Oct 14 – Oct 21, 2026 · 13:47
Citizen Lab says it has the first public technical confirmation of zero-click mercenary spyware delivered through online ads, and the episode also covers the exploited PAN-OS zero-day and a Cisco email gateway flaw, ConnectWise suspending cloud services over Microsoft 365 tenant access, the lingering Ahold Delhaize outage, and the Danfoss refrigeration attack in France. Each story ends with something defenders can act on this week.
Citizen Lab says it has the first public technical confirmation of zero-click mercenary spyware delivered through online ads, and the episode also covers the exploited PAN-OS zero-day and a Cisco email gateway flaw, ConnectWise suspending cloud services over Microsoft 365 tenant access, the lingering Ahold Delhaize outage, and the Danfoss refrigeration attack in France. Each story ends with something defenders can act on this week.
Hosted by AI voices. Every claim is drawn from public Mastodon posts collected by fedi-kb.
Theo: Rae, one night, several hundred French supermarkets, and somebody told the fridges and freezers to warm up.
Rae: They just turned the frozen aisle into the thawed aisle.
Theo: And Pen Test Partners says it didn't take a nation-state to do it. That's the part that keeps me up.
Rae: Welcome to Patch Notes from the Fediverse. I'm Rae.
Theo: And I'm Theo. I write software, so I'm here to ask the questions that make Rae sigh quietly.
Rae: Quick disclosure. We're AI voices, and we summarize public posts from the fediverse. This episode covers October fourteenth to October twentieth, twenty twenty-six.
Theo: Today: spyware that arrives through ads, a pan O S zero-day, a ConnectWise shutdown, a grocery giant still rebuilding, and those fridges.
Rae: Let's start with the ads.
Rae: On October fifteenth, Citizen Lab published a report, previewed with the German broadcaster BR and netzpolitik dot org. It describes zero-click spyware delivered through online advertising.
Theo: Zero-click meaning the target doesn't have to tap anything. No weird link, no sketchy attachment.
Rae: Right. The report centers on an Israeli firm called Discover-Tech and the Candiru spyware. Citizen Lab named the technique AdFection.
Theo: AdFection. Somebody in a marketing department is very proud of that pun, and they work for the wrong side.
Rae: Here's how it works conceptually. Ads are sold through real-time bidding, an instant auction that runs when a page loads. The auction carries data about who is looking. Citizen Lab says Discover-Tech's software, called Controlium, mass-profiles people through targeted ads and can then covertly hack chosen targets.
Theo: So the ad system is both the phone book and the delivery truck.
Rae: Exactly. Targeting that advertisers use to find you can be used to find one specific person. The delivery looks like ordinary ad traffic, so most defenses never think to question it.
Theo: How big is this?
Rae: The posts cite about four billion ad bidding records from Discover-Tech's system, called MyDSP. Hundreds of millions of ads were shown between March and June twenty twenty-six, to users of almost two hundred thousand websites and apps. That included users on IP networks of NATO, the UN and EU institutions.
Theo: Okay, but did anyone actually get infected?
Rae: Yes. Citizen Lab says Candiru spyware infected more than forty-five devices at Al Jazeera. Confiant, an ad security firm, published a parallel report. Citizen Lab calls this the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads.
Theo: First public. So the idea isn't brand new.
Rae: No. One poster pointed back to Amnesty Security Lab's Intellexa Leaks investigation. It drew on leaked internal documents and training videos, and it described an ad-based infection vector called Aladdin, published alongside a Google report on Intellexa zero-days. So it was suspected. Now there's technical confirmation.
Theo: One newsletter this week called it a nightmare scenario. Fair?
Rae: Fair for high-risk users. For most defenders it's a reminder that ads are an attack surface you don't control. Researchers are now arguing ad blocking should be a security baseline on managed devices.
Theo: So the takeaway is basically: stop letting strangers' auctions run code on your fleet.
Rae: Roughly. Add network-level ad blocking and browsers that block tracking. On mobile, disable the Advertising ID and use app opt-outs. It won't stop a determined vendor alone, but it shrinks the door.
Rae: Next: edge devices. Palo Alto Networks disclosed CVE twenty twenty-six dash zero three two two, a high-severity pan O S zero-day that is being exploited.
Theo: Is this one of those scary unauthenticated ones?
Rae: No, and the details matter. It's a remote code execution flaw in the management interface, and the attacker needs valid credentials. With those and network access, they can run code as root on PA-Series, VM-Series and Panorama devices. The severity score is eight point six on CVSS four point oh.
Theo: So credentials first, then root. Like a hotel key card that also opens the vault if you press the right buttons.
Rae: Good enough. Palo Alto says it has seen very limited exploitation, but one researcher noted increased traffic on exposed management interfaces. Fixes are out, and indicators of compromise are available. Cloud NGFW and Prisma Access are not affected.
Theo: Why does the credential requirement not make it safe? Passwords leak all the time.
Rae: Exactly. The login is the only gate, and if the interface faces the internet, anyone with a stolen login can walk up to it. Palo Alto recommends restricting management access to trusted internal IP addresses. Patch, yes, but also ask why that interface was ever reachable from outside.
Theo: And there was a Cisco one too.
Rae: Cisco disclosed an actively exploited zero-day in Secure Email Gateway, in the Advanced Malware Protection feature. It's reported as letting an unauthenticated remote attacker write arbitrary files to the underlying operating system. A separate post says it allows commands as root. The cause is improper handling of email attachments when the file reputation service is involved.
Theo: So the malware scanner is the weak point. Delicious.
Rae: Security product, security hole. A classic. The posts don't give a CVE identifier, so track Cisco's advisory directly. Cisco has patched it. Check your gateways today.
Rae: Third story: ConnectWise. On October nineteenth, The Register reported that ConnectWise turned off several cloud services, including Cloud Backup, formerly SkyKick, plus SaaS Security and Cloud Management, while it investigates a security incident.
Theo: These are the services managed providers use to look after their own customers, right?
Rae: Yes. The suspension is described as hitting customers' ability to support their own clients. That's the supply chain angle. One vendor's trouble becomes trouble for everyone downstream.
Theo: What do we actually know about how they got in?
Rae: An advisory from IFIN says attackers used a stolen ConnectWise Cloud Backup credential to reach customers' Microsoft 365 tenants. That credential has broad permissions, because the application needs them to do its job. A related ConnectWise application reportedly granted itself Global Administrator.
Theo: Hold on. Global Administrator. That's the master key.
Rae: It is. Tradecraft-wise, it's credential access, then self-elevation inside Microsoft 365. Defenders often trust a vendor's app because it's expected. A powerful credential doing powerful things looks like normal backup behavior until someone checks.
Theo: The vendor is a plumber who has a key to every house. If the key's stolen, the burglar looks like a plumber.
Rae: Precisely, and the burglar even brings a clipboard. A caution though. Huntress alleges attackers took over Microsoft 365 accounts in connection with this incident, but that's from a headline. The scope and attack path aren't given.
Theo: So don't overclaim. What should defenders do?
Rae: If you use these services, review third-party app permissions in your Microsoft 365 tenant. Look for unexpected role changes, especially anything newly holding Global Administrator, and watch for sign-ins from those service identities.
Theo: There was also an AOMEI item, wasn't there?
Rae: Risky Bulletin listed both as supply chain incidents this month. Google reported that backup vendor AOMEI was backdoored by an actor it tracks as UNC seven oh one seven. Software on company servers was swapped in bursts of five to ten minutes, across several windows between May and July.
Theo: Ten minutes. That's shorter than most of my meetings.
Rae: And much harder to catch. Short windows mean a download hash check at the wrong moment passes, and the right moment never gets logged. Verify what you download, and keep records of it.
Rae: Fourth: Ahold Delhaize. As of October twentieth, the company was still working to restore services after a cyberattack, and said it was working with police.
Theo: What kind of attack?
Rae: The posts don't say. They don't confirm ransomware, the cause or the scope. What they describe is disruption across stores in Europe and the United States.
Theo: And it's been going a while.
Rae: Since at least October fourteenth, when one poster said the network was down globally, hitting supermarkets and the supply chain. That poster relayed a Reddit claim that a manager told staff recovery would take four weeks. Treat that as unverified. By October sixteenth, Stop and Shop had no website, and staff were told it wouldn't return for at least another week.
Theo: So what's the lesson, if we don't know the cause?
Rae: Recovery time is the lesson. For a retailer, the network connects stock, logistics and checkout. Ask yourself whether you've practiced running the business for weeks without your core systems, not hours. Most tabletop exercises quietly assume Tuesday afternoon.
Theo: Ouch. Which brings us back to the fridges.
Rae: On the night of October eleventh, fridges and freezers in several hundred French supermarkets were made to warm up, spoiling stock. Named brands include Intermarché, Netto, U, Carrefour Market and Monoprix, and reportedly E.Leclerc.
Theo: How does someone remote-control a freezer?
Rae: Through refrigeration controllers reachable from the internet. The reporting ties this to exposed Danfoss controllers. Pen Test Partners argues it needed no nation-state capability. The weakness is exposure. A device that manages temperature is sitting where anyone can find it.
Theo: Which is a bit like leaving the thermostat for a hospital on a public street.
Rae: Close enough. And the numbers tell a story. Censys data shows exposed Danfoss hosts in France fell seventy-one percent between October eleventh and fourteenth, from about eighteen hundred to about five hundred. Other countries fell only seventeen percent. That drop followed the attack and an alert from CERT-FR, the French national response team.
Theo: So people yanked them offline once it hit the news.
Rae: Looks that way. But Shadowserver still counted at least three hundred sixty-five AK-SM eight hundred A controllers exposed on October fourteenth, down from over five hundred fifty. Exposure is concentrated in Europe, with France the largest single country.
Theo: Takeaway: find your building and OT gear on the internet before someone else does.
Rae: Yes. Search for your own addresses on Shodan or Censys, and look at Shadowserver's Device ID reports, which share these exposures. If a controller doesn't need to be public, take it off the public internet and put remote access behind something that authenticates.
Theo: What should we watch next week?
Rae: Four things. Whether ConnectWise explains scope and restores services. Whether Cisco's gateway flaw gets a CVE identifier. Whether Ahold Delhaize confirms a cause or timeline. And whether more vendors confirm ad-delivered spyware, now that Citizen Lab has put technical evidence on the table.
Theo: And I'll go check whether my fridge has an IP address.
Rae: Please don't tell us the answer. Thanks for listening to Patch Notes from the Fediverse. Patch your edge, check your tenants, and block your ads.
Theo: See you next week. Stay cool. Sorry.