Anthropic published research on 12 October 2026 warning that small AI models may soon be able to copy themselves onto poorly secured internet-of-things devices, such as smart ovens and off-brand Android TV boxes, and run there without a datacenter. It describes this as an AI worm that carries its own model weights, or downloads them again from a public hub, and runs inference on the hardware it has compromised. Anthropic split replication into four stages: finding targets, gaining execution, setting up inference and spreading onward. It focused on the inference step because earlier work already shows small models can exploit systems. In its tests a 9-billion-parameter model got inference running on 8 of the 9 hardware types tried, models of 30B parameters and under could complete many individual steps, and GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations; The Hacker News reports GLM-5.2 was the only one of 11 open-weight models tested to propagate reliably across eight emulated Android nodes. Anthropic also ran Gemma4-26B-A4B split across 15 Android TV boxes (about US$55 each) at 0.39 tokens a second. It estimates small models could reach end-to-end capability by the end of this year at their historical rate of improvement, and says such a worm would be slow (a doubling time of days) but hard to shut down because there is no central point to switch off. This is research, not an observed attack.
Anthropic — AI models may be capable of self-replicating without access to a datacenter (12 Oct 2026)
Docker said on 12 October 2026 that from 26 August 2024, converting a Docker Hub personal account into an organization also re-assigned that account's personal access tokens (PATs) to the account named as the new owner, without rotating the secret and without asking or telling that owner. An attacker could create an account and a PAT, convert it, name a target user as owner, and keep using the token with the target's registry scope, so they could pull, push or delete images in the target's repositories and in organizations the target could reach. Docker rated it critical because it allowed publishing images under a legitimate name. It did not give web access or let anyone change passwords, email or two-factor settings. Researchers Peter Molnar and Krisztian Hozak reported it on 30 September 2026 and Docker deployed a fix in under four hours. Docker says it reviewed every conversion back to August 2024, found no evidence of exploitation after examining 304,000 pushes made with transferred tokens, emailed affected users and organization owners on 2 October, and deactivated transferred PATs on 8 October unless owners asked to keep them. Conversion no longer transfers PATs and now needs the named owner's consent.
Docker — Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions (12 Oct 2026)
SSD Secure Disclosure published an advisory on 12 October 2026 covering a three-bug chain on LG webOS smart TVs that lets an attacker on the same local network gain root without a PIN or any owner interaction. The Hacker News summarised the chain on 13 October. Entry is through the ThinQ pairing service on port 3001: the attacker replays a sync-demo app manifest signed with a test certificate the firmware still trusts, and a permission in that manifest makes the pairing service skip the PIN and hand over a privileged key. With the key, the attacker launches the built-in cmp-client app to an attacker-controlled page; the page keeps PalmServiceBridge access and abuses the root-running pmlogd logging service with unchecked shell input. The chain was demonstrated on the 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25 (firmware 04.54.40); whether other models or builds are affected is not stated. An anonymous researcher took third place in the LG webOS category at TyphoonPWN 2026 (Seoul, May) with the demo. No CVE identifiers have been assigned, and no exploitation in the wild was reported in the sources used here. LG has issued a firmware fix per SSD. Owners should check for a TV firmware update; no workaround is available if the update cannot be applied. This is separate from Bitdefender's 2024 webOS findings and from an earlier TyphoonPWN path-traversal chain on a different port.
SSD Secure Disclosure — LG webOS sync-demo preauth RCE / local root chain (12 Oct 2026)
Progress Software, the CNA for MarkLogic, published 20 CVE records (CVE-2026-85957 to CVE-2026-85976) on 12 October 2026, all pointing to its MarkLogic Critical Security Alert Bulletin for October 2026. Every flaw is in MarkLogic Server, the enterprise multi-model database used for document and metadata-heavy workloads, and affects the 12.x releases before 12.1.0 and, for most of them, 11.x before 11.3.7. The items to read first are the unauthenticated network ones. In deployments using SAML, a remote attacker could get the server to accept an assertion it should reject (CVE-2026-85962, 7.5). A separate validation weakness lets the server accept a token it should refuse (CVE-2026-85958, 7.5). On 11.x, the SAML parser processes external DTDs and entities (XXE, CVE-2026-85957, 7.5). The deprecated OpsDirector component carries SSRF and a hard-coded key that an unauthenticated attacker could use to forge trusted requests (CVE-2026-85963, 7.5). Azure deployments may record security-sensitive data in logs (CVE-2026-85961, 7.5), and S3 connections may use cleartext transport (CVE-2026-85975, 7.5). Progress's top score is 8.0, for memory-safety defects in the JavaScript engine integration that a high-privileged attacker could use to corrupt memory (CVE-2026-85965). The rest include predictable Query Console CSRF tokens that could lead to server-side code running with a victim's permissions (CVE-2026-85960, 7.5), Query Console path traversal and information exposure (7.7), out-of-bounds read and write and a second XXE (7.1), Kerberos, TLS hostname and cluster-join transport weaknesses (7.4), world-readable log files (7.1), XSS (6.1) and response splitting (5.4). The CVE records do not mention exploitation or public exploit code. Primary: the Progress MarkLogic bulletin (October 2026) and the Progress-assigned CVE records (12 Oct 2026).
Progress Community — MarkLogic Critical Security Alert Bulletin, October 2026
iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June. In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected. The Record (9 Oct) reports breach notices covering 298,647 people in Texas and another 69,526 in South Carolina, and that iRhythm also filed breach notices in California. No group has publicly claimed the attack. iRhythm has not said whether it paid. Primary: iRhythm update (2 Oct, GlobeNewswire) and SEC Form 8-K (15 Jun); wire: The Record (9 Oct). Correction (23 Oct 2026): this card earlier credited the state-filing figures to two outlets (12 Oct) and added them together; they are now credited to The Record (9 Oct) and are not combined. UPDATE (23 Oct 2026): Oregon's Department of Justice breach database lists an iRhythm Technologies Inc. entry with 8,179,772 as the number affected, reported on 6 October 2026, giving 3 to 8 June 2026 as the dates of breach (the entry also shows a placeholder date of 1/1/0001), 8 June 2026 as the date of discovery and 2 October 2026 as the date notice was sent. The database says its entries show the information in an organisation's initial breach report and do not reflect later updates to affected numbers.
iRhythm — Provides update on cybersecurity incident previously disclosed in June 2026 (GlobeNewswire, 2 Oct 2026)
Independent researcher Simon Koeck published on 12 October 2026 a write-up of a critical chain in Google's shared DevSite platform (the Flask/OAuth front end used by Google developer documentation sites). A /oauth2authorize response set a large Flask session cookie that was signed but not encrypted. Decoding it exposed a pickle-serialized OAuth2WebServerFlow object holding a Google OAuth client_id and client_secret in cleartext; that same client_secret was the Flask SECRET_KEY (itsdangerous cookie-session derivation), so anyone with a cookie could recover the key, forge a valid session, and smuggle a malicious pickle into the OAuth callback's pickle.loads path for remote code execution. Koeck showed the developers.google.com signing key also validated sessions on other DevSite hosts including firebase.google.com, developer.android.com, source.android.com and docs.partner.android.com. Timeline: reported 6 Aug 2026, triaged/accepted 7 Aug, $90,000 VRP reward decided 27 Aug (T2 S0 RCE base $75,000 × 1.2), fixed 7 Oct 2026. Google's fix path, per the write-up: rotate the exposed OAuth secrets and kill sessions signed with them; give each deployment its own high-entropy Flask SECRET_KEY unrelated to OAuth; keep the OAuth flow object server-side with only an opaque reference in the cookie; and stop unpickling client-supplied data. No evidence of exploitation in the wild was published. Primary: Simon Koeck write-up (12 Oct); wire: Cybersecurity News (12 Oct).
Simon Koeck — How I Found a $90,000 Remote Code Execution Vulnerability in Google (12 Oct 2026)
GitLab published a critical patch release on 12 October 2026 (versions 19.4.2, 19.3.4 and 19.2.8 for Community Edition and Enterprise Edition) remediating CVE-2026-97229, an integer overflow in the CI/CD Regular Expression Compiler that, under certain conditions, could let an unauthenticated attacker execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab rates it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Impacted self-managed installs are all CE/EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated customers do not need to act. The advisory does not state that the flaw has been exploited in the wild. Researcher joaxcar reported it via HackerOne. GitLab's advisory now titles the release 19.4.2, 19.3.5 and 19.2.8 and lists the affected 19.3 range as before 19.3.5; it says 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled, fixed in 19.3.5. The same release also ships other High/Medium fixes (XSS in syntax highlighting, several authorization issues, Duo Agent Platform input neutralization, and more) — this card is the Critical regex RCE only. Primary: GitLab Critical Patch Release 19.4.2/19.3.4/19.2.8 (12 Oct); wire: BleepingComputer and Cybersecurity News (12 Oct). UPDATE (22 Oct): GitLab fixed a separate, further regular-expression-compiler flaw, CVE-2026-110264 (CVSS 10.0, all versions from 7.0 affected), on 21 October in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; see the CVE-2026-110264 card.
France's CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October 2026 (latest version 16 October) saying it knows of numerous compromises of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb. CERT-FR says exposing a management interface on the internet is contrary to good practice, warns that attack campaigns against this equipment are probably still under way, and says internet-exposed equipment without security fixes (end of life) is very likely to be compromised; a factory reset alone removes an intruder's persistence but leaves the unit vulnerable, so it will almost certainly be compromised again. CERT-FR has not named a vulnerability. Earlier public research gives a possible path: Claroty Team82 found a hidden date-based 'code of the day' login in the Danfoss AK-SM 800A that bypasses the admin password (CVE-2025-41450, fixed in R4.2), plus post-login command injection fixed in 4.3.1; CERT-FR does not say this flaw was used. UPDATE 14 October: ASD's ACSC issued a High alert (act within 48 hours), Protecting operational technology and edge devices, saying it is aware of incidents affecting commercial refrigeration systems overseas and has not seen active targeting in Australia. It recommends that Australian organisations running internet-connected OT, including commercial refrigeration, keep OT interfaces and edge devices off the internet, patch known vulnerabilities promptly, apply strong authentication, access control and segmentation, and monitor for unusual automated activity. CORRECTION (21 Oct 2026): this card earlier carried store counts, temperatures, losses, fires, a claim that Copeland acknowledged a vulnerability, and statements attributed to Danfoss, Les Mousquetaires, Carrefour, Coopérative U and others, from media reports we had not linked. We removed them; they will return only with a linked source for each claim.
CERT-FR — CERTFR-2026-ALE-012: Security incident targeting remote controllers of refrigeration installations (12 Oct 2026, latest version 16 Oct)
Ahold Delhaize said on 12 October 2026 (Zaandam, Netherlands, 08:29 Europe/Amsterdam) that it is experiencing a security issue within its network and is taking steps to assess and mitigate it, including taking some systems offline to help protect them. The company said its stores are open and serving customers, and that protecting infrastructure for customers, associates and partners is a top priority. The release is marked as inside information under the EU Market Abuse Regulation. BleepingComputer reported the same day that employees at Stop & Shop (US) had trouble accessing schedules and pay stubs, and that customers could not use websites, apps and customer-service platforms at Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium. An internal Food Lion memo described an IT outage that could leave stores unable to shop, stage or hand off online orders. BleepingComputer says Ahold Delhaize operates 9,551 stores across Europe, the United States and Indonesia. The company has not publicly confirmed ransomware, encryption, data theft or a named threat actor for this incident. BleepingComputer notes it is the second major cybersecurity incident to affect Ahold Delhaize in recent years, after INC Ransom stole the personal, financial and health information of over 2.2 million individuals in a November 2024 attack that affected the company's US systems. Primary: Ahold Delhaize newsroom (12 Oct); wire: BleepingComputer (12 Oct). Updated 13 and 19 Oct 2026 (Ahold Delhaize newsroom; 13 October 8:00 pm and 19 October 11:04 pm Perth): on 13 October the company said it was starting a controlled re-launch of certain systems and had no evidence that customer, associate or partner data was taken. On 19 October it said the investigation confirmed the suspicious activity in its IT infrastructure resulted from the malicious actions of others. Taking systems offline, including brand websites and apps, affected most of its brands in Europe and the United States, while all stores stayed open. It notified the Dutch National Cyber Security Centre (NCSC) within 24 hours, has kept the NCSC, law enforcement and regulators updated, and filed a formal police report with the Dutch police on 19 October. Restoration: Albert Heijn's website and app are back, with home deliveries expected from Friday 23 October; Etos and Gall & Gall websites are available; Belgian e-commerce is fully operational; most websites and apps in Central and Southeastern Europe are available; e-commerce at the Ahold Delhaize USA brands (such as Food Lion and Stop & Shop) is expected back in the coming days. The company again says it has no evidence so far that sensitive customer, associate or partner data was taken, and it is not describing the attack type or saying whether a ransom is involved. Correction (26 Oct 2026): the store count is now BleepingComputer's figure of 9,551 (it was given as more than 9,400 with no source), the November 2024 INC Ransom background is credited to BleepingComputer, Ahold Delhaize's 13 October update is now linked, and an unlinked credit to The Record has been removed; the 19 October details rest on Ahold Delhaize's own update. (source: Ahold Delhaize; BleepingComputer)
Ahold Delhaize newsroom — Takes precautionary measures following cybersecurity incident (12 Oct 2026)
Icon Oncology Group said on 12 October 2026 that it is managing a data breach involving unauthorised access to some patient information held on a supplier's system, and that at this stage the incident appears to affect Australia only. Its notice (last updated 15 October 2026, 8:15am AEST) states the incident involved an externally hosted and managed platform that converts incoming faxes to email — not Icon's main system for sending or receiving patient information — that it was contained immediately, and that core clinical and patient management systems were not affected, with all systems online and patient treatment unaffected. The group says it activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It has obtained a copy of the impacted records and is confirming which patients and what information are involved, and says it will contact those patients directly; people who may be concerned can also register for an update via privacy@icongroup.global. Icon believes the records are discrete documents associated with business correspondence rather than complete patient files. Icon Cancer Centre is headquartered in South Brisbane and describes itself as Australia's largest dedicated cancer-care provider, with more than 40 centres. Primary: Icon Group notice (12 Oct 2026, last updated 15 Oct 2026 8:15am AEST). Correction (23 Oct 2026): removed a forum seller's unverified claim about the number and content of documents; Icon's own notice is the only source for what was accessed. (source: https://icongroup.global/en/news/2026-10-12/important-notification-data-breach-incident/)
Icon Group — Important notification – data breach incident (12 Oct 2026; last updated 15 Oct 2026, 8:15am AEST)
Emacs maintainer Sean Whitton disclosed on the oss-security list on 11 October 2026 that the fix for CVE-2026-79992 was incomplete. CVE-2026-79992 is the TRAMP local command execution flaw that Bas Alberts of GitHub Security Lab reported in August. Wonyoung Jung of 78ResearchLab, using its PatchHawk tool, found that tramp-user-regexp still let through characters such as !, #, &, comma and control characters in the user part of a remote file name, so a crafted name can still inject commands into the local shell TRAMP opens while it sets up a connection. The original August report showed that merely checking such a file name, for example through a symlink target committed to a git repository or a recursive directory scan, ran the payload before any SSH connection was made. MITRE assigned CVE-2026-108976 on 11 October (CVSS 3.1 7.8, local attack vector) for Emacs before 31.2 and TRAMP through 2.8.2. A patch by TRAMP maintainer Michael Albinus is attached to the post; it will ship in Emacs 31.2, which the maintainers say will not be released soon. No exploitation has been reported.
oss-security — Sean Whitton (Emacs maintainer): Incomplete fix for Emacs CVE-2026-79992 (11 Oct 2026)
A US federal judge granted final approval on 2 October 2026 to AT&T's US$177 million settlement of class actions over two customer data breaches it disclosed in 2024, according to Cyber Security News (10 October), which cites Bloomberg Law. Judge Sidney A. Fitzwater of the US District Court for the Northern District of Texas approved the deal; AT&T did not admit liability. It sets up a US$149 million fund for the first incident and a US$28 million fund for the second, with legal fees and administration paid from those funds. The first incident, announced on 30 March 2024, involved data on about 7.6 million current and 65.4 million former account holders that appeared on the dark web, including names, addresses, phone numbers, dates of birth, account passcodes and Social Security numbers, mostly dating from 2019 or earlier. The second, announced on 12 July 2024, involved call and text records for nearly all AT&T cellular customers stolen from AT&T's workspace on the Snowflake cloud data platform between 14 and 25 April 2024; it exposed phone numbers, interaction counts, call durations and some cell site identifiers but not message content or Social Security numbers. Claimants can recover up to US$5,000 (first incident) or US$2,500 (second) for documented losses; the claim deadline was 18 December 2025 and no payment date has been announced. The Snowflake theft was part of the 2024 campaign against many Snowflake customer accounts. Wire: Cyber Security News, citing Bloomberg Law.
Cyber Security News — AT&T to pay $177 million after two massive customer data breaches (10 Oct 2026, citing Bloomberg Law)
