Ivanti Zero-Day, Critical GitLab RCE, and Retail Breaches Top Oct 15 CISO Briefing

Security leaders need to prioritize two urgent fixes today: the actively exploited Ivanti Connect Secure authentication bypass (CVE-2026-104935) that CISA added to its Known Exploited Vulnerabilities Catalog, and GitLab's maximum-severity CI/CD Regular Expression Compiler flaw (CVE-2026-97229) rated CVSS 10.0. Also this week, TFG London and French supermarket chains disclosed disruptive cyberattacks, the FBI raided North Korean-linked laptop farms in Texas, and Nike named a new Chief Information Security Officer.

CISA urges emergency patching of exploited Ivanti Connect Secure zero-day

CISA warned that attackers are actively exploiting a new authentication bypass flaw, CVE-2026-104935, in Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability lets unauthenticated attackers run arbitrary commands remotely, enabling credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities Catalog on October 13, 2026, and urged immediate updates, noting Ivanti's Integrity Checker Tool may miss evidence of compromise because attacker commands execute only in memory. Organizations should conduct forensic reviews and consider factory resets for affected appliances. (CISA)

CISA adds four more exploited flaws, including Palo Alto and Cisco products, to KEV catalog

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 14, 2026: a Palo Alto Networks PAN-OS code injection flaw (CVE-2026-0322), a Cisco Secure Email Gateway path traversal bug (CVE-2026-76519), and two Ahsay AhsayCBS flaws, an improper authentication issue (CVE-2026-105133) and a command injection vulnerability (CVE-2026-105134) that CISA says can be chained together. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-facing assets that grant full control post-exploitation; CISA recommends all organizations do the same. (CISA)

GitLab patches maximum-severity CI/CD regex RCE flaw

GitLab urged self-managed customers to patch CVE-2026-97229, an integer overflow in its CI/CD Regular Expression Compiler that carries the maximum CVSS score of 10.0 and affects both Community and Enterprise editions. Fixes shipped October 12, 2026 in versions 19.4.2, 19.3.5 and 19.2.8. Rapid7 researchers reproduced arbitrary code execution on an unpatched 19.4.1 image but found exploitation requires an attacker to commit a malicious CI/CD configuration file to a public project, meaning an ordinary account could meet that bar on self-managed instances allowing public projects. No in-the-wild exploitation has been confirmed yet. (Help Net Security)

UK fashion retailer TFG London discloses cyberattack hitting Phase Eight, Hobbs, Whistles

TFG London, the UK arm of South Africa's Foschini Group, confirmed a cyberattack detected on October 11, 2026, that hit IT systems used by its Phase Eight, Hobbs and Whistles fashion brands; Inside Story and White Stuff were unaffected. Stores remain open and trading, but several systems are still unavailable. The company activated incident response plans, engaged outside cybersecurity specialists, and reported the matter to UK authorities. It has not disclosed the attack type or entry method, and is still investigating whether personal or sensitive customer data was compromised, with notifications to follow if confirmed. (Help Net Security)

Cyberattacks disrupt French supermarket refrigeration and Dutch/Belgian grocery operations

European grocers faced two separate disruptions this week. In France, attackers hijacked Danfoss refrigeration control systems overnight, defrosting fridges and freezers at hundreds of stores run by Intermarché, Netto, Super U, Marché U, Leclerc, Carrefour Market and Monoprix, with damage reportedly reaching hundreds of thousands of euros. Separately, Dutch retailer Ahold Delhaize confirmed a security issue affecting Albert Heijn, Etos, Gall & Gall and Belgian Delhaize stores, taking some systems offline; websites and apps remain down and distribution center work has stopped. The companies say there is no indication the two incidents are connected. (Help Net Security)

FBI dismantles laptop farms tied to North Korean IT worker fraud scheme

The US Department of Justice announced arrests tied to an operation in which North Korean IT workers used stolen identities to land remote jobs at more than 70 US companies across 17 states, generating about $3 million routed to North Korea. FBI agents searched more than 40 suspected laptop farms in Texas between September 21 and 25, seizing about 187 laptops and KVM devices. CrowdStrike, which assisted, tracks the group as Famous Chollima. The case highlights insider-enabled fraud risk for employers running distributed remote workforces and hiring through third-party identity verification. (Help Net Security)

Nike names former CrowdStrike CISO Adam Zoller to top security role

Nike named Adam Zoller as Chief Information Security Officer after he spent nearly two years in the same role at CrowdStrike. He previously spent more than five years as Senior Vice President and Global CISO at Providence, where he oversaw cybersecurity across a health system with more than 50 hospitals, 1,000 clinics and 120,000 caregivers, and earlier held security leadership roles at General Electric, including CISO of GE Healthcare. The move brings deep healthcare and vendor-side security experience to one of the world's most recognized consumer brands. (The National CIO Review)