A CVSS 10.0 unauthenticated RCE in GitLab’s CI/CD regex compiler demands immediate patching for any organization running self-managed instances. Meanwhile, one of the world’s largest grocery chains is in active incident response across three countries, and a confirmed hardware supply chain attack proves that spy chips in the distribution channel are not fiction - they just cost someone $86 million.

In the News

GitLab Ships Emergency Fix for CVSS 10.0 Unauthenticated RCE

GitLab released an emergency patch for a maximum-severity vulnerability in the regex compiler engine used by its CI/CD pipeline. The flaw allows unauthenticated remote code execution on any GitLab CE/EE instance with CI/CD enabled - no credentials, no user interaction, full server compromise.

The attack surface is significant. GitLab is deployed as the primary DevOps platform across thousands of enterprises, and CI/CD functionality is enabled by default on most installations. An attacker who reaches a vulnerable GitLab instance over the network can achieve code execution on the underlying server through a crafted regex pattern submitted to the CI/CD engine. From there, the standard post-exploitation playbook applies: credential harvesting from CI/CD variables, lateral movement into connected repositories and deployment targets, and access to secrets stored in GitLab’s built-in vault.

Organizations running self-managed GitLab should treat this as a stop-everything patch. GitLab.com (the SaaS offering) has already been patched. For self-managed instances where immediate patching is not possible, network-level isolation of GitLab servers and CI/CD runners from production infrastructure is the primary compensating control. Disable public-facing CI/CD endpoints if feasible.

What defenders should do: Patch all self-managed GitLab CE/EE instances immediately. Validate that CI/CD runners are network-segmented from production databases and secrets stores. Audit CI/CD pipeline variables for exposed credentials. Review GitLab access logs for anomalous regex compilation requests as a post-compromise indicator.

Source: BleepingComputer

Ahold Delhaize Takes Systems Offline After Multi-Country Cyberattack

Ahold Delhaize, the parent company of US grocery chains Stop & Shop, Giant, and Food Lion, took multiple systems offline after detecting a cyberattack affecting operations across the United States, Netherlands, and Belgium. The company operates over 6,700 stores and reported $90 billion in annual revenue.

The operational response - pulling systems offline across multiple countries simultaneously - signals a significant intrusion with potential lateral movement across the organization’s infrastructure. The attack vector and threat actor have not been publicly confirmed. The pattern of multi-country system shutdown is consistent with ransomware containment procedures, though Ahold Delhaize has not used that term in its public statements.

This incident is relevant beyond retail. Any organization with distributed operations across thousands of sites faces the same architectural challenge: centralized IT systems that, when compromised, cascade disruption to every physical location. The question for defenders is whether their business continuity plans account for simultaneous multi-site system shutdowns, and whether store-level operations can function independently when central systems go dark.

What defenders should do: Organizations with distributed retail or multi-site operations should review IT/OT segmentation between central systems and branch locations. Validate that point-of-sale and inventory systems can operate in a degraded mode if central connectivity is severed. Ensure incident response plans include procedures for coordinated multi-country system isolation.

Source: The Record (Recorded Future)

Ledger Confirms Spy Chip Implant Drained $86M in Crypto From Reseller Channel

Ledger confirmed that a physical hardware implant - a spy chip inserted into devices at a Southeast Asia reseller called CryptoBilis - siphoned $86 million in cryptocurrency by intercepting signing operations. The attack targeted the distribution layer, not Ledger’s manufacturing line. Devices passed factory integrity checks but were tampered with after leaving Ledger’s controlled supply chain.

This is a confirmed, large-scale hardware supply chain attack. The implant intercepted cryptographic signing keys during transaction authorization, redirecting funds to attacker-controlled wallets. The attack did not require any software vulnerability - the compromised hardware performed its malicious function at the physical layer, beneath the operating system and firmware integrity checks.

The implications extend well beyond cryptocurrency. Any organization that relies on hardware security modules, network appliances, or endpoint devices sourced through third-party resellers or distributors faces analogous risk. Hardware root-of-trust verification - cryptographic attestation that a device’s hardware has not been modified since manufacture - is the primary countermeasure. Vendors that implement silicon-level identity certificates (such as SUDI certificates on network equipment) provide a verifiable chain of custody from factory to deployment.

What defenders should do: Verify procurement channels for critical hardware - HSMs, network appliances, authentication tokens. Implement hardware integrity verification for devices sourced through third-party distributors. For high-security deployments, use vendor trusted supply chain programs that provide additional physical and cryptographic assurance.

Source: SecurityWeek

French Supermarkets Hit by IoT Attack - Refrigerators Remotely Heated to 50°C

Threat actors hijacked Danfoss refrigeration controllers across hundreds of French supermarket locations, remotely raising temperatures to 50°C and spoiling perishable inventory at scale. The attack exploited internet-exposed industrial IoT management interfaces with default or weak credentials. No ransomware was deployed. No data was exfiltrated. The attackers simply manipulated physical-world conditions through network-accessible industrial controls.

This attack is notable for its simplicity and its physical-world impact. Danfoss refrigeration controllers, like many industrial IoT devices, were designed for operational convenience - remote management over the network - without adequate security controls. Default credentials, no network segmentation, and direct internet exposure created an attack surface that required no sophistication to exploit. The result was hundreds of stores losing entire perishable inventories simultaneously.

For defenders, this is the OT segmentation conversation made tangible. Industrial IoT devices - HVAC controllers, refrigeration systems, building management systems - should never be directly reachable from the internet. They should sit on segmented network segments with monitored, restricted access. OT asset discovery tools that automatically inventory these devices are the prerequisite: you cannot segment what you cannot see. MITRE ATT&CK for ICS technique T0855 (Unauthorized Command Message) and T0831 (Manipulation of Control) apply directly.

What defenders should do: Audit all internet-exposed industrial IoT management interfaces. Enforce network segmentation between IT and OT environments. Change default credentials on all industrial controllers. Deploy OT asset discovery to inventory devices that may not appear in traditional IT asset management systems.

Source: The Hacker News

Defender Action Items

  • GitLab CE/EE: Patch immediately to the emergency release. Segment CI/CD runners from production. Audit pipeline variables for credential exposure.
  • SonicWall SMA 1000 (CVE-2026-102255): Validate patch status on all SMA 1000 appliances. If unpatched, take offline or restrict management interface access. Over 135 exploitation attempts observed in the wild.
  • Bricksforge WordPress Plugin (CVE-2026-85097): Update or disable immediately on any WordPress instance in DMZ or customer-facing environments. Confirmed unauthenticated RCE under active exploitation.
  • Industrial IoT/OT: Audit for internet-exposed Danfoss and similar industrial controllers. Segment OT networks. Change default credentials. Deploy OT asset discovery.
  • Hardware procurement: Review supply chain provenance for HSMs, hardware wallets, and network appliances sourced through third-party distributors.

Detection Spotlight

For organizations running self-managed GitLab, the following Splunk SPL query identifies anomalous CI/CD regex compilation activity that may indicate exploitation attempts against the regex compiler RCE. Look for unusually large or malformed regex patterns submitted to the CI/CD engine:

index=gitlab sourcetype="gitlab:production"
| search controller="Ci::Pipeline" OR controller="Ci::Runner"
| where len(params) > 5000
| stats count by src_ip, user, uri_path, _time
| where count > 10
| sort -count

This query surfaces high-volume or oversized CI/CD requests that could indicate exploitation attempts. Baseline normal regex compilation request sizes in your environment first - legitimate CI/CD pipelines rarely submit regex patterns exceeding a few hundred characters. False positive rate depends on CI/CD workload complexity; environments with heavy regex-based test suites will need tuning.

For OT environments concerned about the Danfoss refrigeration attack pattern, monitor for unauthorized management protocol traffic to industrial controller subnets:

index=firewall sourcetype="cisco:ftd"
| search dest_zone="OT" AND (dest_port=80 OR dest_port=443 OR dest_port=502 OR dest_port=47808)
| where src_zone!="OT_Management"
| stats count by src_ip, dest_ip, dest_port, action
| sort -count

This flags any non-OT-management traffic attempting to reach industrial controllers over common management and industrial protocols (HTTP/S, Modbus, BACnet).

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.