Monday opens with a supply-chain compromise that matters for anyone running cloud infrastructure and a ransomware escalation that matters for anyone running Palo Alto firewalls. The OVHcloud CLI backdoor lasted only 94 minutes, but that window was long enough to exfiltrate developer secrets at scale. Meanwhile, the PAN-OS zero-day from Friday graduated from targeted exploitation to confirmed ransomware campaigns overnight.

In the News

OVHcloud CLI Backdoored via Compromised GitHub Account - 94 Minutes of Secret Exfiltration

An attacker compromised the GitHub account of an OVHcloud contributor and pushed a malicious release of the official OVHcloud CLI tool between 12:47 and 14:21 UTC on October 19. The backdoored release harvested environment variables - cloud API keys, access tokens, service credentials - and exfiltrated them to attacker-controlled infrastructure.

OVHcloud revoked the release within 94 minutes and rotated the compromised contributor’s access. The company has advised all customers who downloaded the CLI during that window to rotate every credential that was present in the environment where the tool ran.

This is a textbook software supply-chain attack. The mechanism is not novel - compromised contributor accounts have been the initial access vector for npm, PyPI, and GitHub-hosted supply-chain attacks throughout 2025 and 2026. What makes this one operationally significant is the target: a major cloud provider’s official management tool, which by design has access to the highest-privilege credentials in a customer’s environment.

What defenders should do: Any CI/CD pipeline or developer workstation that pulled the OVHcloud CLI on October 19 should be treated as compromised. Rotate all cloud API keys, tokens, and service account credentials that were accessible in that environment. Review pipeline logs for the specific release version. Longer term, enforce artifact signature verification and pin CLI tool versions in infrastructure-as-code manifests - automated pulls of “latest” are how these attacks propagate.

Qilin and Inc Ransomware Gangs Actively Exploiting PAN-OS CVE-2026-0257

Palo Alto’s Unit 42 team published an updated advisory confirming that the Qilin and Inc ransomware groups are using CVE-2026-0257 for initial access in active campaigns. This is the escalation from Friday’s zero-day disclosure - what started as limited, targeted exploitation is now in the hands of ransomware-as-a-service operators.

CVE-2026-0257 affects the PAN-OS management plane. Successful exploitation gives an attacker authenticated access to the firewall’s management interface, which is then used as a pivot point for lateral movement into the internal network. Both Qilin and Inc are known for double-extortion operations - data theft followed by encryption - and the firewall management plane gives them an ideal vantage point for network reconnaissance before deploying ransomware.

What defenders should do: Patch PAN-OS immediately per Palo Alto’s advisory. If patching is delayed, restrict management plane access to out-of-band management networks and enforce MFA on all administrative access. Monitor for anomalous administrative sessions, new firewall rules created outside change windows, and unexpected outbound connections from the firewall management IP. MITRE ATT&CK: Initial Access (T1190 - Exploit Public-Facing Application).

Ahold Delhaize Cyberattack Disrupts Grocery Operations Across US and Europe

Ahold Delhaize, the parent company behind Stop & Shop, Food Lion, Hannaford, and Albert Heijn, confirmed a cyberattack that forced the company to take multiple systems offline. The disruption hit pharmacy services, e-commerce ordering, and in-store operations across both US and European locations.

No threat actor has publicly claimed responsibility. The attack vector has not been disclosed. The operational impact is the story here - this is not a data-theft headline but a business continuity failure affecting physical retail operations that serve millions of customers daily.

What defenders should do: Retail and critical infrastructure organizations should validate network segmentation between point-of-sale systems, pharmacy dispensing platforms, e-commerce infrastructure, and corporate IT. If a single attack can cascade across all of those domains, the segmentation is not working. Test incident response playbooks for scenarios where containment requires taking revenue-generating systems offline.

Unpatched Broadcom Wi-Fi Flaw Enables Root Code Execution from Radio Range

An unpatched vulnerability in Broadcom Wi-Fi chipset firmware allows an attacker within radio proximity to execute arbitrary code as root on affected routers. No authentication is required. No network password is needed. The attacker does not need to be connected to the target network.

The flaw affects both consumer and enterprise customer premises equipment (CPE) built on Broadcom Wi-Fi chipsets. No patch is currently available from Broadcom, and proof-of-concept details are circulating in research channels.

What defenders should do: Identify Broadcom-based Wi-Fi CPE in your environment, particularly in branch offices and OT facilities. For critical locations, consider replacing vulnerable hardware with managed SD-WAN or enterprise access points that do not rely on the affected chipset. As a compensating control, enforce zero-trust network access policies that do not trust the branch router as a security boundary. MITRE ATT&CK: Initial Access (T1190), Execution (T1203).

Defender Action Items

  • OVHcloud CLI users: Rotate all cloud credentials accessible on any system that pulled the CLI between 12:47–14:21 UTC October 19. Pin CLI versions and enforce artifact signature verification in CI/CD pipelines.
  • PAN-OS CVE-2026-0257: Patch immediately. If patch cannot be applied today, restrict management plane access to out-of-band networks and enforce phishing-resistant MFA on all admin accounts. Monitor for unauthorized firewall rule changes.
  • Retail and critical infrastructure: Validate segmentation between POS, pharmacy, e-commerce, and corporate domains. Run a tabletop exercise for containment scenarios requiring revenue-system shutdowns.
  • Branch and CPE hardware: Inventory Broadcom Wi-Fi chipset devices. Prioritize replacement of unmanaged CPE in sensitive locations. Enforce ZTNA policies that remove implicit trust from branch routers.
  • Siemens Software Center (CVE-2026-110936, CVSS 8.4): Restrict execution to hardened admin workstations. Monitor for DLL sideloading and LegionLoader indicators.

Detection Spotlight

For organizations monitoring PAN-OS management plane compromise (CVE-2026-0257), the following Splunk SPL query identifies anomalous administrative sessions - new admin logins from unexpected source IPs or outside approved change windows:

index=pan_logs sourcetype="pan:system" log_subtype="auth"
  result="success"
| eval hour=strftime(_time, "%H")
| where (hour < "07" OR hour > "19")
  OR NOT cidrmatch("10.250.0.0/24", src_ip)
| stats count by src_ip, user, dest_ip, _time
| where count > 0
| sort - _time

This query filters for successful administrative authentication events occurring outside business hours (before 07:00 or after 19:00) or from source IPs outside the designated management subnet (adjust 10.250.0.0/24 to your environment). Any hit warrants immediate investigation - legitimate after-hours admin access should be rare and well-documented. False positive rate is low if the management subnet CIDR is accurate; tune the time window to match your change management schedule.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.