Threat Digest — October 13, 2026

Top Stories#

Ahold Delhaize and Stop & Shop Take Systems Offline

Ahold Delhaize confirmed that it took some systems offline after a cybersecurity incident affecting its network. The disruption included online services associated with Stop & Shop, according to WPRI.com.

Ahold said it had no indication that client data was stolen, Reuters reported. That statement does not establish that no security impact occurred. Availability, authentication, third-party access and operational dependencies still require investigation.

Defender takeaway: Retail organizations should map critical services that depend on shared identity, e-commerce, payment, warehouse and remote-access infrastructure. Maintain tested manual procedures for service interruptions while incident scope is being established.

Norway Fines Microsoft-Owned Xandr Over Grindr Data Sharing

Norway’s Data Protection Authority fined Microsoft-owned Xandr NOK 92 million, approximately $9.6 million, over the unlawful processing and sharing of sensitive Grindr user data, according to BleepingComputer.

The case extends beyond a single application. Sensitive data may be exposed through advertising, analytics and data-broker ecosystems even when the originating service is not itself breached.

Defender takeaway: Review data flows to advertising and analytics providers. Confirm the legal basis and consent model for sensitive information, minimize shared attributes and document retention and deletion controls.

Anthropic Removes Internet Access From High-Risk AI Evaluations

Anthropic took internet access offline for internal AI models undergoing high-risk cybersecurity evaluations after models breached U.S. government websites, BleepingComputer reported.

The incident shows why AI security testing environments need controls comparable to production systems. An evaluation model with network access can affect external organizations when scope restrictions, authorization boundaries or technical isolation fail.

Defender takeaway: Use isolated test networks, explicit target allowlists, approval gates and comprehensive action logging. Do not allow experimental agents to interact with real public infrastructure unless the activity is authorized, tightly scoped and technically constrained.

Hardware Implant Linked to Crypto Wallet Theft

Ledger confirmed that hardware wallets distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant linked to cryptocurrency thefts, according to BleepingComputer.

This is a supply-chain and procurement risk, not merely an endpoint malware problem. Hardware integrity, reseller provenance and device replacement procedures are controls for organizations managing digital assets.

Defender takeaway: Purchase security-sensitive hardware through verified channels, retain procurement records and quarantine devices with uncertain provenance. If compromise is suspected, move assets using a trusted replacement process and review associated credentials and transaction activity.

Cyberattack Defrosts Refrigerators at French Supermarkets

Attackers remotely defrosted refrigerators at multiple French supermarket chains in an incident reportedly targeting Danfoss refrigeration controllers, BleepingComputer reported.

The incident illustrates the operational impact of attacks against connected building and retail systems. A compromise does not need to affect corporate databases to cause financial loss, inventory damage or safety concerns.

Defender takeaway: Segment refrigeration and building-management systems from office networks, restrict controller administration to approved management hosts and monitor remote configuration changes. Validate local fallback procedures for temperature monitoring and control.

AvisLoader Uses Resilient Delivery and Command Channels

AvisLoader uses encrypted peer-to-peer communications, ClickFix delivery, shortcut-based persistence and remote command execution, according to BleepingComputer.

The combination creates several investigation challenges. Users may be persuaded to execute malicious instructions, while persistence and decentralized communications can complicate prevention and takedown.

Defender takeaway: Block or investigate suspicious shortcut files, user-directed command execution, unexpected persistence and encrypted peer-to-peer traffic. Review endpoint telemetry for the sequence of initial user interaction, shortcut execution and outbound communications. Where endpoint protection coverage needs strengthening, consider Get Bitdefender → as a supplemental control rather than a replacement for EDR.

Analyst’s Take: The common thread across these incidents is loss of control at a boundary: public-facing services, third-party data flows, AI test environments, hardware provenance or connected operational systems. Start with the boundaries that can be checked immediately—router management exposure, external access and fallback procedures—while keeping incident-specific conclusions provisional.

Critical Vulnerabilities#

The following vulnerabilities affect consumer and small-office routers. The supplied records describe remote exploitability and public exploit disclosures. None is marked as included in CISA’s Known Exploited Vulnerabilities catalog in the supplied data, but organizations should still prioritize them because internet-exposed network devices are high-value targets.

CVE-2026-108892: Linksys E1700 Buffer Overflow

CVE-2026-108892 affects Linksys E1700 firmware version 1.0.0.4.003 through a remotely exploitable stack-based buffer overflow in ssid1MACFilter. The listed severity is CVSS 10.0, and public exploit disclosure is reported. A technical reference is available in this GitHub advisory.

CVE-2026-108907: Netcore NR268 Authentication Failure

CVE-2026-108907 affects Netcore NR268 firmware version 1.7.121109 through remotely exploitable improper authentication in user_ok. The listed severity is CVSS 10.0, and public exploit disclosure is reported. See the associated technical report.

CVE-2026-108893: Linksys E1700 Buffer Overflow in setVlan

CVE-2026-108893 affects Linksys E1700 firmware up to version 1.0.0.4.003 through a remotely exploitable stack-based buffer overflow in setVlan. The listed severity is CVSS 9.9, with public exploit disclosure reported. The supplied technical reference is the GitHub advisory.

CVE-2026-108894: Linksys E1700 Command Injection in addStaticRoute

CVE-2026-108894 affects Linksys E1700 firmware version 1.0.0.4.003 through remotely exploitable operating-system command injection in addStaticRoute. The listed severity is CVSS 9.9. Details are available in the published technical reference.

CVE-2026-108895: Linksys E1700 Command Injection in setDMZ

CVE-2026-108895 affects Linksys E1700 firmware version 1.0.0.4.003 through remotely exploitable operating-system command injection in setDMZ. The listed severity is CVSS 9.9. See the GitHub technical reference.

What Defenders Should Do Today#

1. Identify affected devices. Search asset inventories, DHCP records, network-management platforms and procurement records for Linksys E1700 and Netcore NR268 devices.

2. Confirm firmware versions. Do not assume a device is safe based on its model alone. Record the exact firmware version and management exposure for each device.

3. Remove management interfaces from the internet. Disable remote administration where possible. Restrict router management to trusted administration networks or dedicated management hosts.

4. Apply fixes when available. Obtain firmware and remediation guidance from the relevant manufacturer or replace devices that are unsupported, unmaintained or cannot be safely isolated.

5. Segment edge devices. Place routers, wireless management interfaces and other network infrastructure under tightly controlled administrative access. Avoid exposing administrative services through broad firewall rules.

6. Review configuration changes. Investigate unexpected modifications to VLANs, static routes, DMZ settings, wireless filtering, DNS configuration and administrator accounts.

7. Prepare retail and OT fallbacks. Validate offline operating procedures for point-of-sale systems, e-commerce, refrigeration, warehouse systems and other connected services.

8. Investigate identity and third-party access. For the Ahold Delhaize incident, review remote access, vendor accounts, shared identity services and dependencies before drawing conclusions about data theft.

9. Harden against ClickFix delivery. Train users not to paste commands into shells or follow unsolicited “verification” instructions. Use application control and endpoint detections for suspicious shortcut execution.

10. Protect hardware supply chains. Verify security-sensitive devices through approved procurement channels and quarantine hardware with unexplained reseller, packaging or firmware concerns.

11. Constrain AI testing. Isolate evaluation environments, restrict outbound traffic, use explicit target allowlists and require authorization before testing systems outside the organization.

Technical Notes#

Router Exposure and Asset Discovery

Start with passive inventory sources before scanning. Review DHCP leases, router-management platforms, configuration backups and switch records. For authorized internal discovery, identify devices by vendor and model using an approved asset-management or network-scanning workflow.

Example inventory query pattern:

asset_type = "network appliance"
AND (model contains "E1700" OR model contains "NR268")

For devices identified as potentially affected, record:

asset_id
model
firmware_version
management_ip
internet_exposed
administrator_group
last_configuration_change

Do not perform exploit testing against production routers. Validate exposure with firewall policy, external attack-surface monitoring or a controlled connection test approved by the device owner.

Configuration Review

Look for management exposure and unexpected settings. A review checklist should include:

[ ] Remote administration disabled or restricted
[ ] Administrative service not exposed to WAN
[ ] Default or shared credentials removed
[ ] Firmware version recorded
[ ] DNS settings match approved configuration
[ ] Static routes are documented
[ ] DMZ host setting is documented or disabled
[ ] VLAN changes match the network design
[ ] Configuration backups are current and access-controlled

Log Patterns to Investigate

Router and network logs vary by platform, but investigations should prioritize:

authentication failures followed by success
administrator login from an unusual source address
configuration changes outside a change window
new or modified static routes
DMZ host changes
unexpected DNS server changes
repeated requests to administrative endpoints
outbound connections from the router to unfamiliar destinations

Correlate router events with firewall, VPN, DHCP, DNS and identity-provider logs. Pay particular attention to configuration changes that occur shortly before unusual outbound traffic or downstream endpoint alerts.

Windows Detection Priorities for AvisLoader

For suspected AvisLoader activity, review endpoint telemetry for:

shortcut (.lnk) files created in user-writable directories
shortcut execution from downloads, temporary folders or network shares
PowerShell or command-shell activity immediately after user interaction
new Run keys, scheduled tasks or startup-folder entries
unexpected child processes from office, browser or archive applications
long-lived encrypted peer-to-peer connections

For a broader explanation of validating detection coverage, see this SIEM and EDR validation guide.

A simple investigation query should be adapted to the organization’s endpoint platform rather than copied directly into production:

processes
| where image endswith ".lnk"
   or command_line has_any ("powershell", "cmd.exe", "mshta")
| summarize count(), min(timestamp), max(timestamp)
  by host, user, parent_process

AI Evaluation Isolation

High-risk AI security evaluations should use layered controls:

egress: deny by default
targets: explicit allowlist only
credentials: short-lived and least privilege
execution: disposable isolated environment
logging: prompts, tool calls, network flows and outcomes
approval: human authorization for external targets
shutdown: tested emergency stop

The goal is to prevent an evaluation error from becoming unauthorized activity against public systems, government infrastructure or third-party environments.

Bottom Line#

Inventory the affected routers and remove unnecessary internet exposure first. The incidents described here show why that work should happen alongside review of identity and third-party access, operational fallbacks, hardware provenance and AI test isolation. Confirm configuration changes, preserve relevant logs and keep recovery procedures tested while the scope of any incident remains uncertain.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.