Security Roundup: French Supermarket Fridges Hacked, Ivanti Zero-Days Exploited
Summary
This security-news roundup covers attacks on French supermarket refrigeration systems, Ivanti VPN zero-days, major vulnerability fixes, a Meta GitHub breach, an FBI infrastructure seizure, and security industry developments.
Key points
- Attackers reportedly compromised refrigeration controllers at about 150 Intermarché stores in France, raising temperatures, spoiling food, and reportedly causing fires.
- UTA0576 chained three Ivanti Connect Secure zero-days to gain unauthenticated root access, steal credentials and recovery data, and evade integrity checks. Fixes for two flaws were available; one remained pending.
- XBOW and four researchers built a Chrome exploit chain in six days and received a $250,000 Google bug bounty; the bugs have been patched.
- Microsoft’s October update fixed 1,411 vulnerabilities. Three were zero-days, including an actively exploited Windows Shell flaw that bypasses Mark of the Web protections.
- The DOJ and FBI seized seven domains tied to tools allegedly used by Beijing-based Integrity Technology Group for scanning, phishing, and targeting critical infrastructure.
- Meta said compromised employee credentials enabled access to GitHub repositories containing source code and data about roughly 1,500 people; it said affected accounts are secured.
- Researchers reported risks involving npm Trusted Publishing and malicious GitHub repositories distributing malware and stealing credentials.
Article Details
- Event Type
- Cybersecurity incidents, active exploitation, vulnerability disclosures, and threat-intelligence reporting
- Impact
- Attackers reportedly compromised refrigeration systems at about 150 French Intermarché stores, spoiling food and reportedly causing fires. UTA0576 chained three zero-days to gain unauthenticated root access to fully patched Ivanti Connect Secure appliances and sought credentials and recovery data; Ivanti released fixes for two flaws, while the privilege-escalation fix was still pending when Volexity published. Microsoft reported active exploitation of a Windows Shell zero-day. Other reported impacts included a critical GitLab remote-code-execution flaw, malicious npm package-publishing risk, compromised Meta employee credentials exposing source code and personal data linked to about 1,500 individuals, and FakeGit repositories distributing malware and stealing credentials. The FBI and DOJ seized seven domains allegedly tied to hacking tools run by Integrity Technology Group; the article does not provide the domain values.
CVE
CVE-2026-96951The one to care about is CVE-2026-96951, which is actively exploited and lets attackers slip past Windows Shell’s Mark of the Web protections, aka the warnings you get on files downloaded from the internet.CVE-2026-97229Rapid7 disclosed CVE-2026-97229, a critical unauthenticated RCE in self-managed GitLab CE/EE that’s triggered through malicious CI/CD configuration files.
Threat Actors
Integrity Technology GroupThe DOJ and FBI seized seven domains tied to hacking tools allegedly run by the Beijing-based company; the tools were reportedly used for scanning, phishing, and targeting critical infrastructure.UTA0576Tracked actor that Volexity says chained three Ivanti Connect Secure zero-days to gain unauthenticated root access and target credentials and recovery data.
Malware
SmartLoaderFakeGit/SmartLoader attack flow showing how malicious GitHub repositories distribute malware and steal credentials. Source: Apiiro ResearchStealC13,000 of those repos were updated within 34 hours to point downloads at SmartLoader, which can drop the StealC infostealer. The kicker: the attackers mostly reused existing repos instead of making new ones, which is
Vendors
GitLabCritical GitLab flaw turns CI/CD configs into RCEIvanti🔓 Ivanti gets hit again: Attackers chained zero-days to compromise fully patched VPNs and slip past integrity checks.LedgerTampered Ledger wallets reportedly phoned home with recovery phrasesMetaMeta GitHub breach exposes source code and personal dataMicrosoft🩹 Microsoft patches 1,411 bugs: Three were zero-days.
Products
GitLabRapid7 disclosed CVE-2026-97229, a critical unauthenticated RCE in self-managed GitLab CE/EE that’s triggered through malicious CI/CD configuration files.Ivanti Connect SecureVolexity caught attackers chaining three zero-days in Ivanti Connect Secure for unauthenticated root access, even on fully patched appliances.npm Trusted PublishingSlugFest exposes npm Trusted Publishing takeover riskWindows ShellOne Windows Shell flaw was already being exploited.