Ivanti Zero-Day, Grocery Chain Hack, and GitLab Critical Flaw Lead Oct 14 Briefing

CISA's alert on a newly exploited Ivanti Connect Secure authentication-bypass zero-day (CVE-2026-104935) and a cyberattack that hijacked supermarket refrigeration systems across France while disrupting Ahold Delhaize's Dutch and Belgian stores top today's briefing. Also in focus: a critical CVSS 10.0 GitLab remote-code-execution flaw, Park Dental Partners' 8-K update on its August breach litigation, and new CISO appointments at Acronis and Pegasystems.

CISA Warns of Actively Exploited Ivanti Connect Secure Zero-Day

CISA disclosed on October 13 that attackers are actively exploiting CVE-2026-104935, an authentication-bypass zero-day in Ivanti Connect Secure versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 and prior, enabling unauthenticated remote command execution for credential theft and data exfiltration. The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog the same day. CISA warned that Ivanti's Integrity Checker Tool may not detect compromise because attacker commands run in memory, and recommended factory resets, credential rotation, and certificate reissuance for suspected victims. (CISA)

CISA Adds Exploited Windows Command Injection Flaw to KEV Catalog

Alongside the Ivanti entry, CISA added CVE-2026-96951, a Microsoft Windows command injection vulnerability, to its Known Exploited Vulnerabilities Catalog on October 13 based on evidence of active exploitation. The alert reiterates that Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-exposed assets that grant total control post-exploitation. While BOD 26-04 only binds federal agencies, CISA is urging all organizations to adopt the same risk-based patching priorities and to check for prior compromise before applying fixes. (CISA)

Park Dental Partners Updates SEC Filing on August Breach Litigation

Park Dental Partners filed an 8-K on October 13 confirming that unauthorized access identified on August 28, 2026 resulted in acquisition of patients' protected health information, with notifications ongoing under state and federal law. The company faces four putative class-action lawsuits filed in Ramsey County, Minnesota, alleging failure to safeguard data and delayed notification; plaintiffs moved on October 7 to consolidate the suits. Park Dental said it has not identified any material impact on its financial condition from the incident to date. (SEC EDGAR)

Cyberattack Hijacks French Supermarket Freezers; Ahold Delhaize Disrupted

Hundreds of French supermarkets under Intermarché, Super U, Leclerc, Carrefour Market and Monoprix suffered spoiled stock after attackers remotely hijacked Danfoss refrigeration control systems overnight between October 11 and 12, turning freezers into warming units and causing damage reaching tens or hundreds of thousands of euros per chain. Separately, Dutch retailer Ahold Delhaize confirmed an unrelated security issue that forced some systems offline, disrupting Albert Heijn distribution centers, websites and apps across the Netherlands and Belgium. No link between the two incidents has been confirmed. (Help Net Security)

Acronis Appoints Gerald Caron as Chief Information Security Officer

Acronis announced on October 13 the appointment of Gerald Caron as Chief Information Security Officer, tasked with leading global security strategy across the product lifecycle and internal operations. Caron brings more than 20 years of federal and private-sector cybersecurity experience, including prior CIO roles. The hire comes as Acronis' managed detection and response service grows more than 50% quarter over quarter, with Caron also set to support adoption of Acronis MDR by Acronis TRU and strengthen security throughout the company's product development process. (Yahoo Finance / GlobeNewswire)

Pegasystems Names Sean Croston as Chief Information Security Officer

Pegasystems announced on October 13 that it has appointed Sean Croston as Chief Information Security Officer, making him responsible for the company's information security standards and policies. Pega describes itself as an enterprise AI software company for mission-critical work. The appointment adds dedicated security leadership to Pega's executive ranks as the company continues to expand the AI-driven workflow platforms that large enterprise clients rely on to run business-critical operations and decisions. (Business Wire via newspressnow.com)