VulnHub

Around 700 supermarkets in France were affected by a cyberattack targeting refrigeration systems, specifically those operated by Copeland and Dixell. The attackers have not claimed responsibility for the incident, which raises concerns about the security of critical infrastructure in the retail sector. This incident not only disrupts operations but also poses risks to food safety, as refrigeration systems are essential for preserving perishable goods. The attack highlights the vulnerabilities in supply chain technology and the potential for significant operational disruptions if such systems are compromised. As supermarkets work to recover, it remains crucial for organizations to bolster their cybersecurity measures to prevent similar attacks in the future.

Next.js has rolled out an urgent security patch that addresses two serious vulnerabilities allowing unauthenticated remote code execution (RCE) and a high-severity denial-of-service (DoS) issue. The first RCE flaw is linked to React Server Components, while the second involves librsvg, an open-source library used by Next.js for processing SVG images through the sharp package. This update, released on October 14, is crucial for developers using Next.js, as it can prevent attackers from executing malicious code on affected systems. Users should apply this patch promptly to protect their applications from potential exploitation. The vulnerabilities could have serious implications for any web applications relying on Next.js, making swift remediation essential.

Drupal has patched a serious vulnerability in its Field UI module that could allow attackers to execute code on affected servers. This flaw, identified by the Drupal Security Team, cannot be exploited directly through the core system alone; however, several contributed modules can provide pathways for exploitation. Notably, at least one of these paths does not require user authentication, making it particularly concerning for site administrators. The security update was released on October 14 and affects Drupal versions 11.4.10, 11.3.19, and 10.6.19. It is crucial for users of these versions to apply the updates promptly to prevent potential attacks.

A security vulnerability has been identified in Thermo Fisher's Torrent Suite Software, specifically versions 5.18 and earlier. The flaw, classified as CVE-2026-107777, allows authenticated attackers to exploit a path traversal issue, potentially enabling them to read arbitrary files on the Torrent Server. This could pose serious risks, especially in sensitive sectors like healthcare and public health, where such data could be critical. Users are advised to update their software to version 5.22 or later to mitigate this risk. As of now, there are no reports of this vulnerability being actively exploited in the wild, but organizations should remain vigilant and follow recommended security practices to safeguard their systems.

J4Care has reported multiple critical vulnerabilities in its dcm4chee-arc-light software, specifically version 5.35.1. These vulnerabilities could allow attackers to delete medical images, access patient information, inject false studies, and even cause denial-of-service conditions. The flaws stem from issues like missing authorization, infinite loops, and inadequate validation of inputs, which could be exploited to manipulate patient records and associated data. J4Care recommends that all users upgrade to version 5.35.2 or later to mitigate these risks. Given the nature of the affected software, which is widely used in healthcare settings, these vulnerabilities present significant risks to patient data security and system integrity.

Guangzhou Juan IoT Technology's EseeCloud app and firmware have serious vulnerabilities that could let attackers take control of affected IP cameras. Specifically, versions of the EseeCloud App up to 4.9.6 and EseeCloud Firmware up to 4.9.86.0 are impacted by three critical vulnerabilities. One flaw allows attackers to log in using hard-coded credentials, while another lets them rebind devices to their own accounts, potentially exposing sensitive information. Furthermore, a third vulnerability permits attackers to enumerate registered devices due to a discrepancy in error messages. As these products are used globally across critical sectors like energy and communications, the implications for security are significant. Users are urged to contact the company for support and remain vigilant about their device security.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, identified as CVE-2026-21589, affects multiple Atlassian products, allowing unauthorized access to files or directories. The risk posed by this vulnerability is significant, especially for federal agencies, as it can lead to total control of affected systems if exploited. CISA urges all organizations, not just federal agencies, to prioritize fixing high-risk vulnerabilities like this one. If anyone is aware of additional vulnerabilities that are being exploited but not listed in the KEV Catalog, they can submit these for review through CISA's nomination form.

CISA Malcolm has been found to have several vulnerabilities that affect versions up to 26.08.0. These vulnerabilities include authentication bypass, incorrect authorization, server-side request forgery, and cross-site request forgery, among others. Attackers could exploit these flaws to gain unauthorized access to sensitive components like the Arkime backend or execute harmful commands through the kiosk application. The vulnerabilities pose risks to critical infrastructure sectors including energy and water systems, highlighting the importance of timely updates for users of Malcolm. Users are strongly advised to upgrade to version 26.09.0 where these issues have been patched.

A new wave of cyberattacks is targeting US companies through fake AI products. Attackers are mimicking popular AI software to spread malware, hijack browser sessions, and compromise business accounts. Research from ANY.RUN identified over 1,200 instances of these campaigns between April and October 2026, with a significant portion of the attacks aimed at US businesses. This surge in malicious activity is putting additional strain on Managed Security Service Providers (MSSPs), who are struggling to keep up with the growing threat. Companies need to be vigilant about the authenticity of AI tools they use and ensure they have adequate security measures in place to protect against these deceptive tactics.