Today's outlook

Six critical Chrome flaws get a fix as a cyberattack spoils food in hundreds of French supermarkets

By The IT Security Desk

Good morning. Google's Chrome releases advisory lists six vulnerabilities each carrying a CVSS base score of 9.6 on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: CVE-2026-106419, CVE-2026-106417, CVE-2026-106414, CVE-2026-106401, CVE-2026-106382 and CVE-2026-106375. Google's advisory states each affects Chrome up to the fix in 155.0.8059.39. The vector marks these network-reachable, low-complexity, requiring no privileges but requiring user interaction, with a scope change and high impact to confidentiality, integrity and availability. None of the six appears on CISA's Known Exploited Vulnerabilities catalog.

What to do: update Chrome to 155.0.8059.39, the fixed release Google names in its advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html), and follow the vendor advisory for any interim mitigation. Because the vector requires user interaction, confirm your managed browser fleet has pulled the update rather than assuming auto-update completed.

The Record reports that a cyberattack overnight Sunday disrupted refrigerators at hundreds of French supermarkets, spoiling fresh food at stores run by some of the country's largest grocery chains (https://therecord.media/cyberattack-disrupts-refridgeration-in-france). The Record does not name the chains or the mechanism in the material supplied.

BleepingComputer reports that Daiichi Kosho, a major Japanese entertainment system maker, disclosed a malware infection at its contractor Nippon Columbia that exposed more than 8.7 million customer and employee records (https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/). If you are a Daiichi Kosho or Nippon Columbia counterparty, treat the disclosure as grounds to review any data you have shared with them.

The Register reports that AI systems are capable of carrying out attacks against infrastructure and that AI agents move robotic arms and, in its words, "make OT device operator screens lie" (https://www.theregister.com/security/2026/10/11/ai-systems-are-fully-capable-of-carrying-out-nightmare-attacks-against-infrastructure-and-nobodys-ready/5302450). The Register's report says nobody is ready for such attacks.

Help Net Security's week-in-review reports that FortiBleed is still active and carries a Patch Tuesday forecast for the week ahead (https://www.helpnetsecurity.com/2026/10/11/week-in-review-fortibleed-is-still-active-patch-tuesday-forecast/). Track FortiBleed remediation guidance as it is published and plan for the upcoming patch cycle.