Palo Alto warns of actively exploited PAN-OS root RCE zero-day

🕵️ RESEARCH & DEEP DIVES

• Hackers turn EU supermarket fridges into heaters via unpatched Danfoss controllers
  Hackers remotely locked supermarket refrigeration controllers into defrost mode across Europe, spoiling food worth tens of millions of dollars.

  • Overnight Oct. 12, 2026, attackers hit 400+ grocery stores in France, Spain, Portugal, Poland, Germany and Belgium, including Intermarché, Carrefour, Coopérative U and E Leclerc.
  • Hackers locked refrigeration units into defrost mode, raising temperatures to ~50°C (122°F), spoiling all contents and reportedly causing small fires; extended defrost cycles masked the attack as routine maintenance.
  • Affected units mostly ran Danfoss AK-SM 800 and older AK-SC355 controllers, end-of-life since 2021 and 2016; Claroty Team82 disclosed three Danfoss AK-SM 800A vulnerabilities (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452) enabling RCE or DoS in August.
  • France's CERT-FR also identified Dixell/Copeland XWEB controllers as involved; Team82 disclosed 23 XWEB Pro vulnerabilities the same day as the Danfoss research.
  • Many affected stores relied on third parties with remote OEM access to manage the outdated OT firmware, with little visibility or governance over those connections.
  Sources 📄 Source: reuters.com · 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Fake Chrome app by developer Hizbartech hit Google Play with 100,000+ downloads
  A fake Google Chrome app published by Hizbartech appeared on Google Play, copying Chrome's branding and reaching 100,000+ downloads.

  • Affects Android users searching Google Play for Chrome; the fake listing copied Chrome's name, icon, screenshots, and description but was published by 'Hizbartech' instead of Google LLC
  • The app reportedly appeared above the real Chrome as a sponsored search result; a screenshot showed 100,000+ downloads, though an indexed listing showed 10,000+
  • The listing was originally a game called Ball Bounce (listed August 22) that rebranded as Chrome in late September, inheriting its existing download count
  • Users who installed the 42 MB app found a chat-style interface with AI avatars and ads, not a browser; no evidence of password theft or malware payload was published
  • IOC: Android package com.ballbounce.Hizbartech; the listing was reported removed (link returned not-found on October 14)
  Sources 📄 Source: piunikaweb.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• Microsoft patches three Active Directory security feature bypass flaws (CVE-2026-69982, -96252, -108131) CVE-2026-108131 CVE-2026-69982 CVE-2026-96252
  Microsoft disclosed three Active Directory vulnerabilities that let remote attackers bypass a key security feature in Windows domain environments.

  • Affects Microsoft Active Directory-related components in Windows domain environments, including domain controllers and supporting Windows servers
  • Tracked as CVE-2026-69982, CVE-2026-96252, and CVE-2026-108131; all classified as security feature bypass vulnerabilities
  • Remote attackers could bypass protections that normally limit access, validate requests, or prevent unsafe behavior
  • ZDI identifies CVE-2026-108131 as an Active Directory Federation Services (AD FS) Spoofing Vulnerability
  • No evidence of active exploitation has been provided, but the flaws could aid lateral movement toward domain controllers
  Sources 📄 Source: msrc.microsoft.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• Microsoft patches three AD FS flaws enabling remote security bypass and spoofing CVE-2026-108131 CVE-2026-69982 CVE-2026-96252
  Microsoft's October 2026 updates fix three Active Directory Federation Services vulnerabilities that let unauthenticated remote attackers bypass a security feature or perform spoofing.

  • The flaws affect Microsoft AD FS, the federated authentication and single sign-on component, across Windows Server 2012/2012 R2, 2016, 2019, 2022, and 2025, with some records also listing Windows client releases.
  • CVE-2026-69982 is a security feature bypass (CWE-1390, weak authentication), CVSS 5.9, exploitable over a network with no privileges or user interaction but high attack complexity.
  • CVE-2026-96252 is a spoofing flaw from improper cryptographic signature verification (CWE-347), CVSS 9.1, with low attack complexity and high confidentiality and integrity impact.
  • CVE-2026-108131 is another AD FS spoofing vulnerability, CVSS 7.5, allowing an unauthorized attacker to spoof over a network.
  • Fixes shipped in the October 13, 2026 security updates; no public evidence of active exploitation of these specific CVEs.
  Sources 📄 Source: zerodayinitiative.com · 📎 Coverage: cyberupdates365.com · 👁 via cryptika.com (discovered)

• [ADVISORIES] 📄 Source for Cisco warns of actively exploited Secure Email Gateway flaw CVE-2026-76519 — sec.cloudapps.cisco.com

• [ADVISORIES] 📄 Source for Palo Alto warns of actively exploited PAN-OS root RCE zero-day CVE-2026-0322 — security.paloaltonetworks.com