Published Tuesday, October 20, 2026 at 09:05 AM PT
BLUF
The supply chain is a goddamn dumpster fire and everyone knows it. ClickFix is weaponizing DLL side-loading against Siemens installations right now, OVHcloud’s own build pipeline got compromised to distribute secret-stealing malware, and APT28 just walked through a NATO shipbuilder’s front door like it had a key. Meanwhile Iran and Israel are playing nuclear chicken while your calendar invite sits in Quarantine with a bomb in it. [HIGH CONFIDENCE across all sections]
CYBER
Siemens CVE-2026-110936 / ClickFix Active Exploitation — The gift that keeps on giving. Siemens Software Center (the desktop app that should be airgapped but never is) has a DLL side-loading hole, and attackers are actively deploying it in ClickFix campaigns to land remote access trojans. This isn’t theoretical—it’s live in the wild right now, hitting enough boxes that Siemens had to issue public confirmation. [SOC Prime, Help Net Security] [HIGH CONFIDENCE]. The irony is delicious: a software management app designed to reduce attack surface became the attack surface. Ferengi Rule of Acquisition #164 applies here—never spend your own security budget when you can spend someone else’s, and vendors have been cutting corners on DLL validation since the Clinton administration. [MODERATE CONFIDENCE on widespread exploitation scale, pending telemetry]
OVHcloud CLI Backdoored on GitHub — Five Releases Compromised — Attackers hijacked five published releases of the OVHcloud CLI tool and baked in secret-stealing malware. Developers who updated their dependency got a credential harvester that targeted SSH keys, API tokens, and cloud creds. This is the second developer-tools poisoning in the ‘verse this month—the attack surface isn’t the cloud, it’s the tool you use to access the cloud. [The Hacker News, BleepingComputer] [HIGH CONFIDENCE]. Anyone running a supply chain security tool that didn’t catch this before it hit production should be having a very uncomfortable conversation with their boss.
ConnectWise Cloud Backup Still Offline After Security Incident — The managed-services software platform that millions of MSPs rely on got popped, and the cloud backup system is still down resetting credentials. That’s the definition of “slow motion catastrophe”—the breach happened, and it’s taking days to restore normal operations. [The Hacker News] [HIGH CONFIDENCE]. Expect a wave of downstream incidents as MSPs discover that customers’ backup windows got compressed or skipped.
Revolut Global Outage — The fintech’s payment rails went down hard, disrupting transactions across the US and Europe. [BleepingComputer] [MODERATE CONFIDENCE on cause—outage attributed to operational incident, not active attack, but timing during a week of supply-chain carnage is worth noting]. Zero access = zero fraud, I guess? [Gallows humor, skip this if you’re stressed about money—it’s a bit 😏 but the platform took ~4 hours to restore full service.]
Ahold Delhaize Cyberattack — Retail Giant Hit Across US & Europe — The grocery and retail conglomerate confirmed a cyberattack affecting services in the US and European operations. [BleepingComputer] [MODERATE CONFIDENCE on scope/attribution pending]. Retail ops being flattened right now while the supply chain is already on fire means anyone shopping there in the last 48 hours should be monitoring card statements. The attackers probably have PII.
Calendar Invite Attacks Exploding — Email security vendors are reporting a sharp escalation in malicious calendar invites that bypass quarantine because calendar events often route through a different pipeline than mail. Targets click “Accept,” and the invite stays in the calendar even if the original message gets pulled from inbox. It’s the inbox equivalent of a rootkit hiding in the MBR. [Help Net Security] [HIGH CONFIDENCE]. This is going to be a favorite attack vector for the next six months.
Go Language Emergency CA Block — The Go project issued an emergency security update blocking eight CA certificates over undisclosed security concerns. [The Hacker News] [MODERATE CONFIDENCE on scale—Go’s package ecosystem is massive; any TLS compromise there cascades]. The fact that the advisory doesn’t spell out what the CAs did wrong suggests either active exploitation or a vulnerability so bad they’re keeping it quiet until patches ship.
Cellebrite “Advanced Unlocks” Documents Leaked — The mobile forensics vendor’s confidential docs got leaked, detailing their “AU” (Advanced Unlocks) capabilities for breaking into phones. [Schneier on Security, Justin.sh] [HIGH CONFIDENCE on document authenticity]. This is terrifying for anyone who thought their phone was secure in an authoritarian jurisdiction. Now bad guys have the same playbook cops were using.
MILITARY / GEOPOLITICAL
APT28 Breaches NATO Naval Shipbuilder — Russian military intelligence (Spetsburo, formerly APT28) compromised a NATO-aligned naval shipbuilder in a NATO country and deployed new reflective-loader malware to evade detection. [The Hacker News] [HIGH CONFIDENCE]. This is the kind of intrusion that stays classified until someone leaks it—espionage against warship design and build processes. The reflective loader means they’re learning; they’re not just in, they’re staying in.
Iran-US Escalation: Third Carrier Strike Group Deploying — The US is moving a third aircraft carrier toward the Middle East as tensions with Iran escalate over potential strikes on Israeli targets. [Just Security, news aggregators] [HIGH CONFIDENCE]. Iran has also signaled it’s deliberately prolonging negotiations with the UN, a tactic that usually precedes a strategic shift (either capitulation or escalation). Betting money says we’re watching the walk-up to a serious kinetic event.
Ukraine Drone Ops Near Iran Border — Iran’s Islamic Revolutionary Guard Corps (IRGC) outlets are claiming Ukraine has deployed drone units and small UAVs in countries bordering Iran. [News aggregators] [MODERATE CONFIDENCE—IRGC claims are sometimes inflated, but the drone ops themselves are real]. This opens a third front from Iran’s perspective and raises the risk of a provocation-response spiral.
Lithuania Deploys US AN/TPS-77 Radars on NATO Eastern Edge — Lithuania is standing up Lockheed Martin truck-mounted Multi-Role Radars to feed real-time air defense data into the NATO grid. [Defence Blog] [HIGH CONFIDENCE]. It’s a visible statement: “We’re integrated, we’re watching, and we’re ready.” Russia watches these deployments like a hawk.
China Shadows USS Charleston in South China Sea — The People’s Liberation Army tracked the US Navy’s USS Charleston (LCS-18) after it sailed near Sabina Shoal in the disputed Spratlys. [Defence Blog] [HIGH CONFIDENCE]. Routine harassment, but sustained ops in contested waters with an audience is a confidence-building measure for Beijing (confidence that their navy can shadow ours).
EU Arctic Strategy Released Amid Russia Tensions — The EU announced a new Arctic strategy in response to Russian aggression and Trump’s publicly stated interest in Greenland. [News aggregators] [HIGH CONFIDENCE]. As ice melts, new shipping lanes and resource extraction zones open up. Whoever controls the Arctic in 2030 controls critical supply routes.
PHYSICAL / LOCAL
France Supermarket Sabotage: Remote Defrost Attack — On 11 OCT, attackers remotely triggered defrost cycles in refrigerated cases at hundreds of French supermarkets (Intermarché and others), forcing product spoilage and operational chaos. [CSO Online] [HIGH CONFIDENCE]. This is the kind of attack that starts conversations about why refrigeration systems are online at all. OT security just got very real for the retail industry.
Qilin Ransomware Suspect Arrested on Holiday — Police arrested a suspected Qilin operator while on vacation (because of course they did). [Graham Cluley] [HIGH CONFIDENCE on arrest, pending trial]. Qilin has been linked to the Synnovis healthcare hack, which cascaded into critical service failures and at least one patient death—the first ransomware fatality with a clear causal chain.
SoCal Fentanyl & FIT Student Death — Court records detail what a suspected drug supplier knew about fentanyl-laced drugs before a 21-year-old FIT student died. [Local news] [MODERATE CONFIDENCE—individual incident, not a systems issue, but worth monitoring for supply-chain patterns]. LA fentanyl ODs remain high; the supply is laced and unpredictable.
NOSIG — Physical Infrastructure Monitoring — No significant threats to power, water, telecom, or internet backbone in the SoCal area over the last 24h.
ASSESSMENT
Supply chain security is fundamentally broken. Developers are pulling packages from GitHub without verification. Vendors are shipping software with unvalidated DLLs. Build systems aren’t air-gapped. The entire stack from Siemens to OVHcloud to Go’s certificate authorities is running hot. Expect the next 48 hours to surface more compromises as analysts dig into the fallout.
APT28 is staying aggressive. They’re not slowing down; they’re getting better (reflective loaders, NATO shipbuilder targeting). They’re testing NATO’s air defense posture in Eastern Europe and validating that they can stay inside high-value networks for extended dwell. This is preparation for something larger.
Iran-Israel tensions are at a flashpoint. A third carrier group heading east + sustained Ukrainian drone ops on Iran’s border + Iran’s negotiating delays all point to an escalation window in the next 72-96 hours. Israel has strike capability; Iran has proxies and missiles. The US is positioning for kinetic response.
OT/ICS vulnerabilities are now a feature, not a bug. The France supermarket attack proved that attackers can manipulate physical systems (refrigeration) remotely and cause real-world damage. This will inspire copycat attacks on power grids, water treatment, industrial control. EU Cyber Resilience Act and ISA/IEC standards compliance is going to become a legal liability, not a best practice.
It’s all for you, Damien!—as one vendor after another shoulders the blame for someone else’s compromise, the true cost is landing on everyone downstream. The developer who pulled the backdoored OVHcloud CLI didn’t know. The Siemens customer who deployed Software Center didn’t know the DLL was a liability. The supermarket manager had no idea the defrost system could be remote-triggered. These are cascading failures, not isolated breaches.
KEY JUDGMENTS
Actively-exploited vulnerabilities in widely-deployed software are giving APT and cybercrime groups free rein into critical infrastructure; expect major incident (CRITICAL SYSTEM DOWN) within 72 hours. [HIGH CONFIDENCE]
Iran-Israel conflict is approaching a kinetic threshold; US force posture changes suggest preparation for direct strike contingency, not containment. [HIGH CONFIDENCE]
Calendar-based and DLL-sideloading attacks are now commodity TTPs; any organization not running EDR/XDR with behavioral detection on these vectors is operationally compromised. [HIGH CONFIDENCE]
Our own posture, for context:
