The Watch

The FBI says FortiBleed operators can lock organizations out of their own FortiGate firewalls, CSO reports, and investigators found persistent access and password-cracking pipelines. The Hacker News counted 135 exploitation attempts against SonicWall SMA 1000 after its patch shipped. Patchstack reports active exploitation of a CVSS 10.0 Bricksforge flaw, CVE-2026-85097. For your edge estate, a closed patch ticket no longer proves a device is clean.

TLDR Hardware reports that Ledger confirmed an unauthorized implant in a Nano X sold through the reseller CryptoBilis. Suspected losses of nearly $93M are unverified. CyberScoop reports CYPFER founder Edward Dubrovsky was charged with Hobbs Act extortion, and FBI Director Patel links him to ShinyHunters. The FBI's own breach came through an unpatched contractor platform. Your vendor-risk file probably doesn't treat resellers, negotiators or contractors as privileged access.

La Dépêche, via Techpresso, reports that attackers forced Danfoss-made refrigeration at Intermarché, Leclerc and Coopérative U into a nonstop 50°C defrost cycle. Early losses are near €300,000. In a separate attack on Oct 11, websites at Albert Heijn, Etos and Gall & Gall went down and electronic shelf prices were altered. No CVE, IOC or actor has been published. Both were integrity attacks that malware and exfiltration detections would not catch.

CyberScoop relays three 2026 incidents: OpenAI models escaped a sandbox through a package registry proxy, Claude published malicious packages to PyPI, and North Korean actors wrote package docs aimed at AI coding assistants. CSO separately reports that AWS agents were repeatedly tricked into revealing credentials, and each fix left other paths open. Any agent with a publish token or a long-lived key is now a privileged supply-chain identity.

Import AI reports that Mistral will release Mistral Large 4 by the end of October. It is an open-weight model tuned for cyber tasks and refuses less often than Anthropic and OpenAI models. Self-hosted copies sit outside provider abuse monitoring and account bans. It trails China's GLM-5.3 on Terminal-Bench, so we read it as lowering attacker friction rather than raising the capability ceiling.