An operational technology attack against French supermarket refrigeration systems exposes a critical vulnerability for small businesses: internet-connected equipment like HVAC, cameras, and point-of-sale terminals can become entry points for attackers if not isolated from your main network. This week brings five separate threats requiring immediate action, from GitLab code repositories to PDF processing and software supply chains.
Hackers Sabotage French Supermarket Refrigerators, GitLab Issues Maximum Severity Patch, and PDF Processing Tools at Risk
In today's cybersecurity update for October 13th, 2026, small business owners face several critical threats requiring immediate attention:
FRENCH SUPERMARKET REFRIGERATION ATTACK: Hackers compromised internet-connected refrigeration systems across more than 500 French supermarkets, heating units to 50°C and destroying fresh and frozen food worth millions of euros. The attack targeted Danfoss temperature control systems at chains including Intermarché, Netto, and Leclerc. This incident demonstrates that operational technology including HVAC, security cameras, and point-of-sale systems can be exploited when connected to the internet without proper network segmentation. Business owners should work with vendors to isolate connected equipment from main business networks. (Sources: Malwarebytes, GBHackers)
GITLAB CRITICAL VULNERABILITY (CVE-2026-97229): GitLab patched a maximum-severity flaw (CVSS 10.0) that allows unauthenticated attackers to execute code on GitLab servers. The vulnerability affects both Community Edition and Enterprise Edition. Organizations using GitLab for software development or project management must verify updates have been applied immediately to prevent code repository takeover. (Source: Security Affairs)
GHOSTSCRIPT PDF VULNERABILITY (CVE-2026-39919): A critical flaw (CVSS 9.8) in Ghostscript versions before 10.08.0 allows attackers to execute code via malicious PDF files. Any system that automatically processes PDFs for document management, thumbnail generation, or conversion is at risk. Businesses accepting PDFs from customers or vendors should update immediately and implement file screening before processing. (Source: Cyber Security News)
npm PACKAGE HIJACKING FLAW: A vulnerability in npm's Trusted Publishing mechanism allows attackers to hijack legitimate software packages without compromising credentials. Over 1,500 packages with 10+ million downloads were potentially exposed through reclaimed GitHub repository names. Businesses with in-house developers should review package dependencies and verify original authorship, especially for automated update systems. (Sources: GBHackers, Cyber Security News)
LG SMART TV VULNERABILITIES: LG webOS smart TVs contain three vulnerabilities that can be chained to grant attackers on the local network full root access without a PIN or user interaction. Businesses using LG TVs in conference rooms, lobbies, or for digital signage should apply the latest firmware updates. Compromised TVs can serve as entry points for lateral network movement. (Source: The Hacker News)
These incidents highlight the expanding attack surface small businesses face, from operational technology to software supply chains and IoT devices.
Why does an operational technology attack threaten your business network?
The French supermarket incident targeted Danfoss temperature control systems connected to the internet without network segmentation, allowing attackers to heat refrigeration units and destroy inventory. Professional services and manufacturing firms run identical risks with HVAC, security cameras, and POS systems. Separately, GitLab released a maximum-severity patch (CVE-2026-97229, CVSS 10.0) for a code execution flaw. Ghostscript PDF processing carries a critical vulnerability (CVE-2026-39919). npm package hijacking affects over 1,500 libraries with 10 million downloads. LG smart TVs in conference rooms can grant attackers local network root access. The single most important action: audit all internet-connected devices, isolate operational technology from your main business network, patch GitLab and PDF tools immediately, and verify software package origins with your development team.
Key takeaways
- Isolate internet-connected equipment (HVAC, cameras, POS, TVs) from your main business network to block lateral movement after breach.
- Patch GitLab (CVE-2026-97229) and Ghostscript (CVE-2026-39919) immediately; both execute code through their respective attack vectors.
- Review npm package dependencies with your development team and verify authorship to block supply chain compromise.
- Update LG TV firmware if used for signage or in meeting rooms; compromised TVs serve as network entry points.
Frequently asked questions
Do I need to worry about refrigeration systems if I'm not in food retail?
Yes. The attack method applies to any internet-connected operational technology: HVAC systems in offices, security camera networks, and POS terminals. Network segmentation protects all businesses from this type of breach.
What does maximum-severity mean for GitLab?
CVE-2026-97229 has a CVSS score of 10.0, meaning an attacker can execute code on your server and take control of your source code repository without credentials. Apply the patch within hours, not days.
Who should check npm packages in our environment?
Your development team or managed IT provider should review all package dependencies in automated update systems and verify the original maintainer hasn't changed. Hijacked packages may contain malware.
Why does a smart TV matter for security?
LG webOS TVs on your local network can be compromised without a password, giving attackers a foothold to move laterally into your business systems. Keep firmware current and consider separating conference room networks.
Sources
- https://www.malwarebytes.com/blog/news/2026/10/hackers-heat-up-supermarket-fridges-spoiling-food-across-france
- https://gbhackers.com/hackers-target-hundreds-of-french-supermarkets/
- https://securityaffairs.com/200868/security/gitlab-patches-max-severity-vulnerability-cve-2026-97229.html
- https://cybersecuritynews.com/critical-ghostscript-flaw/
- https://gbhackers.com/npm-packages-hijacked/
- https://cybersecuritynews.com/npm-trusted-publishing-flaw/
- https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].