Dead Air, Burning Racks, and a Record Fine

This Week in Brief

The week from 8 to 12 October belonged to infrastructure. On Thursday afternoon a fault inside Telenor’s mobile network stopped voice calls across Norway for hours, emergency calls to 110, 112 and 113 failed, and Bane NOR halted every train in the country. Nkom has raised its preparedness and opened supervision. Four days later, on Monday 12 October, a fault in the BankID app degraded ID-porten for two and a half hours and knocked out signing through the public e-signing service. On 8 October, Ukraine began a run of drone strikes on Yandex data centres that by Sunday had shut down two facilities and crippled a third, taking dozens of Russian cloud services with them. Datatilsynet handed Microsoft-owned Xandr the largest fine in its history, NOK 92 million, for passing Grindr users’ sensitive data through ad auctions. Carried over from earlier issues: the Citrix NetScaler zero-days are still being exploited with a new web shell, a third exploited zero-day has joined them, and Citrix has shipped a fourth critical patch. On 8 October Økokrim named organised crime’s foothold in tourism and fishing and held up the DNB loan-corruption indictment from March as its insider example, and Lotteritilsynet moved to block 62 gambling operators including Polymarket. In the Middle East, Riyadh airport was hit four times in five days, the 10 October strike alone killing 13.

Security

Citrix NetScaler: a third exploited zero-day and a fourth critical patch (CVE-2026-88771, -88772, -88779, -107406)

NSM flagged CVE-2026-88771 and -88772 on 27 September and a third exploited zero-day, CVE-2026-88779, on 3–4 October; on 9 October Citrix issued its third critical NetScaler patch in as many weeks (CVE-2026-107406, CVSS 9.5, SAML IdP). The original pair is still being worked by attackers. The Hacker News and watchTowr both report a second-stage payload, delivered via a Perl script, that creates a superuser account on the appliance and conceals a PHP web shell behind URLs styled to look like CSS files. Patches have been available since the original disclosure. This is a continuation of an already-running story rather than a single new vulnerability, but the web-shell technique is a meaningful escalation in attacker tradecraft against an appliance that remains widely unpatched.

Operational read: if you run NetScaler and have not patched against CVE-2026-88771, -88772 and -88779, and applied the 9 October fix for CVE-2026-107406, treat this as urgent. Patching alone does not clear a box that was already compromised during the exploitation window since late September, check for unexpected superuser accounts and for static files served from unusual paths that respond like a web shell rather than CSS.

Norway and the Nordics

Telenor outage stops calls, emergency numbers and every train in Norway

At 15:15 on Thursday 8 October a fault inside Telenor’s mobile network began stopping voice calls: between Telenor customers, to and from Telia and Ice, and to the emergency numbers. Police, fire and health services reported that calls were not getting through, and Bane NOR stopped all trains at the nearest station because its train control could not reach the emergency services, which its safety rules require before trains may run. SMS and data were largely unaffected. Telenor’s 18:45 press release said traffic had run normally since 17:25, with emergency numbers confirmed reachable in an 18:05 update; Bane NOR reported its communication problem solved at 19:30. Nkom said nothing pointed to deliberate action; Telenor’s chief executive said there was no indication of a breach but did not fully exclude sabotage. The cause is described as a technical fault in traffic handling that will take time to analyse.

Nkom has raised its preparedness, announced supervision of Telenor — its second Telenor supervision opened that day, the other concerning roughly 20,000 SIM cards disabled by a routine update in late September — and is examining a possible breach of the law; the digitalisation minister’s line was that this must not happen. It is not the first time: Telenor failed emergency callers four times in autumn 2024, and Nkom later found 22 breaches, including missing redundancy, and imposed a NOK 50 million fee, its largest ever, upheld in July 2025. Telenor had 40.4 percent of Norway’s mobile subscriptions at the end of 2025 (Nkom).

Operational read: a network that is up but cannot route calls is worse than one that is down, because phones only fall back to another operator’s network for emergency calls when their own has no coverage. Keep your police district’s backup number, keep at least one phone in the household on a different operator, and remember that data-based calls (Signal, WhatsApp) worked while ordinary voice was out. Any critical procedure that assumes a public mobile call will connect, as Bane NOR’s train control did, deserves a second look.

BankID app failure degrades ID-porten and e-signing

Four days after Telenor, a second piece of national digital infrastructure stumbled. From 12:12 on Monday 12 October, Digdir reported disruptions in ID-porten, the login gateway to Altinn, Skatteetaten, NAV and most other public services, and traced them to problems with the BankID app. Its e-signing service, eSignering, had reduced availability for both signing and login, which Digdir classed as major impact. BankID with a code device worked throughout, as did MinID, Buypass and Commfides. The BankID app was available again from 14:44, and Digdir closed both incidents later that afternoon. No cause beyond “problem med BankID App” has been published.

Operational read: most Norwegians log in to almost everything with one app. Make sure you have a second e-ID that works, MinID or a BankID code device, before you need it, and if your business depends on customers signing with BankID on a deadline, plan for a few hours when they cannot.

Datatilsynet: record NOK 92 million fine for Microsoft-owned Xandr

Datatilsynet has fined Xandr, Microsoft’s ad-tech company, NOK 92 million (about EUR 8.6 million), the highest fine the authority has issued. Xandr relayed personal data about Grindr users in Norway, including data revealing sexual orientation, through real-time bidding to potentially thousands of companies, acting on both the buying and selling side. Datatilsynet found that explicit consent was required and that Xandr had done nothing to make sure it existed. The complaint came from Forbrukerrådet together with noyb. Xandr has three weeks to appeal; the decision is not final until then.

Operational read: “we are only the intermediary” did not hold. If your website or app runs third-party ad or tracking tags, you are part of the same chain, and since 1 January 2025 Norway’s ekomloven requires GDPR-grade consent for any non-essential tracking.

Økokrim: organised crime has embedded itself in legitimate Norwegian industries

Økokrim’s 2026 national threat assessment, released 8 October, states that criminal networks are increasingly operating inside legal sectors rather than alongside them, naming tourism, the fishing fleet and finance specifically. Destinasjon Lofoten told TV2 that “nordlysturisme”, the northern-lights tourism trade in Lofoten and Finnmark, has become a documented front for illegitimate operators. NRK, Aftenposten, Finansavisen and Dagsavisen all carried the assessment the same day.

Operational read: this is a law-enforcement framing shift, not a new crime type. For any Norwegian business doing due diligence on tourism-sector or fishing-fleet counterparties, the assessment is now a citable basis for asking harder questions about ownership structure and cash flow.

Økokrim points to the DNB loan-corruption case as the insider pattern to watch

Five people, among them a former DNB bank manager and two advisers, were indicted in March for gross corruption and fraud over 98 loans worth NOK 316 million approved against payment between 2020 and 2022; the trial is scheduled for February. On 8 October Økokrim director Pål Lønseth used the case to illustrate the insider risk flagged in the new threat assessment (TV2), citing financial-sector insiders as an emerging category of risk alongside external fraud.

Operational read: the insider angle is the point here. Access-review and segregation-of-duties controls around loan approval authority are the control that would have caught this pattern; if your organisation has a similar single-approver bottleneck, this is the week to review it.

Lotteritilsynet moves to block 62 gambling sites, Polymarket among them

Norway’s Gaming Authority sent formal blocking notices to 62 gambling operators found in breach of Norwegian gambling law, with DNS blocking to follow; the 62 operators have until 15 October to respond before decisions are issued, and 238 foreign operators are already blocked. Polymarket is named specifically, reported by E24, TV2, NRK and Adresseavisen. The inclusion is notable given Polymarket’s prior entanglement in last year’s Nobel Peace Prize leak controversy, where betting odds moved ahead of the 2025 announcement; the Nobel Institute, which says it was most likely spied on in 2025, tightened procedures before Friday’s announcement of Navi Pillay as the 2026 laureate, and more than $27 million had been staked on Polymarket.

Operational read: DNS blocking is trivially bypassed by anyone using a non-ISP resolver or VPN, so treat this as a legal and reputational marker rather than an effective technical control. Norwegian organisations with marketing or sponsorship ties to prediction-market platforms should note the regulatory direction before Lotteritilsynet’s enforcement widens.

Regulatory and Policy

The EU’s AI Omnibus, in force since 27 July, pushed the AI Act’s high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I); the watermarking item below is therefore voluntary positioning, not compliance under a live deadline.

Digi.no reports, single-source so far, that OpenAI has begun watermarking ChatGPT text output in Europe ahead of the Act’s transparency requirements. If confirmed by a second outlet, this would be the first concrete sign of a major AI provider adjusting output behaviour specifically for EU compliance rather than policy language alone, worth tracking in the next issue.

Conflicts

Ukraine knocks out three Yandex data centres in four days

Ukrainian drones hit Yandex’s data centre at Sasovo in the Ryazan region on 8 October, forcing a full shutdown of a site that housed two of the supercomputers used to train YandexGPT. Several modules at Yandex’s Kaluga site were disabled on 9 October, and on 11 October a strike shut down the Vladimir facility, disrupting more than 80 platforms and Yandex Cloud services including compute, object storage, managed Kubernetes and PostgreSQL. Zelenskyy confirmed the strikes as retaliation for Russian attacks on Ukrainian digital infrastructure. Meduza and The Moscow Times documented knock-on outages at Avito, Ivi, Megafon, Russian Railways and T-Bank.

Cloudflare Radar showed a sharp fall in automated traffic from Yandex’s network (AS13238) at the same time, which spread online as proof that Russian propaganda bots had been knocked offline. Analyst Richard Stiennon, who shared the graph, added the caveat that Cloudflare’s figure “probably includes Yandex’s crawler”, so ordinary search crawling accounts for much of it and the graph says little about influence operations.

Operational read: data centres are now military targets, and cloud concentration is a physical risk as well as a contractual one. A backup held with the same provider as production is not a backup. And treat a dramatic dashboard graph as a measurement of what that dashboard counts, not as confirmation of the story attached to it.

Riyadh airport hit four times in five days; Houthis threaten every Saudi airport

Riyadh’s King Khalid airport was struck on 7, 8, 10 and 11 October. The 8 October strike killed three, among them a Saudia pilot, and set an airliner on fire. The 10 October missile strike killed 12, later 13, an American among them, and injured more than 300 — the deadliest attack in a Gulf Arab state since the Iran war began. On 11 October a further hit on Terminal 4 killed one and injured 11, and Dammam’s airport was also struck. The Houthis threatened further attacks on Saudi airports, excluding those serving Mecca and Medina. The UK now advises against all but essential travel to Riyadh province and other parts of the kingdom, and the US and others have told citizens to avoid the airport; Washington says it is considering joining Saudi strikes.

Russia strikes Ukraine on Putin’s birthday, Ukraine hits back at Samara and the Black Sea

Russia launched roughly 70 ballistic missiles and 130 drones against Kyiv, Dnipro, Zaporizhzhia, Kremenchuk and Pryluky on 7 October, timed to coincide with Vladimir Putin’s birthday. Casualty figures vary by outlet and update cycle: at least 24 were killed per AP on the day, 32 per Ukrainian sources cited by EA WorldView; the Pryluky apartment-block toll later rose to 22, five of them children. Ukraine struck back, hitting an oil pipeline and storage facility in Russia’s Samara region and a shadow-fleet tanker in the Black Sea near Sochi, with NASA satellite imagery confirming the resulting fires.

A Russian guided bomb hit a bus stop in Kramatorsk on 8 October; the Donetsk governor put the toll at 33 killed and 18 injured, AP reported 30 dead.

Ukrainian commander says Russia is using AI to plan drone strikes

Ukraine’s deputy air defense commander told Euromaidan Press that Russia may be using AI to plan wave attacks and select targets, citing Odesa as an example. This is a single-source, military-attributed claim with no independent corroboration found this round. It should be read as an assessment from an interested party in an active war, not a confirmed capability.

India: 259 nationals recruited into the Russian military since 2022

India’s Ministry of External Affairs confirmed 259 Indian nationals have been recruited into the Russian armed forces since the war began, with 69 still serving and 139 securing early discharge. Families allege coercion and deception in recruitment. The figures come from an official MEA statement via Moneycontrol; no second outlet corroboration was found this round, but the attribution is to the government body itself rather than an anonymous source.

By the Numbers

What to Do This Week

1. Save your police district’s backup number and make sure at least one phone in the household or office is on a different mobile operator. If a critical routine of yours depends on a public mobile call connecting, write down the fallback.
2. Set up a second e-ID (MinID or a BankID code device) so a BankID app failure does not lock you out of public services.
3. Check that your backups do not live with the same provider as the systems they protect.
4. Audit third-party ad and tracking tags on your sites and apps against the consent you actually collect; the Xandr fine shows intermediaries are not exempt.
5. Patch NetScaler against CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779, apply the 9 October fix for CVE-2026-107406 if you have not already, then hunt for unexpected superuser accounts and static-looking files that behave like a web shell.
6. Review single-approver authority in loan or payment-approval workflows for segregation-of-duties gaps, prompted directly by the DNB case.
7. If your organisation works with tourism or fishing-sector counterparties in Northern Norway, factor Økokrim’s assessment into counterparty due diligence.
8. Treat DNS-based gambling blocks as a compliance signal, not a technical control, when assessing exposure to platforms like Polymarket.
9. Hold the AI-targeting claim as unconfirmed until a second named outlet corroborates it, before repeating it as settled fact.

Methodology: stories drawn from open-source reporting, cross-checked against named outlets and researched directly against the local SearXNG instance where corroboration was needed. Named sources: Nkom, Digdir, Telenor, Bane NOR, Datatilsynet, Forbrukerrådet, The Moscow Times, Meduza, Reuters, AP, NBC, Al Jazeera, Cloudflare Radar, NSM, The Hacker News, watchTowr, NRK, Aftenposten, TV2, Finansavisen, Dagsavisen, E24, Adresseavisen, Nettavisen, Digi.no, EA WorldView, Euromaidan Press, Moneycontrol. Single-source and contested claims are marked in the text where they appear. Presumption of innocence applies throughout to all individuals named in connection with ongoing investigations or indictments.

Issue 037, covering 8 to 12 October 2026