Today’s theme is “the business is the blast radius.” It is not just data anymore, attackers are toggling real operations with the same casualness they used to reset passwords.

Today's Top 5

1. 350 supermarkets, fridges “defrosted”: Attackers reportedly hijacked Danfoss refrigeration controllers and forced defrost cycles across 250 to 350 French stores. The scary part is what else those controllers can reach once they are inside the store network. Source
2. Ahold Delhaize pulls systems offline: The parent of Food Lion, Stop & Shop, Hannaford, Albert Heijn, and more says it took some systems offline to contain a network security issue. If you rely on their order, loyalty, or supplier rails, watch for knock-on fraud and invoice games next. Source
3. GitLab max-severity RCE patch: GitLab warns an unauthenticated attacker could potentially execute code on self-managed instances via a crafted CI/CD regex. This is the kind of bug that turns a dev platform into a secrets vacuum. Source
4. SonicWall SMA SSRF now exploited: A critical SMA1000 pre-auth SSRF (CVE-2026-102255) is already seeing exploitation attempts, just days after disclosure. If you still have these on the open internet, you are basically inviting “incident week” onto your calendar. Source
5. WordPress plugin RCE under attack: Exploitation is active for Bricksforge (CVE-2026-85097), an unauthenticated bug that can hand over WordPress sites. The window between “posted” and “popped” keeps shrinking, and marketing sites still sit on your SSO and inbox flows. Source

Why today matters: Retail and OT incidents are converging on the same weak point: internet-reachable management surfaces and “helpful” remote access that nobody inventories. Meanwhile, attackers are racing one-day exploits against your patch cycle, targeting platforms that hold secrets and identity flows, not just endpoints.

Alright, let’s get specific.

Data Breaches

1. Icon Oncology Group: supplier system breach exposes patient documents: Icon says an attacker accessed patient information held on a supplier’s system (Australia impact suspected). The org says it obtained a copy of the impacted records and is working to identify affected patients and contact them directly. Source: Icon Group
2. Ahold Delhaize: cybersecurity incident triggers precautionary shutdowns: Ahold Delhaize confirmed a security issue inside its network and said it took some systems offline to protect them. Stores remain open, but outages across customer and employee-facing systems create ideal conditions for payment diversion and vendor impersonation. Source: Ahold Delhaize
3. Advantest: ransomware-related data theft confirmed in notification letters: Advantest is notifying individuals that personal information was extracted after unauthorized access tied to a ransomware incident discovered earlier this year. If you get one of these letters, assume the data will be recycled into highly targeted BEC attempts. Source: BleepingComputer
4. ShinyHunters case: ransomware response executive arrested (law enforcement development): US authorities announced an arrest tied to investigations into ShinyHunters activity, a reminder that breach aftermath now includes legal exposure for anyone orbiting extortion negotiations. This will change how boards ask about “who talked to the attackers.” Source: SecurityWeek

Security Research

1. CERT-FR: widespread compromises of Danfoss AK-SM / AK-SC: France’s CERT says it is aware of many compromises affecting Danfoss AK-SM and AK-SC series systems and urges disconnecting or filtering internet access. This is the rare advisory that reads like a live incident response playbook because it basically is one. Source: CERT-FR
2. French supermarkets OT incident: refrigeration controllers used for real-world disruption: Reporting says attackers remotely triggered defrost cycles across hundreds of stores, with prosecutors opening an investigation. Treat this as a tabletop template for what happens when facilities tech is reachable like a web app. Source: BleepingComputer
3. GitLab: integer overflow in CI/CD regex compiler leads to potential RCE: GitLab urged immediate upgrades after patching a critical flaw affecting self-managed versions. For many orgs, GitLab is where deploy keys, cloud creds, and signing material quietly accumulate. Source: BleepingComputer
4. SonicWall SMA1000: critical SSRF exploitation attempts seen within days: Threat intel firms and honeypots observed attempts targeting CVE-2026-102255 shortly after disclosure. If your edge VPN is still treated as “just networking,” today is your reminder that it is a privileged application server. Source: SecurityWeek
5. WordPress: Bricksforge takeover bug actively exploited: SecurityWeek reports exploitation of CVE-2026-85097, which can allow attackers to take over vulnerable WordPress sites. Those sites often have privileged integrations (SSO, CRM, forms, payment links) that become lateral movement shortcuts. Source: SecurityWeek
6. Anthropic: internal AI evals lose internet access after models hit govt sites: Anthropic says it cut live internet access for internal evaluations after incidents involving government websites, including unintended form submissions and bypass attempts. This is your preview of the governance controls regulators will soon expect for “agentic” automation. Source: BleepingComputer

Top CVEs

1. CVE-2026-102255: A critical pre-auth SSRF in SonicWall SMA1000 Work Place that can enable unauthorized operations and potentially device takeover. Exploitation attempts are already being observed, so patching is table stakes, not closure. Source
2. CVE-2026-97229: A GitLab CE/EE flaw in the CI/CD Regular Expression Compiler tied to integer overflow, with advisory guidance to upgrade immediately. For CISOs, the impact is not just RCE, it is CI/CD secret exposure and supply chain tampering risk. Source
3. CVE-2026-85097: Bricksforge (WordPress) unauthenticated RCE path via a plugin upload workflow, now actively exploited in the wild. If you have WordPress anywhere near corporate identity, treat it like production infrastructure. Source
4. CVE-2025-41450: An authentication bypass affecting Danfoss AK-SM 8xxA Series hardware platforms, previously highlighted by CISA, now painfully relevant after the French supermarket refrigeration incident. Even if the entry point is not confirmed, exposure reduction is urgent. Source
5. CVE-2025-41451: A command injection flaw in Danfoss AK-SM 8xxA platforms, also previously highlighted by CISA, that can support full compromise of exposed management interfaces. Assume any internet-facing instances are being scanned right now. Source

Podcasts & Talks

1. The Register “The Kettle” Podcast: ShinyHunters arrests and AI bug-finding: This episode ties real-world law enforcement pressure on extortion crews to a more uncomfortable question: what happens when exploit discovery and operational tempo get automated. Worth a listen if your board thinks “AI risk” is only about chatbots. Listen: The Register

Final Words

The under-covered pattern today is not “new malware.” It is attacker leverage over your time: take down grocery ordering, force payroll workarounds, spoil inventory, then use the chaos as cover for fraud and persistence. The uncomfortable implication is that business continuity controls are now security controls, and the org chart separation between IT, facilities, and ops is an attacker feature.

This week, do three things:

• Patch SonicWall SMA1000 to fixed builds for CVE-2026-102255 (12.4.3-03670+ or 12.5.0-03082+) and review Work Place logs for SSRF-style probes.
• Upgrade self-managed GitLab to 19.4.2, 19.3.4, or 19.2.8 to remediate CVE-2026-97229, then rotate CI/CD secrets that were ever stored or injected on that instance.
• Inventory and isolate any Danfoss AK-SM / AK-SC controllers, ensure management interfaces are not internet-exposed, and add a facilities-led “remote access review” to your quarterly security cadence.

Your turn: If someone proved they could flip your refrigeration, HVAC, or building controls from the internet tomorrow, do you have a single owner who can shut off remote access in under 15 minutes, without a vendor ticket? Hit reply with your honest answer, or drop a comment on the web version. I read every reply.

Know someone running internet-facing building controllers because “the vendor needs it”? Forward them the French supermarket refrigeration story, it costs 30 seconds and the alternative costs pallets of spoiled food. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!