THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
Ahold Delhaize has confirmed malicious activity behind disruptions across its grocery brands and filed a police report. Stores remain open, but online ordering, digital discounts and customer services have not fully recovered. Albert Heijn expects deliveries to restart gradually on October 23.
Cybersecurity
AT A GLANCE
Rapid7 says attackers compromised a Citrix NetScaler appliance in early October by chaining CVE-2026-88771 and CVE-2026-88779, achieving root execution. The firm found web shells, multiple persistence methods, internal reconnaissance and evidence that configuration files and key material were staged and exfiltrated; it says the activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT campaign.
What changed The later recovered dropper expanded beyond the earlier version with reverse access, relay installation and high-availability recovery, indicating a broader effort to preserve control during the intrusion.
Why it matters For responders handling an affected NetScaler, a restart or removal of individual scheduled tasks is not evidence of eradication: the implant could recreate its execution hooks.
Rapid7 ↗BeyondTrust confirmed exploitation of CVE-2026-102764, a critical authentication bypass affecting Remote Support versions 26.2.3 and earlier unless patched; Rapid7 reports that two compromises occurred in August. Mandiant described arbitrary file uploads, web-shell and tunneling deployment, attempted credential-vault extraction, persistence and log deletion, and attributed the activity to suspected PRC-nexus espionage actor ARMORY CASTLE. Rapid7 urges emergency patching and investigation for prior compromise, noting that patching does not remove persistence.
What changed The October disclosure exposed a substantially older incident window: both known compromises date to August 29, so an investigation limited to activity around disclosure would miss their reported start.
Why it matters Remote Support customers need to separate vulnerability remediation from incident recovery. Suspected compromise can require a clean rebuild and credential rotation, while hosted customers also need credential and configuration reviews.
What to watch next Rapid7 expects an authenticated exposure check in its October 20 content release; the source does not confirm that the check has shipped.
Rapid7 ↗LESS NOISE. MORE CONTEXT.
ConnectWise suspended Cloud Backup and related services after attackers used a compromised Cloud Backup application credential to access customer Microsoft 365 accounts. Huntress confirmed unauthorized access to at least 162 tenants and reported more than 300 successful sign-ins among nearly 1,000 accounts targeted, while saying it has not established whether the activity came from one operator. ConnectWise says its investigation is ongoing, backups remain encrypted and isolated, and customers should review accounts for unauthorized access changes.
What changed After discovering the incident on October 15, ConnectWise disabled seven application identities and invalidated shared credentials on October 17. Those actions did not necessarily end access through previously issued tokens.
Why it matters For MSPs and their customers, vendor-side shutdown is not sufficient containment: attacker-created access inside individual tenants must be identified and removed locally.
What to watch next Service restoration remains an open operational question. As of October 19, customers could neither run scheduled backups nor restore data, and ConnectWise had no restoration time to provide.
HelpNet Security ↗A Sapio Research survey of 700 IT and security decision-makers found that 95% had seen frontline workers use login workarounds such as sharing credentials or staying signed in. Sixty-two percent reported a confirmed or suspected attempt to abuse account recovery, password reset or unlock procedures; 28% reported confirmed attempts. The survey also found passkeys in use at 28% of organizations, with 45% of those retaining passwords alongside them.
Why it matters In shared-workstation environments, login workarounds weaken accountability: actions recorded against one employee’s account may actually belong to a colleague using the same session or password.
HelpNet Security ↗The research abstract describes a CAPTCHA-solving system combining a fine-tuned YOLOv8 detector with a vision-language model and confidence-based routing. It reports 85.4% overall accuracy across 16 classes and says VLM-generated answers serve as training labels, allowing the detector to learn new categories and recover after image perturbations. In a simulated year-long arms race, the solver reportedly recovered from each monthly round of perturbations.
What changed Within the experiment, image perturbations reduced detector accuracy to zero, but VLM-generated labels enabled recovery—a measured transition from failure to adaptation, not a demonstrated change in live services.
Why it matters For operators relying on visual CAPTCHA perturbations, the experiment suggests that defeating a fixed detector may provide only temporary resistance when a second model can supply labels for recovery.
Schneier Blog ↗