Today's outlook

GitLab urges an immediate patch for a max-severity RCE flaw as Google fixes six critical Chrome vulnerabilities — patch both today

By The IT Security Desk

Good morning. BleepingComputer reported that GitLab warned users to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Treat this as the day's top priority and apply the patch GitLab's advisory directs.

Google released a Chrome stable channel update for desktop. Google's advisory lists six vulnerabilities each carrying a CVSS base score of 9.6 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): CVE-2026-106419, CVE-2026-106417, CVE-2026-106414, CVE-2026-106401, CVE-2026-106382 and CVE-2026-106375. The advisory lists the fix in Chrome 155.0.8059.39; update to that release and restart the browser to apply it (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html). None are listed on CISA's KEV catalog.

SecurityWeek reported that a vulnerability in the Bricksforge WordPress plugin is being exploited in the wild and can allow threat actors to take control of targeted WordPress websites. If you run Bricksforge, check the vendor's advisory for a fix and review the site for signs of compromise.

On the attack front, The Record and BleepingComputer reported a cyberattack overnight Sunday disrupted refrigeration at hundreds of French supermarkets, spoiling fresh food; BleepingComputer reported the attack targeted Danfoss refrigeration controllers. Help Net Security reported a separate disruption at Netherlands and Belgium stores owned by Ahold Delhaize, and BleepingComputer reported Ahold Delhaize confirmed it took some systems offline after a cybersecurity incident. Operators of internet-reachable building and refrigeration controllers should check that those systems are not exposed and that remote access is restricted.

BleepingComputer reported that Ledger confirmed some devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. BleepingComputer also detailed AvisLoader, a Windows malware loader that Varonis researchers say uses ClickFix delivery, shortcut-based persistence and encrypted peer-to-peer command-and-control — defenders should hunt for ClickFix lures and anomalous shortcut persistence.

Schneier on Security reported the FBI arrested someone associated with the ShinyHunters theft of FBI data. SecurityWeek reported Canonical's main Ubuntu and Canonical websites were disrupted in a second DDoS attack this year, and BleepingComputer reported Anthropic took internal high-risk AI tests offline after incidents involving U.S. government websites.