6 Nov 2026
Week in review
Greetings,
A suspected cyber attack has disrupted supermarkets across Europe, forcing stores to discard large quantities of food after attackers allegedly manipulated refrigeration systems and increased temperatures in fridges and freezers. The incident follows a similar attack on cooling units at hundreds of supermarkets in France just weeks earlier, highlighting the growing cyber risks associated with Internet-exposed operational technology (OT) and Internet of Things (IoT) systems.
Dr Ivano Bongiovanni, General Manager of AUSCERT, was interviewed by the ABC, sharing his expert insights on the incident and its implications for Australian businesses. You can listen to the full episode here.
This incident serves as a timely reminder that cyber threats extend far beyond traditional IT networks. As organisations continue to adopt smart and connected technologies, securing operational systems is becoming just as critical as protecting corporate networks. When compromised, these systems can lead to significant operational disruption, financial loss, and reputational damage. The attacks underscore the importance of implementing strong cyber security controls, monitoring connected assets, and ensuring operational technology is included in broader cyber resilience and incident response planning.
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Date: 2026-11-01
Author: The Hacker News
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate.
Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is privileged, the attacker could gain "root access to the host machine," Canonical said.
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Date: 2026-11-04
Author: Security Week
[Please see AUSCERT Bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.13892]
Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, including seven critical memory safety bugs.
Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.
The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.
CISA says max severity GitLab flaw now exploited in the wild
Date: 2026-10-30
Author: Bleeping Computer
[See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12505]
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files.
CVE-2026-97229 stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation.
Debian and Ubuntu APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root
Date: 2026-11-04
Author: Cyber Security News
[Please see AUSCERT Bulletins: https://portal.auscert.org.au/bulletins/ESB-2026.13951/ & https://portal.auscert.org.au/bulletins/ESB-2026.13984/]
A newly disclosed bug in APT, the package manager behind Debian and Ubuntu, can let a network spy swap a trusted software package for a bad one.
The flaw is tracked as CVE-2026-109518 and can end in code running with root rights, the highest level of control on a Linux system. Debian announced the issue on November 4, 2026, and credited researcher Max Justicz with finding it.
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Date: 2026-10-30
Author: Security Week
[AUSCERT has notified potentially affected members about this vulnerability]
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
Drupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.
Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal’s statistics show the module is used on more than 42,000 sites.
ESB-2026.13725 – IBM QRadar User Behavior Analytics: CVSS (Max): 10.0
Vulnerable components such as framework libraries are susceptible to exploitation with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update.
ESB-2026.13800 – Citrix XenServer: CVSS (Max): 9.8*
An unauthenticated attacker on the management network could compromise the host and/or any running Workload Balancing or Conversion Manager applicances. Patches have been released to address these vulnerabilities.
ESB-2026.13672 – python-git: CVSS (Max): 9.8
Vulnerabilities in python-git could result in arbitrary command execution, path traversal with arbitrary read/write, config injection, leaking of secrets through environment variable expansion or denial of service. It is recommended to update python-git packages.
ESB-2026.13892 – Google Chrome: CVSS (Max): 9.6*
Google Chrome has been updated to address 213 security issues in this release. The full comprehensive list of changes and fixes is detailed in the advisory.
ESB-2026.13958 – Linux Kernel: CVSS (Max): 10.0
This Linux Kernel update resolves 1077 vulnerabilities, contains two new features and has 11 security fixes. The full comprehensive list of changes and fixes is detailed in the advisory.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
