Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads

Here’s a roundup of the week’s biggest cybersecurity developments, from a retail giant pulling its network offline to government spyware delivered through ordinary online ads. A zero-day in a popular VPN appliance, a record Patch Tuesday, and a major crackdown on North Korean IT workers also made headlines. Most of these stories show how attackers keep exploiting trust, whether in ads, messages, or the software we already rely on.

Ahold Delhaize takes systems offline after a cyberattack!

Dutch retail giant Ahold Delhaize confirmed on October 12 that it had detected a “security issue” and shut down parts of its network to contain it. Stores stayed open, but customers couldn’t use websites or apps at several brands in the Netherlands and Belgium, and some Stop & Shop staff couldn’t reach schedules and pay stubs. The company is also dealing with its second major incident in recent years. BleepingComputer

Refrigerators at French supermarkets shut down by hackers!

Attackers remotely switched off refrigeration units at several French supermarket chains over the weekend before the window, reportedly by targeting Danfoss refrigeration controllers. Researchers say the weaknesses in that equipment had been disclosed months earlier, which makes the story a warning about leaving known flaws unpatched. BleepingComputer Cybersecurity Dive

Government spyware delivered through online ads!

Citizen Lab reported that Candiru spyware infected at least 45 Al Jazeera devices in 2024 and 2025 using malicious ads that needed no click at all. The ads were sold through a company called Discover-Tech, which the researchers describe as a bridge between ad networks and mercenary spyware vendors. It is the first public technical confirmation that this kind of spyware can reach real devices through advertising. The Hacker News

Ivanti Connect Secure zero-day under active attack!

Ivanti disclosed CVE-2026-104935, an authentication bypass in its Connect Secure VPN appliances that lets unauthenticated attackers run commands. Volexity found a threat actor chaining it with other flaws to reach root on fully patched devices. CISA added it to its exploited catalog and gave federal agencies until Friday to patch. BleepingComputer

More edge devices added to CISA’s exploited list!

On October 14, CISA added a Palo Alto Networks PAN-OS code injection flaw (CVE-2026-0322) and a Cisco Secure Email Gateway path traversal flaw (CVE-2026-76519) to its Known Exploited Vulnerabilities catalog. The pattern is familiar: internet-facing network gear remains a favourite entry point, and patching it quickly matters more than almost anything else. Sherlock Forensics

BeyondTrust Remote Support flaw linked to China-based hackers!

BeyondTrust patched CVE-2026-102764 in its Remote Support product on October 16. The flaw was reportedly exploited by a China-linked group since late August. Remote support tools are a high-value target because they hold privileged access to many organisations at once. Sherlock Forensics

Microsoft’s October Patch Tuesday breaks records!

Microsoft’s October Patch Tuesday fixed more than 1,400 vulnerabilities, a record for the company. One of them, CVE-2026-96951, is a Windows Shell flaw that is already being exploited and lets attackers bypass the Mark of the Web protection on downloaded files. Administrators should prioritise it. The Record

FBI disrupts North Korean “laptop farms” in Texas!

The Justice Department charged 14 people and arrested two in Operation Lonestar Roundup. FBI agents searched more than 40 suspected laptop farms in Texas and seized about 187 devices. North Korean IT workers used stolen or fake identities to win remote jobs at roughly 70 US companies, and the scheme is estimated to have raised around $3 million. BleepingComputer

AI helps build a full Chrome exploit in six days!

Security firm XBOW used AI agents powered by OpenAI’s public GPT-5.6 Sol model to chain three previously unknown Google Chrome bugs into a full-chain exploit. The work took six days and is reported to be worth around $250,000 in bug bounty terms. It shows how quickly AI tools are shrinking the time between a vulnerability and a working attack. Cyber Recaps

Spy chips found in hardware crypto wallets!

Researchers reported spy implants inside hardware crypto wallets, and the wallet maker Ledger confirmed that a chip implant was behind some wallet thefts. The story is a reminder that supply chain attacks can target hardware as well as software, and that buyers should check where their devices come from. This Week in Security

Small AI models could form self-spreading botnets, Anthropic warns!

Anthropic warned that small AI models could soon be used to build self-propagating botnets across internet-connected devices. The warning reflects a broader concern that cheaper, lighter models will make automated attacks easier to run at scale. Hacklido

OpenAI employee arrested for planting a hidden recorder!

An OpenAI employee was arrested over an alleged hidden recording device placed in an executive conference room. The case is an insider threat story, showing that physical and internal security matter as much as network defences at AI companies. Hacklido

ConnectWise suspends cloud backup after Microsoft 365 tenant compromises!

ConnectWise suspended its cloud backup service after attackers compromised Microsoft 365 tenants. Customers who relied on that backup were left without a safety net, which is why backups should be stored separately from the systems they protect. Hacklido

Critical GitLab flaw with a CVSS score of 10.0!

GitLab patched a flaw rated CVSS 10.0 that could let unauthenticated users run code on the server. Administrators running self-managed GitLab instances should update immediately, since a bug at this severity is typically found and exploited quickly. Hacklido

Technical University of Denmark reports identity system breach!

The Technical University of Denmark found unauthorised access to its identity and access management systems, with a large amount of data taken out. Identity systems are especially sensitive because compromising them can open the door to everything else. Sharkstriker

These cybersecurityincidents also highlight the importance of email security. Implementing DMARC, SPF, and DKIM helps organizations protect their email domains against spoofing and reduce the risk of domain impersonation and phishing attacks.