The Tuesday Briefing — Oct 13, 2026

The Big Picture

A single unauthenticated flaw in GitLab, a tool thousands of businesses use to store and build their software, scored a perfect 10 out of 10 on the industry's danger scale this week. At the same time, bank regulators started asking hard questions about AI tools that make decisions on their own, and a French grocery chain lost food across hundreds of stores after hackers broke into its refrigerator controls over the internet. If you take away one thing: the gap between "connected to the internet" and "protected" keeps showing up in places businesses don't think to check — refrigerators, backup software, and the AI coding tools your developers use every day.

This Week's Top 5

1. A Maximum-Severity Flaw Was Found in GitLab, a Tool Millions of Developers Use

What happened: GitLab, a platform many companies use to store and build their software, had a security hole so severe it received the highest possible danger score (10 out of 10). The flaw let attackers break in without even needing a password, on any company running their own copy of the software.

Why it matters to your business: If your developers or IT team run GitLab on your own servers (not GitLab's cloud version), this flaw could let an attacker steal your source code, passwords, and other secrets stored in the system.

What to do: Ask whoever manages your GitLab whether you run a self-hosted version, and if so, confirm it's been updated to the latest patched version this week.

2. Hackers Broke Into Grocery Store Refrigerators and Spoiled Food Across Hundreds of Locations

What happened: Attackers found refrigeration control systems connected to the internet at major grocery chains and remotely changed temperature settings, spoiling food across hundreds of stores.

Why it matters to your business: Any internet-connected equipment in your business — refrigeration, HVAC, security cameras, door locks — can be a way in if it's exposed online without protection, not just computers and phones.

What to do: Make a list of every piece of equipment at your business that connects to the internet (beyond computers), and ask your IT provider to confirm none of it is reachable without a password or extra network protection.

3. Bank Regulators Are Now Directly Questioning How Banks Use AI That Acts on Its Own

What happened: Three major U.S. banking regulators are now actively asking banks detailed questions about AI tools that take automatic actions — including how those actions are tracked and whether a human can shut them down.

Why it matters to your business: Even if you're not a bank, this signals where all regulation is heading: businesses using "autonomous" AI tools will increasingly need to show they can track what the AI did and turn it off if needed.

What to do: For any AI tool at your business that can take actions on its own (send emails, approve requests, modify files), write down who can shut it off and how — before a regulator or customer asks.

4. An AI Tool Reviewing Security Alerts Changed Its Mind on 3 Out of Every 4 Serious Warnings

What happened: A study of an AI tool used to sort cloud security warnings by urgency found it downgraded the severity of 75% of high-priority alerts — meaning real problems may have been quietly marked "not urgent."

Why it matters to your business: If your business or IT provider uses AI to triage security alerts, there's a real risk that genuine threats are being automatically dismissed without a person ever seeing them.

What to do: Ask your IT provider or security vendor whether any AI tool is involved in deciding which security alerts get attention, and whether a human reviews downgraded alerts before they're closed.

5. Criminals Are Now Specifically Hunting for Exposed AI Tools to Hijack for Cryptocurrency Mining

What happened: A new malware campaign is scanning the internet for businesses running their own AI tools (like chatbot or model-hosting software) that were left exposed without passwords, then taking them over to mine cryptocurrency and gain remote access.

Why it matters to your business: Any AI tool you've set up yourself — not through a major vendor like Microsoft or Google — needs the same password protection and firewall rules as your most sensitive servers.

What to do: If your business runs any self-hosted AI tools, ask your IT provider to confirm they require a login and aren't directly reachable from the public internet.

Quick Hits

• A banking app discovery bug could have let an attacker create 184 times the total supply of a major cryptocurrency — a reminder that even well-funded companies miss huge flaws.

• Researchers found that AI coding tools fail to shut down properly when something goes wrong, silently allowing risky actions through instead of blocking them — ask your developers if this default has been fixed on their tools.

• A security company found that over half the businesses it checked had AI tools secretly operating on their network that nobody had approved or even knew about.

• A fake WordPress plugin update was actively exploited to break into websites with no password required — check your WordPress plugin list for anything called "Bricksforge" and update immediately.

• Attackers are now hiding invisible instructions inside AI coding tool configuration files that trick the AI into writing insecure code without your developer noticing.

• A global survey found cyberattacks are up 48% compared to last year, with ransomware specifically up 53%.

• Google had to pause accepting new bug reports from outside researchers because AI-generated spam reports were overwhelming their security team.

One Thing to Do This Week

Walk through your building and make a list of everything connected to the internet that isn't a computer or phone — thermostats, cameras, door locks, refrigeration units, printers. For each one, find out if it has a default or weak password, and if it's reachable from outside your building's network. This week's grocery store refrigerator hack happened because nobody thought of a fridge controller as a security risk. A 30-minute walk-through can catch the same mistake before it costs you.

Worth Reading

• Help Net Security — Details on the maximum-severity GitLab flaw and what self-hosted users need to check first.

• SBS News — How attackers got into French supermarket refrigeration systems through exposed equipment.

• WTAQ — What bank regulators are now asking about AI tools that act without human approval.

• Mondaq — How criminals are scanning for exposed self-hosted AI tools to hijack.