This week's cyber to-do list

Meltdown: hackers heated 700 French supermarkets' freezers to 50°C

"Login admin, password today's date" went round this week.

• Fridge attack in France. Non-IT List every machine a supplier can reach from outside. IT Find old Danfoss and other controllers on client networks.
• Ivanti remote access under attack. IT Update by Friday.
• Windows October updates. IT Confirm they installed on every PC.

VRT NWS: cyberattack hits supermarket cooling in France, Comeos on Belgium (12 Oct 2026) → https://www.vrt.be/vrtnws/nl/2026/10/12/cyberaanval-treft-koelinstallaties-van-supermarkten-in-frankrijk/

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: I keep a list of my own parts. It is short, and until this week it did not have 'fridge' on it either.

Delhaize pulled its own plug. Who pulls yours?

Why it held.

Non-IT Write your incident plan this week, on one page. First, the response: who may switch systems off (a name and a deputy), who you call (IT partner, insurer, the CCB), who tells customers and staff what. Then the fallbacks: for each system, can you still run the business if a hacker takes it out for a day?

AP: French government on the fridge attack, with the Ahold Delhaize statement (13 Oct 2026) → https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/

Best before Friday: three updates for your IT partner

In plain words:

• Ivanti Connect SecureFlaw: CVE-2026-104935, authentication bypass, exploitedFix: 25.1.3.0 and 22.8R2.5; 22.7R2.14 and earlier not affected (Ivanti's CVE record)Do by: Friday 16 OctoberWho checks: IT or whoever manages the box
• WindowsFlaw: CVE-2026-96951, Mark of the Web bypass, exploitedFix: October cumulative update: KB5127648 (Windows 11 24H2 and 25H2), KB5126653 (23H2), KB5126657 (Windows 10 22H2)Do by: this weekWho checks: IT on every PC
• FortiGate VPNFlaw: no new CVE: stolen logins, 969 in use (CCB)Fix: the week-41 password reset, after checking the full account listDo by: nowWho checks: IT
• Danfoss controllersFlaw: AK-SM 800A: CVE-2025-41450, 41451, 41452Fix: R4.2 and R4.3.1; AK-SM800 and AK-SC355 get no updates: replace, or off the internetDo by: this monthWho checks: Non-IT Ask your installer what they fixed

CISA alert: Ivanti Connect Secure actively exploited (13 Oct 2026) → https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

New in ECP: score one odd part of your company on its own

You (or whoever runs ECP for you):

• Set that part apart, by name. Type a word that appears in those devices' names, and ECP groups them and shows how many it found.
• Score a risk for that part on its own. Ransomware on hosted phone systems is not ransomware on office laptops. The group gets its own score and owner; the rest of the company keeps its old score, and a device added later lands in the rest, so nothing drops off the register.
• Accept a risk, and ECP proposes a matching exception on its controls, ending no later than the review date you set. The risk's owner or an admin has to confirm it, and the review date tells them when to look again. Under CyFun it shows as a deviation, not as done.

See everything that shipped → https://easycyberprotection.com/changelog/