Security Digest 038, audio
Listen to the audio version of this digest, voiced by Brian.
This Week in Brief
This is issue 038, weeks 42 and 43, covering 13 to 22 October. Citizen Lab showed that a targeted ad can install spyware without a click, and its report lists the Storting, Nkom and Kripos among the Norwegian networks where the same firm’s ads were shown. On 21 October PHP rushed out fixes for two critical flaws whose CVE numbers had leaked, and the websites of Digdir and OsloMet and the Feide login went offline as a precaution. Attackers who reached refrigeration controllers in about 700 French supermarkets ran some units at 50 degrees Celsius for hours. Five Norwegians were charged in Bergen with aggravated fraud against NATO’s procurement agency. Ukraine launched more than a thousand drones at Russia overnight into 18 October, the clearest sign yet that Trump’s 11 October “energy ceasefire” never held, and after talks in Oslo and St Petersburg the Kremlin said on 21 October that it was ready in principle to resume three-way talks with Kyiv and Washington in November.
Security
AdFection: zero-click spyware through ad auctions, and its ads on Norwegian state networks
Citizen Lab showed on 15 October that the Israeli firm Discover-Tech bought targeted ads that infected devices at Al Jazeera with Candiru spyware the moment an ad rendered, with no click (Citizen Lab; Al Jazeera; The Record; heise online). In Norway, the report says, they were shown on networks of the Storting, the Digitalisation Agency, Nkom, Statens IT, the police IT unit and Kripos, at two Norwegian media organisations, and on municipal networks in northern Norway near military sites; the report shows ads served there and makes no infection claim for them (Citizen Lab; ITavisen). Discover-Tech also synced user identifiers with Xandr, the Microsoft platform Datatilsynet fined NOK 92 million in issue 037.
Operational read: Citizen Lab advises blocking ads and tracking at the gateway and on work-issued devices. Norwegian public bodies and newsrooms should treat ad blocking as a security control and check DNS logs against the Discover-Tech domains in Appendix C of the report.
php2shell: PHP rushes out fixes after a leak, and Feide and Digdir go offline
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix CVE-2026-109618 and CVE-2026-109619 (severity 9.2 of 10), which can let an attacker with no login run code on servers that use PHP for web requests. The CVE numbers leaked a day earlier, and PHP brought the release forward (PHP; PHP Foundation). Amazon saw an exploit attempt against one of its honeypots on 17 October, four days before disclosure, and says the flaws are now broadly exploited; it cannot yet say whether the early attempts would have worked on real systems (Amazon). In Norway, the websites of Digdir and OsloMet went offline and Sikt shut the Feide login for under an hour; NSM said on 21 October it knew of no active exploitation (Aftenposten; VG; NSM).
Operational read: PHP also hides inside appliances, control panels and hosted platforms. Patch, restart every PHP worker, and search logs back to 17 October for PHP processes that start shells (CISA; Amazon).
Supermarket freezers pushed to 50 degrees in France, Norwegian grocers check their suppliers
Attackers with remote access to internet-facing refrigeration controllers disrupted cooling at about 700 of France’s roughly 10,000 supermarkets from the night of 11 to 12 October, France’s finance minister told lawmakers. Some Intermarché units ran at 50 degrees Celsius for six hours, stock was destroyed, fires were reported in some stores, and the Paris prosecutor’s cybercrime unit is investigating (Reuters via NBC News; SecurityWeek). France’s cyber agency ANSSI first warned of compromised Danfoss controllers, many of them end-of-life, and from 13 October also of Copeland and Dixell systems. In Norway, Coop has asked its suppliers for security clarifications, and Rema 1000, which uses Danfoss equipment, says it replaced the vulnerable components in recent years and is double-checking. NSM told TV 2 that attacks of this kind against infrastructure will probably become more common in Norway (TV 2; VG).
Operational read: these controllers are usually installed and serviced remotely by a contractor and rarely appear on IT’s asset list. Find every one on your network, take them off the open internet, put vendor access behind a jump host with multi-factor authentication, and make sure a changed setpoint or an unusually long defrost cycle raises an alarm that someone answers.
Ivanti Connect Secure: a zero-day chain that gives root and edits the logs (CVE-2026-104935)
Ivanti patched CVE-2026-104935 (severity 8.6 of 10) in Connect Secure on 13 October, two flaws that an actor Volexity tracks as UTA0576 chained with a third, still unpatched privilege-escalation bug to run code as root, tamper with logs and slip past Ivanti’s Integrity Checker Tool, exploiting them since early October (BleepingComputer; Dark Reading). CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, and Shadowserver counts more than 5,500 Connect Secure instances exposed online.
More exploited flaws on CISA’s list
CISA also added a Windows Shell flaw fixed in Microsoft’s October updates, flaws in Palo Alto’s PAN-OS management interface, Cisco’s Secure Email Gateway, AhsayCBS and Atlassian Data Center, and a Fortinet flaw that Unit 42 ties to an implant on a telecom provider’s firewalls (BleepingComputer; SecurityWeek; Unit 42). On 20 October it added four Plex Media Server flaws that chain into Plex2Shell, used from 17 October to plant cryptominers on servers older than version 1.43.3 (Plex; SecurityWeek; CISA). BeyondTrust says a suspected China-nexus group exploited a Remote Support flaw, CVE-2026-102764, from 29 August, and that its own automated triage closed the alerts as false positives, so nobody noticed until 28 September (CSO Online; The Record; Cybersecurity Dive).
Microsoft ties the ConnectWise breach to China-aligned Storm-0940
On 15 October attackers signed in to Microsoft 365 tenants as ConnectWise’s Cloud Backup apps, with the apps’ own credentials and no user sign-in. Sign-ins succeeded in more than 300 of the tenants Huntress can see, and in two the app made itself Global Administrator. On 21 October Microsoft said it assesses that Storm-0940, a China-state aligned group, was responsible and used ARTEX, an open-source framework that runs AI agents for penetration testing, to try more than 2,250 tenants. Both firms say a sign-in alone does not show data was taken. ConnectWise chief executive Manny Rivelo said containment does not remove access already established inside customer tenants (Huntress; Microsoft; Reuters).
Norway and the Nordics
Five Norwegians charged over alleged fraud against NATO’s procurement agency
Økokrim arrested five Norwegian citizens in the Bergen area on 14 October and charged them with aggravated fraud against NATO’s Support and Procurement Agency, or with aiding and abetting it, over alleged over-invoicing of more than 1 million euros for services to NATO ships in Norwegian ports between 2021 and 2025. Police in Germany and Romania searched linked companies the same day through Eurojust, which says the allegations include bribery of foreign public officials. Four were remanded in custody for two weeks on 15 October, and one denies any wrongdoing. “If NATO has been defrauded, there will be a tough crackdown,” said Senior Public Prosecutor Marianne Bender (Økokrim; Eurojust; VG; Bergensavisen). FTRCRP does not name the suspects, and the presumption of innocence applies.
Altinn’s access management fails three times, and delegation fails with it
Digdir’s status page logged three failures of Altinn’s access-management service: from 07:07 to 08:58 and from 13:17 to 14:29 on 14 October, and a short incident around 10:04 to 10:12 on 19 October. The afternoon failure on the 14th and the incident on the 19th also broke delegation through Maskinporten and Ansattporten, the services organisations use to delegate API access and employee logins. Digdir has published no cause. Separately, Digdir moves platform.altinn.no to a new IP address behind a new reverse proxy between 08:00 and 09:00 on 26 October, drops three TLS 1.2 cipher suites and the P-384 and P-521 key-exchange groups, and starts requiring SNI (Digdir).
Operational read: queue and retry calls that depend on Altinn delegation, and before 26 October check firewall allowlists, TLS settings and old clients such as Windows Server 2012 or Java 7 that talk to platform.altinn.no.
Foxtrot’s violence for hire: a London sentence and a 14-year-old’s inbox
A 19-year-old from Stavanger was sentenced at Woolwich Crown Court on 16 October to 20 years for conspiracy to murder on behalf of the Swedish Foxtrot network (NRK; TV 2). A day earlier Faktisk.no showed how short the path is: a fictitious 14-year-old reached a suspected Foxtrot recruiter with one message, the chat moved to Signal, and one job on offer paid NOK 200,000.
On 21 October two teenagers went on trial in Lillestrøm over a grenade attack on a restaurant in Strømmen in October 2025; the prosecutor says a criminal network ordered it, the two deny acting for one, and police have named Foxtrot as one hypothesis (NRK; TV 2).
Russian fishing billionaire sues a Kirkenes newspaper in London
NRK reports that Vitaly Orlov, owner of Russia’s largest fishing group Norebo, has sued The Barents Observer, an online newspaper in Kirkenes, for defamation in the High Court in London over five articles about the sanctions on Norebo. Norebo is under EU sanctions, its trawlers linked to Russian state surveillance, and banned from Norway’s economic zone, a ban it is fighting in Oslo District Court. Media lawyer Jon Wessel-Aas calls the London case a SLAPP, a lawsuit meant to silence; Orlov’s lawyers reject the label and deny the espionage allegations (NRK; The Barents Observer).
In brief: DNB and Vipps, Datatilsynet’s record, and Nkom’s risk analysis
On the morning of 19 October some DNB customers could not log in to the online and mobile bank, and Vipps users at several banks had trouble paying in the app for about an hour; neither DNB nor Vipps gave a cause (NRK; VG; Nettavisen). Datatilsynet said on 20 October that it received 282 breach notifications caused by deliberate attacks in the first half of 2026, against 103 a year earlier and the most since it began counting in 2023, much of the rise from single attacks on shared suppliers (Datatilsynet). Nkom’s annual risk analysis on 21 October calls cyber attacks the most serious threat to Norway’s digital infrastructure, traces about three in four recorded incidents to power or transmission failures, and notes that most base stations have only two to four hours of battery (Nkom).
Regulatory and Policy
Oil fund committee proposes opening the door to nuclear-weapons makers
A government-appointed committee chaired by former Norges Bank governor Svein Gjedrem recommended on 15 October that the Government Pension Fund Global be allowed to invest in nuclear-weapons producers headquartered in countries that are nuclear-weapon states under the Non-Proliferation Treaty and allied with Norway, in practice the United States, Britain and France. Lockheed Martin, Boeing, BAE Systems, Airbus and Safran are among the companies now excluded on those grounds (Norges Bank Investment Management). Reaction in the Storting split sharply, and the paused Ethics Council would permanently lose its right to recommend exclusions (E24; TV 2; News in English; Reuters).
Epstein
Swedish police investigate suspected procuring linked to Epstein’s Stockholm scholarship
Sveriges Radio’s P4 Stockholm reported on 15 October that Swedish police are running a preliminary investigation into suspected procuring linked to Jeffrey Epstein’s years of funding for a scholarship at the Stockholm School of Economics. State prosecutor Maria Hävermark confirmed the investigation, said no one has been notified of any suspicion and the school says it will cooperate with police (Sveriges Radio; TT via Göteborgs-Posten). The presumption of innocence applies.
Conflicts
The energy ceasefire collapses, and more than a thousand drones hit Russia
Trump’s 11 October “energy ceasefire” collapsed almost at once. A Russian attack on 13 to 14 October left at least 600,000 people without power in the Kyiv and Kharkiv regions (CNBC). Overnight into Sunday 18 October Ukraine launched more than 1,000 drones at Russia, setting the Petersburg Oil Terminal and the Ruchi oil depot ablaze (AP). Overnight into 19 October Russia fired 16 ballistic missiles at the Kyiv region, hitting 28 substations and leaving more than half a million people without electricity, heat and water, and Ukraine’s air force said partners gave no warning of the first wave (AP via CBC; CNN). Overnight into 22 October Russian strikes killed one person and injured 24 in Kyiv and damaged metro infrastructure on the Pivdennyi Bridge, city authorities said (Kyiv Independent; Kyiv Post), and Moscow’s mayor said 630 drones had flown toward Moscow, 163 of them shot down near the city (TASS; RTÉ).
Ukraine talks run through Oslo
On 20 October Zelensky met US envoy Steve Witkoff in Oslo, with Prime Minister Jonas Gahr Støre and Finland’s President Alexander Stubb at the table (NRK; TV 2). Witkoff met Vladimir Putin in St Petersburg the next day, and Putin’s adviser Yuri Ushakov said Russia was “in principle” ready to resume three-way talks with the United States and Ukraine in November, while saying the proposals from Oslo had little substance (AP; AFP; CBS News). Zelensky said Kyiv was in favour, and Trump said a settlement was “maybe now the closest we’ve been” (RTÉ; Ukrainska Pravda). On his way back to the US, Witkoff stopped at Gardermoen, where Støre met him aboard his plane (NRK; TV 2).
By the Numbers
| Figure | Detail |
|---|---|
| almost 200,000 | Websites and apps that carried Discover-Tech’s ads, March to June (Citizen Lab) |
| about 700 | French supermarkets hit by the refrigeration attack, of roughly 10,000 |
| more than 300 | Microsoft 365 tenants Huntress saw the attacker sign in to through ConnectWise Cloud Backup |
| more than 1 million euros | Alleged over-invoicing of NATO’s procurement agency, Bergen case |
| 3 | Altinn access-management failures on Digdir’s status page, 14 and 19 October |
| 282 | Breach notifications from deliberate attacks to Datatilsynet, first half of 2026 (103 a year earlier) |
| 4 | Plex Media Server flaws added to CISA’s list on 20 October |
| 20 years | Sentence for the Stavanger teenager in the Foxtrot murder plot, minimum 13 |
| NOK 200,000 | Pay offered for one Foxtrot “job” in the Faktisk.no test |
| at least 600,000 | Ukrainians left without power after the 13 to 14 October strikes |
| more than 1,000 | Ukrainian drones launched at Russia overnight into 18 October |
| 1 killed, 24 injured | In Kyiv, overnight into 22 October (city authorities) |
| 630 | Drones Moscow’s mayor said flew toward Moscow overnight into 22 October |
What to Do This Week
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution’s patched package, restart every PHP worker, and check web logs from 17 October for PHP processes that start shells.
- Block ads and trackers on work devices and at the gateway for staff at risk of targeting, and check your DNS and proxy logs against the Discover-Tech domains in Citizen Lab’s report.
- Patch or isolate Ivanti Connect Secure for CVE-2026-104935 now. The privilege-escalation flaw in the same chain is still unpatched, so if patching lagged, assume compromise and pull logs from an out-of-band source.
- Patch PAN-OS for CVE-2026-0322 and keep its management interface off the internet, patch Cisco Secure Email Gateway for CVE-2026-76519, and patch any Fortinet device still exposed to CVE-2025-61624.
- Patch self-hosted BeyondTrust Remote Support for CVE-2026-102764, AhsayCBS with the reissued hotfix for CVE-2026-105133 and CVE-2026-105134, and Atlassian Data Center for CVE-2026-21589.
- If you use ConnectWise Cloud Backup for Microsoft 365, keep its app connections disabled until ConnectWise says to reconnect, preserve evidence before deleting anything, and review the apps’ sign-ins, added credentials and role changes from 15 October.
- Update Plex Media Server to version 1.43.3 or later; if an exposed server ran an older version, rebuild it, change the Plex password and turn off Remote Access if unused.
Methodology: stories drawn from open-source reporting and primary documents, cross-checked against named outlets and researched directly against the local SearXNG instance where corroboration was needed. Named sources: Citizen Lab, ITavisen, CISA, Plex, Datatilsynet, Al Jazeera, The Record, heise online, Reuters, AP, NBC News, SecurityWeek, ANSSI, BleepingComputer, Dark Reading, CSO Online, Cybersecurity Dive, Unit 42, Huntress, Shadowserver, TV 2, VG, NRK, E24, Nettavisen, Faktisk.no, Bergensavisen, News in English, Økokrim, Eurojust, Digdir, Norges Bank Investment Management, Sveriges Radio, TT, Göteborgs-Posten, CNBC, CNN, CBC, Kyiv Independent, PHP, PHP Foundation, Amazon, Microsoft, Aftenposten, NSM, Nkom, AFP, CBS News, RTÉ, Ukrainska Pravda, TASS, Kyiv Post, The Barents Observer. Single-source and contested claims are marked in the text where they appear. Presumption of innocence applies throughout to all individuals named in connection with ongoing investigations or indictments.
Issue 038, weeks 42 and 43, covering 13 to 22 October 2026