The supermarket shelves went empty. The vulnerability was already published.

On Monday, 2 November, fridges and freezers in more than a hundred shops across Europe ran hot at once. Delhaize said dozens of its stores in Belgium and Luxembourg were hit. Carrefour counted about fifteen of its Belgian shops, Colruyt five, Swedish Coop seven, Musgrave thirteen SuperValu stores in Ireland. A butcher in Hove, south of Antwerp, watched its fridges climb to 18 degrees and lost about 15,000 euros of meat. In October, hundreds of French supermarkets had already thrown out tonnes of food after the same thing: controllers turned up until units melted or caught fire. Belgium opened a criminal investigation. The EU's agriculture commissioner called it a deliberate attempt to disrupt the food supply.

How did someone turn up a supermarket's freezers from the internet? Awais Rashid, professor of cybersecurity at the University of Bristol, told Al Jazeera what the people who run these systems already knew: the controllers are reachable from the internet, often managed by a third party, and many are past their end of life with known vulnerabilities and easily guessed passwords.

Known vulnerabilities. That is the part of this story we want to talk about, because it is the part that repeats.

Eighteen months of empty shelves

• Ahold Delhaize, October 2026. The group behind Stop & Shop, Food Lion, Giant, Hannaford and Albert Heijn, 9,500 stores and 77 million customers a week, took systems offline on 12 October after what it first called a security issue and a week later confirmed as malicious actions. Its US banners stayed offline for days. This was its second time: in November 2024, ransomware took down pharmacies and online orders, and the data of 2.2 million people left with the attackers.
• Fairlife, July 2026. Coca-Cola told the SEC that ransomware had hit its dairy subsidiary and suspended production across the United States for the foreseeable future.
• United Natural Foods, June 2025. The largest grocery distributor in North America and Whole Foods' main supplier took its systems offline after an attack. Shelves emptied for weeks; the company put the cost at $350 million in lost sales.
• Co-op and Marks & Spencer, April 2025. Social engineering got the attackers in. Co-op's island stores in Scotland ran out of basics while systems were rebuilt, and the data of 6.5 million members was taken. M&S could not take online orders for about six weeks.

Different attackers, different ways in. What they share is the kind of thing the French and Belgian freezer investigations keep finding: a component someone else wrote, running a version someone else had already documented as broken.

The fix was out before the attack

This is the uncomfortable pattern in most of these incidents. When the detail comes out, it is rarely a new technique. It is an unpatched VPN appliance, a controller past end of life, a library three versions behind, a helpdesk that resets a password for a voice on the phone. The vulnerability was published. A fixed version existed. Nobody in the building was the person whose job it was to read the feed that morning, map it to what the company actually ran, and open the change.

Cloudflare made a version of this point today with Zero Wire, a vulnerability intelligence feed on Radar: a card per critical vulnerability with what happened, who should investigate, what to do now and the evidence, written so a CISO and an engineer can read the same page. We think that format is right, and we think most teams are missing the step after it.

You are probably not a supermarket. But your product has a package.json, a go.mod or a requirements.txt with a few hundred packages in it, and every one of them is a controller somebody else wrote, reachable from the internet through your app. In the repository behind this very site, ZeusQA's own check found nine advisories on the day we ran it: eight in undici, the HTTP client under Node's fetch, including a TLS certificate validation bypass rated high, all fixed in 7.30.1, and one in serialize-javascript. None of them were new. All of them were published, and fixed, before anyone on the team had read about them.

What vulnerability watch does

Vulnerability watch is the person who reads the feed. On Pro and Team, switch it on for a connected repository in Connections, GitHub, and once a day:

1. It reads the manifests. package.json with its lockfile, requirements.txt, go.mod, Cargo.lock, composer.lock and Gemfile.lock, from the root of the default branch, through the GitHub API. Nothing is cloned, built or run.
2. It asks the public databases. Every package version goes to OSV.dev, which aggregates GitHub's advisory database and the PyPI, Go, Rust and other ecosystem feeds. Each advisory that applies is matched against CISA's Known Exploited Vulnerabilities catalog, the list of flaws attackers are using right now.
3. It writes the briefing. Each advisory is a card on the new Advisories page: what happened, who should look (the team that owns the manifest, or the one whose dependency pulls the package in), what to do now, the evidence, and a chronology. Known exploited goes first. Needs attention and Reference keep the open and the settled apart.
4. It opens the pull request. A direct dependency with a fixed version gets a pull request that bumps it to the lowest fixed version, caret or tilde kept, with the same briefing in the description and the install command to refresh the lockfile. Up to three a day per repository, ten open at once.
5. It tells the channel. Add a Slack or Discord incoming webhook in Settings, Notifications, pick the lowest severity to post, and each check's new advisories arrive as one message with a link to the briefings and the pull requests it opened.

The Advisories page is in the app's Monitor row, next to Runs and Trends, because that is what it is: one more thing about your product that you should not have to go looking for.

Where it stops

• It reads the manifests at the root of the default branch. A monorepo's nested packages are not covered yet.
• It knows what OSV.dev and CISA publish. A vulnerability with no public advisory, or in a component with no package name, is not found. It would not have seen the freezer controllers.
• A pull request bumps the manifest, not the lockfile; the pull request names the install command to run before merging. A package that arrives through another dependency gets the override or update instruction instead of a pull request.
• Pull requests need the GitHub App's Contents permission at Read and write. Until then, the briefing says so and nothing is opened.
• Pro watches 10 repositories and Team 50, each once every 24 hours, with Check now once an hour.

The release is in the changelog: Vulnerability watch. The controls behind it, and the gaps, are on the security page.

Sources: Al Jazeera, 3 November 2026, "Very cold war: who's attacking Europe's supermarket freezers?"; Ahold Delhaize press release, 12 October 2026; TechCrunch, 16 July 2026, on Fairlife; Grocery Dive, 16 July 2025, on UNFI's $350 million; The Record, 27 June 2025, on the 2.2 million people; BBC, 7 May 2025, on Co-op's island shelves.