Daily Cybersecurity News – October 13, 2026
CyberRecaps is supported by its readers. We may earn an affiliate commission at no extra cost to you if you buy through a link on this page.
npm Trusted Publishing allowed 1500+ package takeovers
HighWhat happened
Bloom Security researchers showed that npm's Trusted Publishing feature allowed an attacker to publish new versions of another maintainer's package without stealing any credential. The only requirement was registering a GitHub repository under a slug (owner/repo name) that the original maintainer had freed by renaming, transferring, or deleting the bound repo or account.
npm recorded the repository only by its mutable slug and ignored the permanent numeric IDs that GitHub embeds in the identity token. Once the slug was free, an attacker could recreate the repo, add a matching workflow file, and receive a short-lived publish credential. Bloom demonstrated the full attack on packages it controlled and counted more than 1,500 exposed packages. GitHub has shipped fixes that expire unvalidated configurations after 48 hours and bind a configuration to the repository's immutable identity on first successful publish.
Who is affected
Maintainers who configured Trusted Publishing against GitHub repositories that were later renamed, transferred, or deleted, plus any consumers of those packages. The exposed packages total more than 10 million downloads and more than one million downloads per month.
One successful malicious publish is enough to affect every machine that installs the new version.
Why it matters
A hijacked release can include a postinstall script that runs automatically on install, giving the attacker code execution on developer and CI machines. The published version also carries a valid provenance attestation naming the attacker's repository, which can defeat simple provenance checks.
Bloom notes that AI coding agents already install roughly 70 packages per month on a typical endpoint, amplifying the reach of any single compromised package.
How it could have been prevented
Review Trusted Publishing configurations and ensure they are bound to immutable repository identities. Rotate or remove any configurations created before the October 2026 changes.
Monitor package publish events for unexpected repositories or workflows. Prefer packages whose maintainers use hardware keys or other strong second factors, and pin dependencies to known-good versions with lockfiles. GitHub recommends treating any pre-fix configuration as untrusted until rebound.
Relevant professional terms
- Trusted Publishing
- An npm feature that lets a package be published from a CI workflow using a short-lived identity token instead of a long-lived secret token.
- Provenance attestation
- A signed build record attached to a published package that states which repository and workflow produced it, intended to let consumers verify the supply-chain origin.
Unauthenticated RCE in Bricksforge WordPress under active attack
CriticalWhat happened
Attackers are actively exploiting CVE-2026-85097, a critical unauthenticated remote code execution flaw in the Bricksforge WordPress plugin. The bug sits in the Pro Forms module through version 3.1.8.9 and lets an unauthenticated visitor upload a file that appears to be an image yet is later saved and executed as PHP.
Insufficient validation of an attacker-controlled URL field in the temporaryFileUploads parameter during form submission is the root cause. Patchstack reported exploitation in the wild. The CVSS score is 9.8.
Who is affected
Any WordPress site running Bricksforge (a paid visual site-builder add-on for the Bricks page builder) at version 3.1.8.9 or earlier. The plugin is not hosted on wordpress.org but still runs with full site privileges.
Exact install counts are not public, yet the plugin's role as a Swiss-Army-knife builder tool means many production sites are exposed.
Why it matters
Successful exploitation gives the attacker full remote code execution on the web server. From there they can deface the site, read or alter database content, steal credentials, or plant persistent backdoors.
Because the attack needs no login, automated scanners can hit every vulnerable site. Security teams treat such plugins as high-risk third-party dependencies rather than optional decoration.
How it could have been prevented
Upgrade Bricksforge immediately to 3.1.8.10 or 4.0.1. After patching, search wp-content/uploads/bricksforge/tmp for unexpected PHP files and review form-submission logs for anomalies.
Maintain a software bill of materials that lists every plugin and version, and apply third-party risk reviews to any component that accepts file uploads or form data. Disable or restrict the Pro Forms module if it is not required.
Relevant professional terms
- Remote code execution (RCE)
- A vulnerability that lets an attacker run their own commands or programs on a target system, usually with the privileges of the vulnerable application.
- Unauthenticated arbitrary file upload
- A flaw that allows anyone on the internet to place a file of their choosing onto the server without first logging in, often leading directly to code execution when the file is later interpreted.
Qilin and Settra ransomware exploit old Palo Alto VPN flaw
CriticalWhat happened
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication-bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. The flaw lets an attacker establish an unauthorized VPN session without valid credentials.
Palo Alto disclosed the issue on 13 May 2026, released patches, and noted limited early exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on 29 May 2026. Despite the five-month-old fix, unpatched devices continue to be targeted. Observed follow-on activity includes Cobalt Strike, BloodHound, and SharpHound.
Who is affected
Organizations running vulnerable PAN-OS versions (including 10.2.0, 11.1.0, 11.2.0, 12.1.0 and corresponding Prisma Access releases). Panorama and Cloud NGFW are not affected.
Any internet-facing GlobalProtect portal or gateway that has not been upgraded remains exposed. EPSS probability sits at 96.9 percent.
Why it matters
VPN access obtained this way looks like legitimate remote-worker traffic, delaying detection until credential theft, lateral movement, data exfiltration, or ransomware deployment occurs. Both Qilin and Settra are known ransomware operators, so successful exploitation frequently ends in encryption and extortion.
The vulnerability carries a CVSS score of 9.1 and is confirmed as actively exploited in ransomware campaigns.
How it could have been prevented
Upgrade all affected PAN-OS and Prisma Access deployments to fixed versions at once. Disable authentication override cookies where they are not required.
After patching, terminate every active GlobalProtect session and hunt for unexpected connections, especially sessions using hostnames such as kali. Patching alone does not remove access that attackers established before the upgrade. Segment VPN entry points and monitor for anomalous internal reconnaissance tools.
Relevant professional terms
- Authentication bypass
- A vulnerability that lets an attacker skip the normal login process and gain access as if they had valid credentials.
- Known Exploited Vulnerabilities (KEV) catalog
- CISA's authoritative list of CVEs that are confirmed to be under active attack in the wild; U.S. federal agencies must remediate them by a set deadline.
Ledger finds hardware implant in CryptoBilis-sold wallets
HighWhat happened
Ledger temporarily halted sales through reseller CryptoBilis after reports of stolen cryptocurrency funds linked to devices bought from that channel. Losses exceed $86 million, mainly among users in Southeast Asia, according to blockchain investigator Specter.
Ledger later confirmed that at least one examined device contained an unauthorized hardware implant. The company is contacting affected customers. All confirmed cases involve units sold by CryptoBilis. CryptoBilis has stopped selling hardware-wallet inventory pending the investigation.
Who is affected
Anyone who purchased a Ledger device from CryptoBilis in the preceding 90 days, especially customers in Southeast Asia. Ledger states the number of impacted devices is limited and confined to that reseller.
Users who have already initialized a suspect device and transferred funds onto it face the highest risk.
Why it matters
A hardware implant can intercept or exfiltrate the seed phrase or private keys at the physical layer, defeating the normal security model of an air-gapped hardware wallet. Once keys are compromised, funds can be drained with no further user interaction.
The incident underscores supply-chain risk for high-value crypto hardware when devices leave authorized distribution channels or are restocked after returns.
How it could have been prevented
If you bought from CryptoBilis in the last 90 days and have not yet set up the device, do not initialize it. If you have already set it up, move assets to a brand-new Ledger signer generated with a fresh seed.
Buy only from Ledger's official store or fully authorized resellers. Never accept a device that arrives with a pre-printed recovery phrase. Resellers should never restock returned units. Treat any offer to help recover lost funds as a scam.
Relevant professional terms
- Hardware wallet
- A physical device that stores cryptocurrency private keys offline and signs transactions without exposing the keys to an internet-connected computer.
- Supply-chain implant
- Malicious hardware or firmware added to a device during manufacturing, distribution, or resale so that it behaves differently from the genuine product the user expects.
Danfoss controllers hijacked to heat French supermarket fridges to 50°C
HighReported store impact
| Chain | Stores hit |
|---|---|
| Intermarché / Netto | At least 300 |
| Coopérative U | 80 |
| Carrefour | 80 |
| Monoprix | ~30 |
| E.Leclerc | Several |
What happened
On the night of 11 October 2026 attackers remotely seized control of Danfoss refrigeration controllers in hundreds of French supermarkets and forced fridges and freezers into defrost, raising temperatures as high as 50°C. Stores had to discard large quantities of food.
The attackers reached the devices through remote-management interfaces used by maintenance firms. CERT-FR confirmed compromises of the AK-SM and AK-SC controller series. Danfoss stated that most affected units were older end-of-life models (AK-SM 800 and AK-SC 355) that no longer receive security updates; some newer AK-SM 800A units were also hit. No threat actor has been named.
Who is affected
French retail chains including Intermarché and Netto (at least 300 stores), Coopérative U (80 stores), Carrefour (80), Monoprix (about 30), and E.Leclerc (several). Exact totals vary by source, but the blast radius reached hundreds of locations.
Any facility still running internet-exposed or weakly filtered Danfoss AK-SM / AK-SC controllers, especially EOL hardware, remains at risk.
Why it matters
The attack converted a cyber intrusion into immediate physical and financial damage: spoiled inventory, emergency clean-up, and estimated losses of tens of millions of euros for one group alone. It demonstrates that OT/ICS devices controlling cold-chain infrastructure are attractive targets when left reachable from the internet.
Older controllers that vendors have declared end-of-life create long-lived exposure because patches will never arrive.
How it could have been prevented
Immediately disconnect vulnerable Danfoss controllers from the internet or place them behind strict network filters and VPN-only access as urged by CERT-FR and ANSSI. Replace end-of-life AK-SM 800 and AK-SC 355 units with supported models.
Segment refrigeration networks from corporate IT, enforce multi-factor authentication on any remote-maintenance portals, and monitor for unexpected setpoint changes or defrost commands. Maintain an inventory of all OT controllers and their patch or replacement status.
Relevant professional terms
- OT/ICS
- Operational Technology and Industrial Control Systems - the computers and controllers that directly manage physical equipment such as fridges, valves, or factory lines.
- End-of-life (EOL) device
- Hardware or software that the vendor no longer supports with security updates, leaving known and future vulnerabilities permanently unpatched.
Small AI models could self-replicate across IoT devices
MediumWhat to watch
- Whether open-weight models under 30 B parameters reliably chain reconnaissance, exploitation, model transfer, and inference startup by end of 2026.
- Appearance of any real-world IoT malware that embeds model weights rather than classic binaries.
- Defensive signals: unexpected large file drops, sustained GPU/NPU load, or lateral movement on Android TV and similar low-cost devices.
- Vendor and ISP responses to default-credential and remote-management exposure on consumer IoT.
What happened
Anthropic's Frontier Red Team reports that small AI models may be only months away from self-replicating across commercial IoT devices without needing a central data center. Researchers bought 15 inexpensive Android TV boxes and showed that a 26-billion-parameter model could run when split across them.
A 9-billion-parameter model successfully started inference on eight of nine hardware types tested. In a closed network of eight emulated Android devices, the open-weight model GLM-5.2 completed a full replication cycle (including a deliberately trivial hacking step) to all eight devices in four of five runs. Models under 30 billion parameters already perform many individual steps but still err when chaining them.
Who is affected
Owners of low-cost IoT and Android-based devices (TV boxes, cameras, routers, etc.) that can run inference and are reachable on local or wide-area networks. Future botnets on the scale of prior IoT worms could host tens or hundreds of thousands of model copies.
No active self-replicating AI worm is reported in the wild today; the work is forward-looking research.
Why it matters
An AI worm that carries its own weights has no single command-and-control server to sinkhole, making takedown harder. Even a large IoT botnet would supply only modest total compute (roughly equivalent to a few dozen high-end GPUs), yet the persistence and autonomy raise new defensive challenges.
Anthropic treats the lab results as an upper bound and notes that historical IoT malware such as Mirai spread by simple default-credential attacks, a bar low enough for future models to clear.
Relevant professional terms
- IoT botnet
- A collection of compromised internet-connected everyday devices (cameras, routers, TV boxes) that an attacker controls as a group to run tasks or launch further attacks.
- Weight-based replicator
- Malware that carries a copy of an AI model's parameters (weights) and can install and run that model on newly infected devices, enabling autonomous spread without external infrastructure.
Raven AI matches interior photos to exact Airbnb homes
MediumHow it works
- User uploads an interior photo (social media, seized device, etc.).
- Raven extracts visual characteristics of rooms, fixtures, and furnishings.
- System searches millions of short-term rental and real-estate listing images.
- Ranked results return matching properties, often with listing text and additional photos of the same address.
What happened
Graylark Technologies has added interior geolocation to its Raven platform (formerly GeoSpy). Law-enforcement users can upload a single photo of a room, appliance, or other interior detail and receive ranked matches to specific short-term rental or real-estate listings on services such as Airbnb, Vrbo, and Zillow.
Demo videos show the tool identifying a Charlotte Airbnb from a washer/dryer photo and a Montecito Vrbo from a bathroom photo within seconds, quoting listing text and surfacing matching interior images. The system does not rely on EXIF location data; it matches visual characteristics across millions of property photos. LAPD and Miami-Dade Sheriff's Office have previously purchased Raven access.
Who is affected
Hosts and owners whose interior photos appear on short-term rental or real-estate platforms, plus anyone whose private spaces have been photographed and later shared. Law-enforcement agencies that subscribe to the service gain a new investigative lead-generation capability.
The feature works worldwide on indexed listings.
Why it matters
A photo that once revealed only a generic room can now be turned into a precise address. While marketed for trafficking and exploitation investigations, the same capability can locate private residences from images obtained by any means, raising privacy and stalking concerns.
It illustrates how AI visual search plus large public listing datasets creates new de-anonymization risks for everyday photos.
Relevant professional terms
- Geolocation
- The process of determining the real-world geographic location of an object, person, or image, here performed from visual content alone.
- Visual feature matching
- An AI technique that extracts distinctive patterns, objects, and layouts from an image and compares them against a large database to find the same physical place even when the photos are not identical.