC/Gateway): Singapore’s CSA issued an alert Oct 12, and CISA told admins Oct 9 to patch it alongside the three earlier NetScaler flaws. It affects SAML SP/IdP configurations and can give RCE or DoS; fixed in 14.1-73.46 and 13.1-64.29 or later. CSA alert, original brief.
- CVE-2026-86950 (Apple CoreGraphics): The KEV remediation due date is today, 2026-10-13. Original brief.
- Flax Typhoon KEV items (CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894): The 2026-10-11 due date has passed, so these are overdue. No KEV additions since Oct 8 (catalog 2026.10.08, 1,739 entries). Original brief.
- CVE-2026-0257 (Palo Alto GlobalProtect): No change; still KEV overdue. Original brief.
- Deferred, not yet briefed: Claude “Adception” ClickFix lure and Telegram Desktop CVE-2026-107181 (recheck 2026-10-14), WatchGuard PSKMAD CVE-2026-13043 (recheck 2026-10-14), and AnyDesk Linux “AnyPwn” (recheck 2026-10-16).
- Watching (no change): CVE-2026-105133 and CVE-2026-105134 (10-09), CVE-2026-82077 (10-11), GhostAction (10-10), CVE-2026-104286 (10-02), CVE-2026-102489 and CVE-2026-102490 (10-03), CVE-2026-88779 (10-04), CVE-2026-61500 and CVE-2026-88062 (10-04), CVE-2026-76504 (10-01), CVE-2026-21589 (10-06), CVE-2026-83548 and CVE-2026-83549 (09-03).