SonicWall SMA 1000 Flaw Draws Attacks, GitLab Fixes a CVSS 10.0 Bug, and Food Retail Is Hit Twice

Attackers began probing a maximum-severity SonicWall SMA 1000 flaw two days after disclosure, and GitLab has fixed a CVSS 10.0 code-execution bug. Food retail took two blows: hijacked refrigeration controllers spoiled stock at hundreds of French supermarkets, and Ahold Delhaize took systems offline. On the compliance side, Norway issued its largest data protection fine, and iRhythm patients are receiving breach letters.

Priority at a glance

SonicWall is under confirmed exploitation attempts. GitLab's bug isn't yet reported exploited but is maximum severity on a server class that holds source code and secrets. The French refrigeration attack and the Ahold Delhaize intrusion have both already happened and are in the response and disclosure phase.

1. SonicWall SMA 1000: maximum-severity SSRF under attack (CVE-2026-102255, CVSS 10.0)

Where this stands. We've covered this flaw since SonicWall's patch shipped, through confirmation of its CVSS 10.0 score and now-ongoing exploit attempts. The facts remain the pre-authentication SSRF flaw lets an unauthenticated attacker make the appliance send requests on their behalf and reach internal functions, and Defused and Previdian report exploitation attempts since October 8, with Previdian logging 135.

Who is affected. SMA 1000 models 6210, 7210 and 8200v on firmware 12.4.3-03526 or older, or 12.5.0-02952 or older. Fixed builds are 12.4.3-03670 and 12.5.0-03082, which also fix CVE-2026-102256 (code execution, CVSS 7.8) and two lesser flaws. SMA 100 and firewall SSL-VPN are not affected.

Severity and context. SonicWall's advisory still says there's no evidence of exploitation, and the flaw is not yet in CISA's Known Exploited Vulnerabilities (KEV) catalog. CISA added four other SMA 1000 flaws to KEV this year, on July 14 and September 2.

What to do. — click a step to check it off

1. Upgrade to 12.4.3-03670 or 12.5.0-03082 now; SonicWall lists no workaround.
2. Review appliance logs since October 6 for unusual requests and unexpected connections to internal hosts.
3. If anything looks wrong, reset credentials and sessions for users of the appliance and hunt for lateral movement.

2. GitLab: unauthenticated code execution in CI/CD (CVE-2026-97229, CVSS 10.0)

What happened. GitLab's October 12 patch release fixes CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. GitLab says an unauthenticated user could run code on the server through a crafted regular expression in a CI/CD configuration. It's rated CVSS 10.0.

Who is affected. Self-managed Community and Enterprise Editions 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com is already patched and Dedicated customers need not act. The release also fixes five high-severity issues.

Severity and context. No exploitation has been reported, but a GitLab path traversal flaw (CVE-2026-85706) reached CISA's KEV catalog on September 11. GitLab servers hold source code and deployment secrets, so a compromise reaches far beyond one server.

What to do. — click a step to check it off

1. Upgrade to 19.4.2, 19.3.5 or 19.2.8, internet-facing instances first.
2. Review recent CI/CD configuration changes and runner activity, and rotate CI/CD variables and tokens if anything looks wrong.

3. Hijacked refrigeration controllers spoil food at hundreds of French supermarkets

What happened. Overnight into Sunday, October 11, attackers took remote control of supermarket refrigeration across France, switching units into defrost and warming display cases. Stores discarded fresh and frozen food. On October 12, CERT-FR (alert CERTFR-2026-ALE-012) said it's aware of numerous compromises of Danfoss AK-SM and AK-SC series controllers. The Paris prosecutor has opened an investigation.

Who is affected. Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc have confirmed impact; French media put the total at roughly 250 to 350 stores. Maintenance contractors often manage these controllers remotely, and reporting indicates many were older models that no longer receive updates.

Severity and context. No vulnerability, entry method, indicators of compromise or claim of responsibility has been published.

What to do. This applies to any building or operational technology (OT) controller, not only grocers. — click a step to check it off

1. Take management interfaces off the internet, or restrict them to trusted IP addresses through a managed VPN, as CERT-FR advises.
2. Require contractors to use a single, logged, multi-factor remote-access path.
3. If compromise is suspected, follow CERT-FR's steps: limit access, factory reset, patch, rotate secrets, review accounts and reconfigure.
4. Replace end-of-life controllers, and keep temperature alarms independent of the controller.

4. Ahold Delhaize takes systems offline after a network intrusion

What happened. On October 12, Ahold Delhaize said it's dealing with a security issue in its network and has taken some systems offline as a precaution. Stores remain open, according to the company.

Who is affected. The group runs Food Lion, Stop & Shop, Giant Food and Hannaford in the US, and Albert Heijn and Delhaize in Europe. Media report outages of websites, apps and online ordering in the Netherlands and Belgium, and US staff unable to reach schedules and pay stubs. The company has not confirmed these reports, named an attacker or said whether data was taken.

What to do. — click a step to check it off

1. Customers and employees should expect incident-themed phishing (fake refunds, orders or payroll messages) and use the brand's app or site directly.
2. Suppliers should confirm any bank-detail change by phone using a number on file.

Compliance and personal data

This section is general information, not legal advice.

Also notable

Touchpoint's Take

The common thread is systems nobody watches daily: a remote-access appliance, a self-hosted code server and a contractor-run refrigeration controller. SonicWall's two-day gap from disclosure to exploitation attempts shows that patch windows measured in weeks no longer fit internet-facing systems.

The French attack shows the cost of reachable, unsupported OT: physical harm, visible to every shopper, and a third-party failure as much as a technical one. Behind the compliance items are people: patients whose insurance details were stolen, and app users whose most sensitive details were shared without valid consent.

If you would like help assessing your exposure to today's issues or your notification readiness, the Touchpoint Security team is available to talk.

Sources

• SonicWall: Product Notice SNWLID-2026-0017, SMA 1000 Series affected by multiple vulnerabilities
• Cyber Security Agency of Singapore: Critical vulnerability in SonicWall SMA1000 Series (AL-2026-137)
• Previdian: CVE-2026-102255 telemetry
• CISA: Known Exploited Vulnerabilities catalog (official data feed)
• The Hacker News: Critical SonicWall SMA 1000 flaw targeted in 135 exploitation attempts after patch
• SecurityWeek: Critical SonicWall vulnerability exploited days after disclosure
• GitLab: Patch release 19.4.2, 19.3.5, 19.2.8
• BleepingComputer: GitLab warns of max severity code execution vulnerability
• CERT-FR: CERTFR-2026-ALE-012, Security incident targeting Danfoss AK-SM and AK-SC series
• BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets
• The Record: Cyberattack disrupts refrigeration at hundreds of French supermarkets
• The Hacker News: Attackers heat French supermarket fridges by hijacking Danfoss controllers
• SecurityWeek: Refrigeration controller hack spoils food across European supermarkets
• Ahold Delhaize: Ahold Delhaize takes precautionary measures following cybersecurity incident
• BleepingComputer: Retail giant Ahold Delhaize takes systems offline after cyberattack
• iRhythm: Notice of data event
• SEC EDGAR: iRhythm Holdings Form 8-K, Item 1.05 (June 2026)
• SecurityWeek: iRhythm data breach impacts at least 360,000 people
• BleepingComputer: Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
• Microsoft: Windows message center (lifecycle reminders)
• SecurityWeek: $86 million crypto heist linked to Ledger signer hardware implant
• BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts
• SSD Secure Disclosure: LG webOS sync-demo pre-auth RCE