Cybersecurity Weekly Roundup: 26 October - 2 November 2026
1. Cyberattacks Disrupt Supermarket Refrigeration Systems Across Europe
Cyberattacks targeting supermarket refrigeration and freezer systems spread across several European countries, including Sweden, Belgium, Luxembourg and Ireland. The incidents affected major retailers such as Ahold Delhaize, Colruyt, ICA, Coop, Carrefour and Musgrave. Attackers interfered with refrigeration controls, causing temperatures in some freezers to rise significantly and forcing affected stores to discard spoiled food. At one Swedish supermarket, freezer temperatures reportedly reached 50°C. Several retailers confirmed that their refrigeration systems had been affected by unauthorised activity, while investigations continued.
The incidents highlight the security risks associated with remotely managed operational technology (OT) and building management systems. Some affected refrigeration units used temperature-control technology supplied by Danish manufacturer Danfoss, which confirmed that it was working with customers to implement fixes. No group had claimed responsibility, and investigators had not established whether the incidents were connected to earlier attacks in France. The European Commission warned that repeated attacks against these systems could disrupt food supply chains and undermine consumer confidence.
Affected Systems: Commercial refrigeration controllers, freezer management systems and remotely managed building infrastructure. No CVE has been assigned to the incidents.
Why It Matters: Cyberattacks against OT systems can cause physical disruption, financial losses and operational downtime. Organisations operating supermarkets, warehouses, healthcare facilities and other critical environments increasingly depend on connected systems that may be accessible through remote management platforms.
Actions: Identify internet-connected OT and building management systems. Restrict remote access to authorised users and trusted networks, enforce network segmentation between IT and OT environments, and change default or exposed credentials. Monitor remote administrative sessions and unauthorised configuration changes. Ensure critical refrigeration and industrial systems have manual operating procedures and tested recovery arrangements.
2. PHP2Shell Vulnerabilities Confirmed Exploited in the Wild
The Canadian Centre for Cyber Security updated its advisory concerning two critical PHP vulnerabilities known as PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are use-after-free memory flaws that could allow unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerabilities affect PHP installations handling web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October following reports of exploitation in the wild.
Successful exploitation could provide attackers with the ability to execute commands within the context of the affected PHP process, potentially enabling further compromise of the underlying web server. The PHP Security Team released fixes for supported versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations running older versions, particularly internet-facing applications using mod_php, should prioritise remediation and assess whether exploitation occurred before patching.
CVE IDs: CVE-2026-109618 and CVE-2026-109619
CVSS: 9.2 (Critical), CVSS v4.0
Affected Versions: PHP 8.5.x prior to 8.5.12, 8.4.x prior to 8.4.27, 8.3.x prior to 8.3.36 and 8.2.x prior to 8.2.35. Older end-of-life versions may also be affected.
Why It Matters: PHP supports a substantial number of websites, content management systems and business applications. Unauthenticated remote code execution on an internet-facing web server could allow attackers to deploy malware, access sensitive information, establish persistence or use the compromised server as an entry point into internal networks.
Actions: Identify PHP versions across web servers, containers and third-party appliances. Upgrade affected installations to the appropriate fixed release. Review web server, PHP and endpoint logs for suspicious requests, unexpected child processes, command execution, unauthorised file creation and unusual outbound connections. Investigate potentially compromised systems and rotate credentials if exposure is identified.
3. Critical Google Brotli Vulnerability Added to CISA's Known Exploited Vulnerabilities Catalogue
The Canadian Centre for Cyber Security published an alert concerning CVE-2026-111497, a critical vulnerability affecting Google's Brotli compression library. Known as Broccoli2Shell, the vulnerability is an out-of-bounds write flaw in the Brotli decoder. An attacker could exploit the issue remotely without authentication by sending specially crafted compressed data to an affected application. Successful exploitation could result in memory corruption, disclosure of sensitive information, application crashes or arbitrary code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 27 October, indicating evidence of exploitation in the wild.
The vulnerability is particularly concerning because Brotli is integrated into a wide range of software and application frameworks. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio and Python Brotli packages. This means organisations may be exposed through bundled dependencies even when they do not directly install or manage the Brotli library themselves. The Canadian Cyber Centre advised organisations to identify affected components, apply available updates and restrict the processing of untrusted Brotli-compressed content where immediate remediation is not possible.
CVE ID: CVE-2026-111497
Affected Versions: Brotli versions 1.0.3 prior to 1.0.10, 1.1.0 prior to 1.1.1 and 1.2.0 prior to 1.2.1.
Fixed Versions: Brotli 1.0.10, 1.1.1 and 1.2.1 respectively.
Why It Matters: Brotli is widely used to process compressed web content. A vulnerability in a shared software dependency can affect multiple applications and services, making it difficult for organisations to identify exposure through traditional asset inventories alone. Successful exploitation could compromise the application or service processing the malicious data.
Actions: Review software inventories, dependency manifests and container images for vulnerable Brotli versions. Identify applications using Node.js, .NET, PowerShell, Python and other affected technologies. Update vulnerable components or apply vendor-provided patches. Where immediate remediation is not possible, prevent affected applications from processing untrusted Brotli-compressed content. Monitor for unexpected application crashes, abnormal process behaviour and suspicious outbound connections.
4. Ivanti Connect Secure Vulnerabilities Added to CISA's Known Exploited Vulnerabilities Catalogue
The Canadian Centre for Cyber Security updated its advisory concerning vulnerabilities affecting Ivanti products after CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalogue. The update followed earlier reports that CVE-2026-111357 was being exploited in the wild. The vulnerabilities affect Ivanti Connect Secure, a remote-access VPN platform commonly used by organisations to provide employees and administrators with access to internal corporate resources. The advisory also references CVE-2026-104935, which had previously been added to CISA's KEV catalogue on 13 October.
The affected Ivanti Connect Secure versions include releases prior to 25.1.1.3, 25.1.3.1 and 22.8R2.6, depending on the product release branch. The inclusion of additional vulnerabilities in CISA's KEV catalogue reinforces the need for organisations to review their VPN infrastructure and apply the vendor's security updates. Since remote-access appliances are directly exposed to external networks, successful exploitation could provide attackers with an entry point into corporate environments and potentially expose authentication material or internal resources.
CVE IDs: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527
Affected Versions: Ivanti Connect Secure versions prior to 25.1.1.3, 25.1.3.1 and 22.8R2.6, depending on the release branch.
Why It Matters: VPN appliances provide access to internal networks and sensitive organisational resources. Exploitation of vulnerabilities in these systems can undermine remote-access security and provide attackers with opportunities to compromise credentials, access internal systems and establish a foothold within corporate environments.
Actions: Identify all deployed Ivanti Connect Secure appliances and verify their firmware versions against the vendor's security advisory. Upgrade affected appliances to the appropriate fixed releases. Review VPN authentication logs, administrator activity, configuration changes and unusual sessions for signs of compromise. Investigate suspicious access, rotate potentially exposed credentials and validate the integrity of affected appliances before restoring normal access.
Key Recommendations
Prioritise actively exploited vulnerabilities: Patch PHP2Shell, Google Brotli and Ivanti Connect Secure vulnerabilities according to organisational exposure and vendor guidance.
Secure operational technology: Segment OT networks, restrict remote access and monitor connected industrial and building management systems for unauthorised changes.
Review software dependencies: Audit application libraries, container images and third-party components to identify vulnerable or outdated dependencies.
Strengthen remote-access security: Review VPN appliances, enforce MFA where supported, restrict administrative access and monitor unusual authentication activity.
Improve threat detection: Monitor endpoint, application, web server, network and identity logs for suspicious process execution, unexpected connections and unauthorised configuration changes.
Validate remediation: Confirm that patches have been successfully applied and investigate potential exploitation rather than assuming that updating vulnerable systems resolves an existing compromise.
