TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. The company disclosed earlier today that several IT systems remain unavailable, although physical stores remain open for customers. According to the press release, the incident has not affected the group’s other brands, Inside Story and White Stuff, or its operations in Australia and Africa. TFG London is the UK subsidiary of South Africa’s The Foschini Group, which owns the aforementioned five fashion and homeware brands. As of mid-2026, the group operated 649 retail locations globally and reported annual sales of £488 million ($646M). The company said it detected the cyberattack on October 11 and immediately activated its incident response and business continuity plans, bringing in external cybersecurity experts to help contain the threat.
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT). Docker Hub is an online registry for storing, sharing, and downloading container images - templates that package everything needed for an application to run in an isolated environment. In Docker Hub, a PAT serves as a secret used to authenticate tools and workflows. It allows you to pull, push, or delete container images. According to a security bulletin from the Docker team, an attacker could create an account and PAT, then convert the account into an organization and name a target user as its owner. The CVE-2026-105445 flaw stems from Docker Hub reassigning a personal access token (PAT) to a designated organization owner without changing its secret or obtaining the target's consent. This allowed the attacker to use the token to authenticate as the target.
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. Customers who can't immediately deploy the October 2026 SAP patches can temporarily mitigate the issue by using an allowlist to validate tenant_subdomain values. "The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated," according to a Tuesday advisory.
GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory. The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program. The company also addressed these flaws: CVE-2026-92883 (CVSS score: 8.7) – A security flaw where an attacker can trick another user’s web browser into running malicious JavaScript code through a specially designed repository. CVE-2026-16301 (CVSS score: 8.5) – An authorization flaw that lets a user with a Developer role bypass security permissions and run automated testing/deployment (CI/CD) pipelines on protected code branches. CVE-2026-14814 (CVSS score: 8.2) – A pattern-matching flaw that allows an attacker to manipulate cached files, causing target users’ automated pipelines to run malicious code and potentially leak sensitive environment variables. In early October, GitLab released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to execute arbitrary commands on the gateway. GitLab disclosed the flaw on October 2 and fixed it with the release of AI Gateway versions 19.2.4, 19.3.2 and 19.4.1. The issue affects the way the AI Gateway handles custom flow prompt templates. According to GitLab, a user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt template sandbox and execute commands on the AI Gateway host. “GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.” reads the advisory. The key point is that the attack does not require an unauthenticated connection. GitLab’s advisory does not provide further details about the exact conditions required to exploit the flaw or the permissions needed beyond that access. GitLab credited the HackerOne researcher invisiblemeerkat with responsibly reporting the vulnerability. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-97229)
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions. Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires. The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out. “300 Intermarché and Netto stores, and fewer than 100 U stores, were affected on Monday, October 12, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss, according to the two retailers.” reports BFMTV. “Hackers reportedly remotely altered the temperatures of the systems, causing the destruction of stocks of fresh and frozen products.” The scale is still being counted. The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers. A specialist site reported that Carrefour Market and Monoprix stores were hit too, which those chains haven’t confirmed. The money follows. A sector source told BFM national losses could reach several million euros, and Intermarché said its affected stores had to throw out all the fresh and frozen products concerned. In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros. Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected. Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires. This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols. The full extent of the damage is still being calculated. The Mousquetaires group reported that 300 Intermarché and Netto stores were affected, while Coopérative U stated that fewer than 100 of its locations were hit. E.Leclerc also confirmed that cooling equipment in several stores was affected, though they did not provide specific figures. Meanwhile, a specialized news site reported that Carrefour Market and Monoprix stores were targeted as well, though these chains have not yet confirmed it. The financial impact is heavy. Industry sources told BFM that national losses could reach several million euros, and Intermarché confirmed that all affected stores had to throw out their fresh and frozen inventory. For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods. The damage isn’t limited to the east. In the Loire-Atlantique, the huge Leclerc Atlantis in Saint-Herblain took all its frozen products off its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins wasn’t expected to reopen its fresh aisle normally before Tuesday, October 13. Several U stores were hit as well, some only in the frozen aisle, and an Intermarché in the same area too. One photo from BFM shows an ice cream shelf reading 26 degrees, which is a fine temperature for a beach. Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented. His point is easy to see. Nobody was stealing data here, and the target was food. Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU. Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra… — Dominique Schelcher (@schelcher) October 12, 2026 The authorities moved quickly. According to the Prime Minister’s office, the national cybersecurity agency ANSSI has identified a vulnerability in software supplied by Danfoss and contacted the company. ANSSI is also talking to its European counterparts because other countries may be affected, and it’s trying to find other French companies hit. Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware, specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates, while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected. Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires. This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols. Because these controllers are typically managed remotely and feature a built-in web server, an attacker who gains access can send direct commands to the connected cooling systems—such as forcing a manual defrost. Claroty’s research highlights that the product is widely deployed across supermarkets, cold-storage facilities, and logistics warehouses, with a Censys scan revealing 2,765 exposed management interfaces online. Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1. However, BFM notes that authorities have not officially confirmed whether hackers exploited this specific flaw in the recent attack. If it was the entry point, standard security disclosure practices were followed, as details were withheld until a patch was made available. For legacy, end-of-life units, no security patches exist, leaving disconnecting them from the public internet as the only viable defense. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French supermarkets)
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data
A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion charges. Reuters reported the arrest, citing court documents, prison records and a person familiar with the case. The group has also stolen information about FBI employees. Court documents filed in the Eastern District of Pennsylvania, which includes Philadelphia, accuse the defendant of conspiring to threaten the confidentiality of information to extort money and of interfering with commerce. “A Canadian ransomware negotiator was arrested Thursday and faces unspecified extortion charges, according to court documents, prison records and a person familiar with the matter, as the FBI cracks down on a hacking group that stole information about its employees.” Reuters states. “Edward Dubrovsky faces charges of conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce,” according to court documents, opens new tab filed with the Eastern District of Pennsylvania, which covers Philadelphia.” Krebs on Security reports that the second charge involves threats. The main criminal complaint remains sealed, so the details of the defendant’s alleged role are not yet public. The records spell the last name two ways, Dobrovsky or Dobrosky, and they don’t list an age, a profession or an employer. A person briefed on the matter told Reuters the defendant is Edward Dubrovsky, a Canadian cybersecurity executive. Reuters couldn’t even settle the spelling, which tells you how early this is. “Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges.” states the report. “Several of those documents — including the core complaint — are now sealed. But a handful of them were indexed at Courtlistener.com, including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.”” Federal prosecutors in Philadelphia didn’t return repeated messages about the discrepancies. Reuters also couldn’t reach Dubrovsky, his lawyers, or CyberSteward, the company named on his LinkedIn profile. According to Krebs, the available records showed no attorney yet. “An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer.” states Krebs. “According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.” CyberSteward advertises itself as a specialist in threat actor engagement, cyber extortions, complex negotiations and settlement facilitation. On LinkedIn, Dubrovsky presents himself as an expert in negotiating ransom payments with cybercriminals. SecurityWeek notes he’s also the author of a book on responding to cyber extortion. Politico and Krebs reported the arrest first. Krebs says he was in Philadelphia for a cyber insurance conference. Federal prison records show a man with his name detained at a federal detention center in the city. ShinyHunters is the backdrop. Last month the group claimed it had stolen information on nearly every FBI employee, and it said it got into the bureau’s jobs website and other systems in response to an FBI report earlier this year warning about its activity. FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software. When Reuters asked about the arrest, the FBI pointed to a statement from Director Kash Patel and declined further comment. Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor. This is the latest arrest… — FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026 Patel described the arrest as the latest in a series of actions against ShinyHunters over just a few days. According to SecurityWeek, he said the FBI will continue working to disrupt the remaining network. This is the third suspected arrest linked to ShinyHunters in recent weeks, following one in the Netherlands on September 15 and another in Jordan on September 28. The case has also moved to another court. A notice filed on October 9 transferred it to the Eastern District of Texas, where sources told Krebs on Security the FBI’s ShinyHunters investigation is focused. However, authorities have not publicly explained what the defendant allegedly did. Reuters reports that the charges have not been specified, and the main complaint remains sealed. Krebs on Security also reports, citing sources, that executives at other ransomware negotiation firms could face charges. The FBI says ShinyHunters has extorted more than $70 million this year. The latest arrest brings the number of suspected ShinyHunters members detained in recent weeks to three. On September 15, authorities arrested a suspected member in the Netherlands. A second alleged key member was reportedly arrested in Jordan on September 28 and is said to be cooperating with the FBI. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ShinyHunters)
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. Yandex customers are experiencing service outages, some of them reporting inability to access files stored on the company’s cloud infrastructure. The impacted data centers are in Sasovo (hit on October 8), Kaluga (hit on October 9), and Vladimir (attacked on October 11). The Sasovo and Vladimir facilities stopped operating completely, while the Kaluga facility's operations are degraded. The attacks are believed to have been carried out by Ukrainian forces trying to cause widespread operational disruptions. Yandex reported no injuries related to these incidents. As Russia’s largest technology companies, Yandex is often called “Russia’s Google,” offering search engine, maps, and navigation services. The company also offers ride-hailing, delivery, shopping, streaming, email, cloud storage, and business cloud infrastructure services.
Anthropic announced that its internal AI models under “high-risk and cybersecurity evaluations” no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. The instances leading to the decision include AI models that exploited website vulnerabilities, submitted forms, bypassed data restrictions, and circumvented safeguards. However, the company said that the misaligned behavior had a minimal real-world impact and assessed the behavior to be less severe than previously reported incidents. The AI company notified the White House about the unauthorized activity: Anthropic estimates that the agents may have been motivated by overly generous rewards during reinforcement learning, which may have encouraged them to find unauthorized workarounds rather than stop when a task was blocked or impossible.
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste. The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system. "Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service," an Intermarché spokesperson told BleepingComputer when asked for more information on the incident. "Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible. We don't have further information currently, nor a specific list of affected stores to share with you."
Confirm this action.
Leaving now will discard your changes.