Attackers warmed the freezers in hundreds of French supermarkets to 50 degrees Celsius and pushed Ahold Delhaize to disconnect systems across three countries, while GitLab and SAP patched maximum-severity flaws that need no login.
Emerging Trends and Key Updates
- Trend Attackers reaching refrigeration gear warmed hundreds of French supermarket freezers to 50 degrees Celsius, while Ahold Delhaize and Foschini disconnected systems across three countries to contain intrusions.
- Trend Maximum-severity server-side flaws pile up as GitLab patches CVE-2026-97229, SAP rates an OAuth2 SSRF maximum severity, and Progress flags five critical MarkLogic bugs.
- Trend Supply chains broke at their trust boundaries: a circuit board hidden under Ledger screens drained $86 million, and npm Trusted Publishing granted publish rights via abandoned GitHub names.
- Trend Drone strikes on Yandex data centers in Sasovo and Vladimir and Iran's 24 vessel hits around Hormuz show physical force aimed at digital and trade infrastructure.
- Update · new SSD Secure Disclosure chained three LG webOS bugs into root on certain smart TVs for any attacker on the same local network, with no PIN needed.
- Update · new Locally, Chris Deluzio and Tony Guy debate on KDKA+, mothers press the Magee board over nurse staffing, and the Pittsburgh Walk of Fame inducts its second class.
Security
1. Circuit Board Under the Ledger Screen
Latest developments: SecurityWeek described the implant's construction on October 13, 2026: a small circuit board sat hidden under the screens of the Ledger signers, read user data, and transmitted it to the attackers, who drained roughly $86 million from wallets created on devices the Southeast Asian reseller CryptoBilis sold; Ledger says the implant captured recovery phrases, and Kim Zetter reported the same day that the scheme reached legitimate resellers in both Asia and Europe and put the total theft near $100 million.
read more
Ledger, the Paris-based hardware wallet maker, has paused sales through CryptoBilis and ties every confirmed theft to a device from that reseller. Anyone holding a Ledger signer bought through a third-party reseller should verify the device and move funds to a seed generated on hardware bought direct.
Sources: SecurityWeek · Kim Zetter (Zero Day) · The Record · BleepingComputer · ↑ top
2. GitLab Patches a 10.0 Regex Compiler Flaw
Latest developments: GitLab's maximum-severity bug now carries an identifier and a mechanism: CVE-2026-97229 is an integer overflow in the CI/CD Regular Expression Compiler, it affects both Community Edition and Enterprise Edition, and an unauthenticated attacker reaches arbitrary code execution on the server through a specially crafted regular expression in a CI/CD configuration.
read more
Self-managed GitLab instances carry the risk; GitLab.com customers do not. Administrators should apply the patched releases immediately, since the flaw needs no account on the target.
Sources: The Hacker News · Help Net Security · BleepingComputer · ↑ top
3. French Supermarket Freezers Driven to 50 Degrees
Latest developments: The attack ran hotter than first reported: on the night of October 11, 2026 the attackers warmed refrigerators and freezers at hundreds of French supermarkets to 50 degrees Celsius, retail chains including Les Mousquetaires confirmed the losses, and the entry point was the single Danfoss controller that runs every cooling unit in a store, a device maintenance firms manage remotely.
read more
One remotely managed controller governs all the refrigeration in a store, which turns a single credential into spoiled stock across a chain. Grocery operators should inventory remote access held by refrigeration maintenance contractors and cut any path that reaches controllers from the open internet.
Sources: The Hacker News · SecurityWeek · Help Net Security · ↑ top
4. Ahold Delhaize and Foschini Disconnect Systems
Latest developments: The Ahold Delhaize incident now spans the Atlantic: the Dutch-Belgian owner of Food Lion, Stop & Shop, Giant, and Albert Heijn says it disconnected some systems to contain an intrusion, and reports put disruption at stores in the United States, the Netherlands, and Belgium; separately, The Foschini Group of South Africa disclosed a cyberattack on October 13, 2026 that knocked out IT systems and some services at three of its British fashion brands.
read more
Two large multinational retailers are working outages they attribute to network intrusions, with store operations rather than corporate email taking the damage. Neither company has named an attacker or confirmed data theft, and neither has given a restoration date.
Sources: The Record · SecurityWeek · The Record · ↑ top
5. Drones and DDoS Hit Russian Internet Infrastructure
Latest developments: Yandex named the damaged sites on October 13, 2026: drone strikes shut its data centers in Sasovo and Vladimir and knocked out part of its Kaluga infrastructure, and Yandex Cloud told customers on October 11, 2026 that the platform ran in emergency mode and they should fall back on their own disaster recovery plans; the same day, SkyNet, a major St. Petersburg internet provider, said a distributed denial-of-service attack that Ukrainian hackers claim has run against its network since October 6, 2026, degrading online gaming, voice calls, and video conferencing.
read more
Physical strikes and network floods are now hitting the same Russian digital infrastructure, taking down cloud storage, payments, and consumer connectivity. Organizations that depend on single-region Russian cloud capacity have lost access to files and have no restoration timeline from Yandex.
Sources: Help Net Security · The Record · BleepingComputer · ↑ top
6. SAP Patches a Maximum-Severity OAuth2 SSRF
Latest developments: SAP shipped its October 2026 security updates on October 13, 2026, fixing 20 flaws across its product line, and rated one of them maximum severity: a server-side request forgery in the OAuth2 handling of SAP Cloud SDK for Python.
read more
The Cloud SDK for Python underpins custom applications and integrations that talk to SAP cloud services, and a server-side request forgery turns such an application into a relay for an attacker's requests into internal systems. SAP customers should work the October patch day notes and update affected SDK dependencies in their own builds.
Sources: BleepingComputer · ↑ top
7. npm Trusted Publishing Opened 1,500 Packages
Latest developments: Bloom Security disclosed on October 13, 2026 that npm's Trusted Publishing feature let an attacker publish new versions of another maintainer's package by registering a GitHub repository name the maintainer had abandoned, with no stolen credential anywhere in the chain; Bloom counted more than 1,500 exposed packages carrying over 10 million downloads in total, and GitHub, which owns npm, says it has shipped fixes.
read more
Trusted Publishing ties publish rights to a GitHub repository instead of a token, so a renamed or deleted repository leaves the claim open to whoever registers that name next. Maintainers should audit the repositories their npm packages trust and reclaim any name they have retired.
Sources: Help Net Security · ↑ top
8. Frontier AI Clears Every Goal in Booz Allen's OT Lab
Latest developments: Booz Allen reported on October 13, 2026 that frontier AI models it set against an isolated industrial control testbed in its Chantilly, Virginia lab met all eight attack objectives the firm had defined: the models mapped the network, matched equipment to known weaknesses, wrote working exploits, pivoted into the systems that run production, and in the final test found a robotic arm, took administrative control, and moved it.
read more
The test puts a measured floor under claims that general-purpose models can run operational technology intrusions end to end, against the very equipment that moves physical things. Plant operators should assume exploit development against their known-vulnerable gear now costs an attacker hours instead of weeks and prioritize segmentation between business networks and production control.
Sources: Help Net Security · ↑ top
9. LG webOS Chain Roots Smart TVs
Latest developments: SSD Secure Disclosure published an advisory on October 12, 2026 describing three vulnerabilities in LG's webOS that chain into root access on certain smart TVs for any attacker on the same local network, with no PIN and no action from the owner; researchers ran the chain on the 32LQ636BPSA and 27TQ600SW models on webOS 7.5.7-25, and LG has issued a fix.
read more
A rooted television on a corporate or home network gives an attacker a persistent listening post with a camera-free but microphone-capable foothold behind the firewall. Owners and facilities teams should take the LG firmware update and keep displays on a segmented network away from business systems.
Sources: The Hacker News · ↑ top
10. MarkLogic Flaws Hand Managers the Server
Latest developments: Progress Software published 31 vulnerabilities in MarkLogic Server on October 12, 2026 and rated five of them critical; two let an account holding only partial management privileges seize administrator control of the database server and keep it.
read more
MarkLogic runs enterprise document and search workloads, so an escalation from delegated manager to full administrator exposes everything the database holds. Progress has shipped fixes since September 10, 2026 in MarkLogic 11.3.7 and 12.1.0, and administrators should upgrade and review who holds delegated management rights.
Sources: The Hacker News · ↑ top
Business and Politics
Iran's Attacks on Hormuz Shipping Reach a Wartime Peak
Latest developments: The Financial Times reported Tuesday, October 13, that Iran has struck 24 tankers and other vessels in and around the Strait of Hormuz in two weeks, six of them on Sunday alone, the heaviest spate since the war began, while OPEC again trimmed its forecast for this year's oil demand growth.
read more
Saudi Arabia says its September crude output reached the highest level since the conflict started, and the renewed attacks on shipping this month put that recovery at risk. Oil prices fell Tuesday after three sessions of gains as traders weighed Persian Gulf supply risk against the Russian diesel President Trump has promised to bring to market, leaving insurers, charterers, and refiners exposed to a sudden halt in Gulf flows.
Sources: FT World · FT World · WSJ World News · WSJ US Business · ↑ top
The AI Trade Cracks Again
Latest developments: Broadcom's chief executive called the artificial intelligence spending race a "casino," and chip stocks slid worldwide Tuesday, October 13, with Nasdaq futures falling sharply.
read more
Samsung Electronics and SK Hynix dropped hard enough to drag South Korea's Kospi sharply lower, and Asian and European technology shares followed as investors questioned the scale of AI capital spending and the pace of Chinese competition. Treasury yields eased partly because money left those shares, which ties the bond market's relief to the equity market's doubt.
Sources: FT World · WSJ Markets · WSJ Markets · ↑ top
European Gas Reaches a Four-Year High
Latest developments: European natural gas prices climbed Tuesday, October 13, to their highest level since December 2022.
read more
Escalating attacks in the Middle East threaten Persian Gulf liquefied natural gas cargoes just as European storage sits unusually low for the season, and the standoff between Washington and Kyiv over Russian diesel supplies compounds the squeeze. A global scramble for LNG raises industrial and household energy costs across the continent through the winter.
Sources: WSJ Markets · WSJ Markets · FT World · ↑ top
Bond Stress Shifts to the Short End
Latest developments: The 10-year Treasury yield fell 5.5 basis points to 5.189% Tuesday, October 13, well below last week's 24-year high, while the Financial Times reported that rising Treasury bill issuance now pressures short-term lending rates and the International Monetary Fund sounded an alarm over governments' public finances.
read more
Lower oil prices and the pullback in AI shares pulled Treasury and eurozone yields down ahead of United States inflation data, and record inflows into government bond funds show investors locking in the highest borrowing costs in decades. Strain migrating from the long end to money markets complicates the Federal Reserve's control of short-term rates.
Sources: WSJ Markets · FT World · FT Home · FT World · ↑ top
JPMorgan Misses as Trading Revenue Falls
Latest developments: JPMorgan Chase, Goldman Sachs, Wells Fargo, and Citigroup all reported third-quarter results Tuesday, October 13: JPMorgan's profit rose from a year earlier yet landed below expectations on weaker bond trading and its shares fell, Wells Fargo's revenue disappointed, and Goldman's equities desks carried net income 30% higher.
read more
The results open a mixed Wall Street earnings season in which fixed-income desks, the engine of a record second quarter built on volatility, gave way while stock trading held up. Because bond trading drove much of the industry's recent profit growth, the split reshapes revenue guidance across the largest United States banks.
Sources: FT Home · WSJ Markets · WSJ Markets · ↑ top
Pittsburgh
Weather
Today: Sunny, high 82F.
Tonight: Mostly Clear, low 65F.
Wednesday: Chance Showers And Thunderstorms, high 78F.
Business
Breeze Airways Takes the Latrobe Gates
Latest developments: Breeze Airways announced Tuesday, October 13, that it will fly out of Arnold Palmer Regional Airport in Latrobe, filling the new terminal that opened to the public the same day, with service expected to start by early 2027.
read more
Westmoreland County's airport has had no commercial passenger service since Spirit Airlines folded in May, and the low-cost carrier's arrival answers the question county officials left open when they unveiled the terminal. Breeze gives travelers in the Alle-Kiski and Laurel Highlands corridor an alternative to driving to Pittsburgh International Airport.
Sources: KDKA · WPXI · WTAE · ↑ top
Mothers Press the Magee Board on Nurse Staffing
Latest developments: WTAE reported Tuesday, October 13, that mothers who delivered at UPMC Magee-Womens Hospital asked the hospital's board to fix nurse staffing levels while contract talks with the newly organized nurses union continue.
read more
The women told WTAE that thin staffing is driving nurses out of the profession at the Oakland hospital, which handles more births than any other in Western Pennsylvania. Their appeal lands in the middle of first-contract bargaining between UPMC and the Magee nurses who voted to unionize.
Dining Out Gets Expensive on Both Sides of the Table
Latest developments: The Post-Gazette reported Tuesday, October 13, that Pittsburgh restaurant owners describe profitability as down quite a bit while customers absorb higher menu prices.
read more
Rising food, labor, and occupancy costs have narrowed margins across Pittsburgh restaurants, and operators tell the Post-Gazette they pass only part of the increase to diners. The squeeze bears on one of the region's larger employers of hourly workers.
Sources: Pittsburgh Post-Gazette · ↑ top
Verizon Retires Its Copper Lines
Latest developments: Verizon told TribLive on Tuesday, October 13, that its copper landline phaseout will not disconnect customers.
read more
Michele Vanetta, who has lived in Jeannette her whole life and kept the same number for nearly 40 years at her current house, is among the Westmoreland County customers whose service moves off copper. Verizon says it will carry those lines onto replacement technology rather than cut them.
Shorty's, Apteka, and Northside Sandwich Week
Latest developments: Pittsburgh City Paper's weekly food column, published Tuesday, October 13, carries updates on Shorty's Social Kitchen, New Amsterdam, Apteka, Northside Sandwich Week, and a new Sheetz meat line.
read more
The column tracks openings, menu changes, and fall cocktail programs across Pittsburgh restaurants and bars, with Northside Sandwich Week giving North Side shops a week of promotion. Readers get the week's operating news on independent kitchens in one place.
Sources: Pittsburgh City Paper · ↑ top
Around Town
Deluzio and Guy Debate on KDKA+
Latest developments: KDKA reported Tuesday, October 13, that United States Representative Chris Deluzio, a Democrat, and his Republican challenger, Tony Guy, meet in a televised debate on KDKA+ on Tuesday.
read more
The two candidates for the Western Pennsylvania congressional seat take questions three weeks before the November 3 election. KDKA is carrying the debate on its KDKA+ channel and streaming platform.
Penn-Trafford Weighs Closing McCullough Elementary
Latest developments: TribLive laid out the Penn-Trafford School Board's consolidation plan Tuesday, October 13, along with what parents say about it.
read more
The board would close McCullough Elementary School, the Westmoreland County district's oldest building, and redistribute grade levels among the schools that remain. Parents have pushed back on the shifts the plan would force on their children's buildings and bus routes.
A Voter Guide to 17 Legislative Races
Latest developments: PublicSource published its 2026 voter guide Tuesday, October 13, three weeks before the November 3 election.
read more
The guide covers 17 contested legislative races in Allegheny County and prints candidates' answers on Immigration and Customs Enforcement activity, the war, and data center development, the issues readers flagged. Those three subjects have driven the fall campaign across Western Pennsylvania.
Sources: PublicSource · ↑ top
Rachel Carson EcoVillage Shows Progress
Latest developments: TribLive reported Tuesday, October 13, that work has resumed at the Rachel Carson EcoVillage site in McCandless after roughly a year of inactivity.
read more
Backers of the cohousing community, planned around shared space and low-energy construction in McCandless, say obstacles left the property largely undeveloped for about a year and the project still moves forward. The site sits in one of the North Hills municipalities fielding the most new residential proposals.
Warm Tuesday, Then Two Impact Days
Latest developments: WTAE's Tuesday morning update, October 13, keeps the day warm and breezy and tags Wednesday, October 14, an Impact Day for rain, with a second Impact Day behind it; KDKA calls Tuesday's push toward 80 degrees likely the year's last.
read more
Pittsburgh starts Tuesday under patchy fog and mist before afternoon sun, and rain arrives with the next front Wednesday. Temperatures drop sharply through the week behind the system.
Sources: WTAE · WTAE · KDKA · ↑ top
Events
The Pittsburgh Walk of Fame Inducts Its Second Class
Latest developments: KDKA reported Tuesday, October 13, that the Pittsburgh Walk of Fame adds its second class of inductees at a ceremony in the Strip District on Tuesday, with Mario Lemieux attending.
read more
The Walk of Fame, laid into the sidewalks of the Strip District, honors Pittsburghers who made a mark nationally and began with an inaugural class last year. Lemieux, the Penguins owner and Hall of Fame center, appears at the induction.
Glass Pumpkins at the Pittsburgh Glass Center
Latest developments: Pittsburgh Magazine's weekend guide, published Tuesday, October 13, leads with Halloween Make-It-Now on Saturday, October 17, at the Pittsburgh Glass Center.
read more
Visitors make their own glass pumpkin in a color of their choosing with a local artist's help, and the Make-It-Now format also offers short tries at glassblowing, flameworking, and fusing, with activities starting at about 20 minutes. Pittsburgh Magazine lists no ticket price.
Sources: Pittsburgh Magazine · ↑ top
Joe Manganiello Publishes "Bloodlines"
Latest developments: The Post-Gazette reviewed Joe Manganiello's memoir "Bloodlines" on Tuesday, October 13, and ran a companion interview the same day.
read more
The Mount Lebanon native and actor opens the book at death's door and closes it in Pittsburgh, where he grew up; the interview covers the Dungeons & Dragons work he calls his dream job. The Post-Gazette treats the memoir as a Pittsburgh story first.
Sources: Post-Gazette Arts & Entertainment · Post-Gazette Arts & Entertainment · ↑ top
McCandless Holds Its First Restaurant Week
Latest developments: WPXI reported Tuesday, October 13, that McCandless's first-ever Restaurant Week is underway.
read more
Restaurants across McCandless, the North Hills municipality along McKnight Road, are taking part in the community's inaugural Restaurant Week promotion. WPXI gave no closing date or participant list.
Sports
Steelers (3-2)
Up Next · Steelers @ Buccaneers · Sun Oct 18, 1:00 PM
Penguins (3-2)
Up Next · Penguins @ Blackhawks · Tue Oct 13, 8:00 PM
Around the Teams
Ranking All 41 Pirates by Their Odds of Returning
Latest developments: The Post-Gazette ranked all 41 players on the Pittsburgh Pirates' roster Tuesday, October 13, by the likelihood each comes back for 2027.
read more
The list runs from Konnor at the near-certain end to Kirby at the other and frames the arbitration, option, and roster-crunch calls general manager Ben Cherington's front office faces this winter. It arrives as the club's offseason decisions begin after a minor-league season the paper graded a success.
Sources: Post-Gazette Pirates · ↑ top
McCarthy Turns to Tampa Bay
Latest developments: The Steelers posted head coach Mike McCarthy's Monday, October 12, news conference previewing Week 6 at the Tampa Bay Buccaneers, set for Sunday, October 18, at 1 p.m. Eastern on CBS.
read more
Linebackers Nick Herbig and Patrick Queen and guard Mason McCormick took the podium the same day on the team's YouTube channel. The Buccaneers trip follows a four-game stretch that has cost Pittsburgh receivers and defensive backs to injury.
Sources: Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · ↑ top
The WPIAL's NFL Pipeline Thins
Latest developments: The Post-Gazette published an examination Tuesday, October 13, of why the WPIAL and the Pittsburgh City League send fewer players to the NFL than they did a decade ago.
read more
Western Pennsylvania high school football long supplied a steady stream of professional players, and the paper traces the decline through participation numbers, recruiting patterns, and the migration of talent to other regions. The trend matters to a city that built part of its identity on that pipeline.
Sources: Post-Gazette Steelers · ↑ top
SNR Drive Takes a Victory Monday
Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, October 12, on the Steelers' Week 5 win over the Indianapolis Colts, with Rob King, the voice of the Steelers, calling in.
read more
The team-produced show worked through the game, the rest of the Week 5 NFL slate, and a segment the hosts labeled "winning is better than losing." The hosts note their opinions belong to them rather than the franchise.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Reading
- Stratechery — SpaceX Buys More Spectrum, Musk and Market Structure, Distributed Cellular. Ben Thompson argues that SpaceX's latest spectrum purchase clarifies a mobile strategy built on distributed cellular service from orbit, and that the approach has a real chance of working against incumbent carriers.
- Ed Zitron — Premium: The Hater's Guide To Junk. Zitron walks through the junk bond market, once a sleepy corner of credit, and argues that the current flood of speculative-grade issuance marks an era of exceptionally low-quality debt.
Markets
S&P 500 7,800.97 ▲ +1.3% Dow 51,487.66 ▲ +0.7% Nasdaq 27,388.78 ▲ +1.3% WTI crude 90.96 ▲ +0.4% EUR/USD 1.1228 ▼ -0.9% GBP/USD 1.3234 = -0.0% USD/JPY 158.02 ▲ +0.3%
Feed Health
Security: 24 of 24 feeds loaded, 43 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, 404 Media, Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 18 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via ESPN
Summaries: 3 model call(s) served by claude-opus-5 (375s of model time; $1.95 at API list price).