Cve

On 11–12 October 2026, attackers hijacked refrigeration controllers in hundreds of French supermarkets and forced defrost cycles that heated units toward 50°C, spoiling food across Intermarché, Carrefour, Monoprix, Leclerc, Coopérative U and Super U. CERT-FR confirmed compromises of Danfoss AK-SM and AK-SC controllers and told operators to disconnect them. Here is what is confirmed, what is still unverified, why refrigeration is OT, and the free tools to check your own exposure.

CVE-2026-85097 is a maximum-severity (CVSS 10.0) unauthenticated arbitrary-file-upload flaw in Bricksforge, a popular add-on for the Bricks WordPress builder, that leads to remote code execution. It is being exploited in the wild from October 7, 2026. Here is exactly how the attack works, why patching alone is not enough, and the defender’s checklist — patch to the latest release, hunt the indicators of compromise, and assume exposed sites may already be breached.

A16z, using Epoch.ai data across 21 major software vendors (Apple, AWS, Microsoft, Google, Cisco, Oracle and more), shows critical-severity CVEs that never cleared ~100 a month for four years suddenly jumping past 600 a month since spring 2026; high-severity reports spiked toward ~2,200 a month. In parallel, Kevin Mandia (Mandiant’s founder) says his new venture Armadin has found 90+ zero-days in production at customer sites this year using models post-trained with real red-teamers — black-box, from the internet, no source code. What’s confirmed vs. reported, why the curve bent, and what a security leader should do now.

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE, under active exploitation with no workaround. Affected versions, patches, and detection.

Attackers are mass-exploiting CVE-2026-0768, a CVSS 9.8 unauthenticated RCE in the Langflow AI app builder, to run code as root and harvest OpenAI API keys and cloud secrets. What the flaw is, why AI gateways are the target, and what to do today.

CISA added LiteLLM CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on Sep 3, 2026 — an unauthenticated attacker can establish an authenticated MCP session against the popular AI gateway. Why the gateway is the prize, and how to respond.

CERT/CC VU#456290 (Sep 1, 2026): a flaw in Hugging Face Transformers 4.49.0–5.8.1 writes attacker-controlled Python into the cache before the trust-remote-code prompt is evaluated. How the consent-bypass works, who is exposed, and the mitigations.

Microsoft detailed a coordinated campaign (Aug 2026) hitting exposed AI infrastructure — LiteLLM, RAGFlow, Kestra — to steal every model-provider API key and then mine crypto on the box. The CVEs, the credential-harvesting playbook, and how to lock your AI control points down.