Here are today’s top cybersecurity stories for Tuesday, October 13, 2026.
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access
Volexity reports an attacker it tracks as UTA0576 compromised a fully patched Ivanti Connect Secure appliance running 22.8R2.4, starting October 3. The chain pairs an authentication bypass and remote code execution flaw, CVE-2026-104935, with a privilege escalation flaw. Ivanti has fixed the first two, and the root escalation fix is still pending. The Hacker News
Attackers Heat French Supermarket Fridges by Hijacking Danfoss Controllers
Attackers took control of Danfoss refrigeration controllers on the night of October 11 and warmed fridges and freezers to as much as 50°C. Les Mousquetaires, Carrefour, Coopérative U, Monoprix, and E.Leclerc reported affected stores. CERT-FR urged operators to disconnect the AK-SM and AK-SC controllers or filter access to them. The Paris prosecutor has opened an inquiry. The Hacker News BleepingComputer
SAP Discloses CVSS 10 Flaw in Cloud SDK for Python
CVE-2026-89111 affects multi-tenant applications on SAP Business Technology Platform. Without validation of the tenant subdomain, the SDK sends the client ID and secret to an attacker-controlled server. SAP fixed the flaw in version 0.45.2, and The Hacker News found six later releases without the check. No attacks are reported. The Hacker News
Docker Fixes Two-Year-Old Hub Flaw CVE-2026-105445
Converting a personal Docker Hub account into an organization transferred its personal access tokens to the named owner without consent. A transferred token allowed pushing, pulling, or deleting images in the owner’s repositories. Docker deployed a server-side fix on September 30 and reports no evidence of exploitation. The Hacker News
GitHub Tightens npm Publishing After Flaw Left 1,500 Packages Open to Hijacking
Bloom Security found npm trusted publishing matched repositories by name instead of by numeric ID. Attackers claiming a freed repository name were able to publish malicious versions of other people’s packages. GitHub now expires unvalidated trusted publisher setups after 48 hours. The Hacker News
Norway Fines Microsoft’s Xandr a Record €8.6 Million Over Grindr Data
The Norwegian Data Protection Authority found Xandr relayed Grindr users’ personal data, including data revealing sexual orientation, to advertisers through real-time bidding. The regulator treated Xandr as a joint controller responsible for consent. Microsoft is reviewing the decision, and Xandr has three weeks to appeal. The Hacker News BleepingComputer
XWorm RAT Evolves Into Surveillance Platform
Netskope reports the plugin count rose from 35 to 46, with new modules for GPS location, live microphone audio, webcam capture, and a live browser view. The browser module allows hijacking of authenticated sessions. Netskope observed more than 1,200 incidents across 100 organizations in the third quarter. SecurityWeek
Two Critical MarkLogic Flaws Give Delegated Managers Persistent Admin Control
Progress disclosed 31 MarkLogic Server flaws, including CVE-2026-85947 and CVE-2026-85948 at CVSS 9.9. Fixes arrived in versions 11.3.7 and 12.1.0 on September 10. No exploitation is reported, and the flaws are absent from the CISA KEV catalog. The Hacker News
LG Smart TVs Open to Pre-Authentication Root Takeover From the Local Network
Three chained webOS flaws let a nearby attacker gain root without a PIN. An anonymous researcher tested models 32LQ636BPSA and 27TQ600SW on webOS 7.5.7-25. LG released a fix, no CVEs are assigned, and no exploitation is reported. The Hacker News
Anthropic Warns Small AI Models Might Form Self-Propagating IoT Botnets
Anthropic tested 11 open-weights models and found GLM-5.2 spread Llama3.1-8B to all eight emulated Android nodes in four of five trials. The company says small models are months away from worm-like spread across weak IoT devices. It says it does not yet have a full rogue replicator. The Hacker News
TFG London Cyberattack Disrupts Systems at Hobbs and Whistles
TFG London detected the attack on October 11 and took IT systems offline across Phase Eight, Hobbs, and Whistles. Stores remain open. The company has not confirmed any customer data exposure, and no threat actor has claimed the attack. BleepingComputer
Stay tuned for today’s in-depth analysis posts.
