October 2026 Threat Brief

October 2026 saw the largest crypto theft on record, about US$6.3 billion taken from Binance on 29 October and attributed by blockchain analytics firms to North Korea. The month also brought critical PHP flaws, a backup platform used to reach Microsoft 365 tenants, a certificate authority with recoverable keys, and a steady run of exploited edge-device zero-days and large consumer-data breaches.

Top items

Binance: about US$6.3 billion stolen in 20 minutes

Critical · under investigation

On 29 Oct, starting at 20:05 UTC, attackers moved about US$6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes, according to TRM Labs, which calls it the largest crypto theft on record. TechCrunch reports at least US$6.3 billion. Binance says a compromised engineer's laptop gave the attacker access to a service container used to submit unauthorized withdrawals, that it has seen no evidence private keys leaked, and that user funds are safe. As of 30 Oct it had not published proof, and it suspended deposits and withdrawals. TRM instead assesses that compromise of hot wallet signing infrastructure is the most likely cause, and describes an Ethereum drain using 50 pre-signed EIP-7702 authorizations. TRM attributes the theft to North Korea's TraderTraitor unit with high confidence and Elliptic also points to North Korea; Binance has not named a culprit, and the sources reviewed show no government attribution. Frozen totals differ by source and by moment.

Stolen (TRM): ~US$6.36B across 10 chains
Window: 29 Oct, from 20:05 UTC, ~20 min
Frozen: ~US$2.7B (TRM)
~US$3B (Binance spokesperson)
Attacker still holds (TRM): 420,000+ ETH and 18,270 BTC, ~US$2.4B

Action: Treat engineer workstations that can reach production signing or withdrawal services as top-tier assets: separate them from service containers, require hardware-backed multi-party approval for outbound transfers, and alert on new account delegations (EIP-7702) on hot wallets. Exchange customers should watch for the updated proof of reserves Binance says it will publish after remediation, and expect phishing that uses the incident.

PHP2Shell: critical flaws in PHP core

Critical · exploitation attempts

Two critical flaws affect nearly every PHP version back to 5.4, across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php at highest risk. Wiz Research, Calif, and OpenAI's Codex Security team reported them, and the researchers say AI tools helped turn them into working exploits. Details leaked online on 20 Oct, and PHP moved its release up to 21 Oct. Amazon logged exploitation attempts from 17 Oct, four days before the patches, and Cloudflare and watchTowr also reported attempts. Sources disagree on impact: Amazon's CISO says the flaws are being broadly exploited, while Dataminr reports only scanning and non-working exploits with no known compromises.

CVE: CVE-2026-109618
CVE-2026-109619
CVSS v4: 9.2 (PHP rating)
Fixed in: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

Action: Patch every PHP install now, including vendor appliances and hosted CMSs. Hunt for web shells on anything exposed since 17 Oct. Source backports exist for 7.4, 8.0 and 8.1, which PHP no longer supports, and distributions may backport fixes under older version numbers, so check changelogs for the CVEs. Disabling session upload progress and setting memory limits reduce exposure but do not make servers safe.

ConnectWise Cloud Backup (formerly SkyKick) used to reach Microsoft 365 tenants

Critical · supply chain

Starting 15 Oct, attackers abused the backup platform's application identities to sign into customer Microsoft 365 tenants, so MFA never applied. Huntress confirmed unauthorized sign-ins in 162 tenants by 16 Oct and later found nearly 1,000 tenants with sign-in activity from the attacker's address, with more than 300 successful. On 21 Oct Microsoft attributed the campaign to Storm-0940, a China-aligned group, and said it used ARTEX, an open-source agentic AI penetration-testing framework, and tried to sign in to more than 2,250 tenants. In some cases the attackers reached privileged cloud access in under three hours and added credentials and role changes that can persist after the app itself is fixed. ConnectWise says it has no indication that backup data was compromised and began restoring the service in stages on 21 Oct.

Confirmed (Huntress): 162 tenants
Targeted (Microsoft): 2,250+ tenants
Activity window: From 15 Oct

Action: If you or your MSP use this product, review Entra sign-in logs for its service principals back to at least 15 Oct, audit application secrets, certificates, OAuth grants, and Graph activity added since 13 Oct, and review role changes. Keep ConnectWise integrations disabled until ConnectWise confirms restoration is safe, and do not delete the enterprise applications as a first step.

Exploited vulnerabilities and zero-days

Product	CVE	What it allows	Status
Ivanti Connect Secure VPN	CVE-2026-104935 + 2 chained · CVE-2026-111357 · CVE-2026-118527	Chained authentication bypass, remote code execution, and privilege escalation giving root on fully patched appliances. Actor UTA0576 harvested Active Directory credentials, BitLocker recovery keys, and LAPS data with custom Python LDAP and Kerberos tools, and deleted evidence from debug and audit logs. Exploited since 1–3 Oct; added to CISA KEV on 13 Oct. Ivanti's Integrity Checker may not detect compromise because commands run in memory. On 30 Oct CISA also added CVE-2026-111357 (CVSS 8.8, local privilege escalation, federal due date 2 Nov) and CVE-2026-118527 (CVSS 4.3, file upload, due 13 Nov). Fixed in 25.1.1.3 and 22.8R2.6.	Exploited Partial fix
Microsoft Patch Tuesday (13 Oct)	CVE-2026-96951 (MotW bypass)	Record ~1,411 CVEs by BleepingComputer's count (some outlets say 1,413), 70 rated Critical. Three zero-days: the exploited Windows Shell Mark of the Web bypass, a publicly disclosed .NET Framework bypass of Windows Defender Application Control (CVE-2026-108398), and a publicly disclosed MessagePack-CSharp denial of service (CVE-2026-92707).	Exploited Patched
Fortinet FortiMail	CVE-2026-104286	Unauthenticated arbitrary file write through crafted HTTP/HTTPS requests, CVSS 9.8. Added to CISA KEV on 1 Oct. Fixes were listed as upcoming for 8.0.2+, 7.6.7+ and 7.4.9+; until then Fortinet advises disabling IBE support and restricting management access.	Exploited CISA KEV
Citrix NetScaler ADC / Gateway	CVE-2026-88779 · CVE-2026-107406	CVE-2026-88779 (disclosed 4 Oct, CVSS 8.7) is a memory overflow under SAML configurations that causes denial of service and is being exploited; CISA KEV deadline 7 Oct. CVE-2026-107406 (disclosed 8 Oct, CVSS 9.5) is a separate SAML memory overflow that can give remote code execution or denial of service; Citrix reports no known exploitation. Earlier September fixes may not cover them, so a second upgrade may be needed.	Exploited Fixes: 14.1-73.46+ / 13.1-64.29+
AhsayCBS backup (MSP platform)	CVE-2026-105133 / 105134	Authentication bypass plus remote code execution as SYSTEM. Huntress saw exploitation from 7 Oct, with attackers deploying JSP web shells and XMRig miners. Added to CISA KEV on 14 Oct. The August fixes were incomplete.	Exploited Hotfix 10.3.4.45 / 9.15.2.70
BeyondTrust Remote Support	CVE-2026-102764	Authentication bypass in RS 26.2.3 and earlier. Exploited since late August; Mandiant and Google attribute it to Armory Castle (formerly UNC5221), a suspected China-nexus espionage actor. Patched 15 Oct (BT26-05); reported added to CISA KEV on 16 Oct.	Exploited
Palo Alto PAN-OS · Cisco Secure Email Gateway	CVE-2026-0322 · CVE-2026-76519	PAN-OS management interface code injection (authenticated, root, CVSS 8.6) and a Cisco AMP path traversal that lets a crafted attachment write files and run commands as root (CVSS 9.8; needs File Reputation enabled and Content Scanner Tools older than 25.3.0.5525). Both added to CISA KEV on 14 Oct. Cisco's fixes shipped on 14 Sep.	Exploited
Atlassian Jira / Confluence / Bitbucket and other Data Center products	CVE-2026-21589	Unauthenticated file access, CVSS 9.3, across eight products including Bamboo, Crowd, Crucible, and Fisheye. Disclosed 5 Oct. Previdian reported exploitation attempts on its honeypots within two hours of watchTowr publishing a proof of concept; no confirmed compromises were reported.	Exploit attempts
Google Brotli (Node.js, PHP, Bun, .NET) · Adobe Commerce / Magento	CVE-2026-111497 · CVE-2026-48356	Brotli (CVSS 9.2, called Node2Shell) is an unchecked return value that a remote, unauthenticated attacker can trigger with a crafted compressed stream, with memory corruption, data exposure, denial of service or code execution possible; Previdian recorded one attempt by 27 Oct and ELLIO saw traffic carrying a public exploit, and the scope is unclear. Node.js, PHP, Bun and .NET have shipped updates. The Adobe Commerce and Magento flaw (CVSS 9.3, called PolyShell) is an unrestricted file upload; Sansec reports at least 953 online stores infected, with activity believed to date to July 2025. Both were added to CISA KEV in an alert dated 26 Oct, federal due date 29 Oct.	Exploited CISA KEV
GitLab CE/EE · Cisco Secure Firewall ASA and FTD	CVE-2026-97229 · CVE-2026-76418	GitLab (CVSS 10.0): unauthenticated code execution on the server through a crafted regular expression in a CI/CD configuration; fixed in 19.2.8, 19.3.5 and 19.4.2. Alpine Linux reported failed attempts on 20 and 21 Oct. Cisco (CVSS 8.6): an unauthenticated remote attacker can force a reload, causing denial of service; Cisco says it saw active exploitation earlier in October and has not said who or how many. Both are on CISA KEV with a federal due date of 1 Nov; the sources reviewed do not state the exact addition date.	Exploited CISA KEV
Drupal Commerce Core	CVE-2026-118539	Missing authorization allowing forceful browsing and an access bypass. Drupal says it is being exploited in the wild; the report gives no start date or CVSS. Published 31 Oct. The report's version ranges are inconsistent, so check Drupal advisory SA-CONTRIB-2026-254 for the fixed releases (3.x branch to 3.3.13, earlier releases to 8.x-2.41 as reported).	Exploited
Linux kernel · Broadcom VMware ESX	CVE-2026-46300 · CVE-2026-41709	CVE-2026-46300 (called Fragnesia, CVSS 2.7 as listed) lets a local low-privileged user corrupt the page cache and gain root on major distributions; federal due date 31 Oct. CVE-2026-41709 (CVSS 7.6) is insufficient logging in ESX that lets an attacker who already has administrator rights act without records; Broadcom patched it in July, and CrowdStrike says the China-linked Warp Panda used it as a zero-day in early 2026. Both were added to CISA KEV in an alert dated 28 Oct.	Exploited

Supply chain

LiteLLM 1.107.0

A poisoned release went out on PyPI and the official Docker images on 21 Oct. The PyPI wheels were live for under two hours and the Docker tags stayed pointed at the bad image for a few hours more. The release pipeline was altered using stolen GitHub credentials from three developer accounts. It ran a credential stealer at every Python startup, even if LiteLLM was never imported, and installed a loader that fetches and runs code from attacker infrastructure every hour. Anyone who installed it should treat every secret on that host as exposed; the clean version is 1.106.2.

npm

Eight malicious packages in a long-running data-theft campaign reached 40,767 downloads as of 1 Oct, 37,419 of them for function-flag. Three packages (function-flag, function-color, cdn-img-fetch) were still installable when checked, and the campaign delivers the Overlord RAT and an infostealer. Download counts measure registry activity, not confirmed infections.

JAMIS Prime (hosted ERP)

Hosted JAMIS Prime environments used by government contractors have been disrupted for about a week, with access returning unevenly since late October. A post from the accounting firm Corporate Results, Inc. says reports and community updates tie the outage to a security compromise of the environment, and that customer instances are being rebuilt on new AWS infrastructure instead of cleaned in place. Some tenants have basic logins back but report intermittent performance, delayed database imports, and broken integrations and reports. No JAMIS statement was found in the sources reviewed, so the cause, scope, and number of customers affected are unconfirmed. For contractors the open questions are DCAA timekeeping and billing records kept by hand during the outage, whether the rebuilt environment keeps the FedRAMP Moderate equivalency the post says JAMIS Prime holds, and whether CUI held in an instance triggered 72-hour DFARS 252.204-7012 reporting to DC3.

Data breaches

Organization	People / records	Cause and data
SourceNext (Japan)	Up to 22,519,960 potentially leaked records	Unauthorized access to the member management system, announced 15 Oct. Names, emails, passwords, addresses, phone numbers, birth dates, company names, subscribed services and login dates; no card data was stored on the system. The count is described as potentially leaked, not confirmed, and the entry method was not stated.
Oracle Health (Cerner)	~20M patients	Customer credentials stolen and used on an unmigrated legacy server. The intrusion ran from January to April 2025; the near-20M tally surfaced from a Texas attorney general filing posted 2 Oct. Oracle has not published an official figure.
Capcom (CAPCOM ID)	11.7M+ accounts	Unauthorized access confirmed 19 Oct and announced 22 Oct. Mostly email addresses, account creation date, login count and last-login IP; 43 accounts also lost birth date, gender, nickname and country, and attackers changed passwords on 196 accounts. Capcom says passwords of other members and card data were not exposed and has not disclosed the entry method.
Burger King Japan	~11.18M app members	Names, birth dates, gender, emails, phone numbers, and order history taken 2–7 Oct and announced 15 Oct. The server held no card numbers.
Denmark CPR register	~8.8M (≈80% of the register)	Attackers misused a private Danish company's legitimate registry access and brute-forced CPR numbers. Names, addresses, and CPR numbers taken. Found 2 Oct, disclosed 5 Oct.
Daiichikosho (karaoke)	~8.72M customers	Malware on an employee PC at contractor Nippon Columbia Group. Names, genders, birth dates, emails, and phone numbers. Announced 8 Oct.
iRhythm Technologies	~8.18M (Oregon AG listing)	Zio cardiac monitor maker. Social engineering gave access to third-party-hosted business applications in June, followed by an extortion demand. The full count surfaced in state filings and notification letters began 9 Oct.
ETS	~7M California students	Files copied between 22 May and 18 Sep using one compromised login. Discovered 25 Sep, districts told 2 Oct. Includes disability status and program eligibility; no SSNs. Counts conflict: EdSource and GovTech reported about 7 million, while a Privacy Guides roundup lists 5.7 million.
Yamato Transport (Kuroneko deferred payment)	~5.3M records	Unauthorized access detected 28 Sep and reported 19 Oct. Names, addresses, phone numbers, and purchase details; no card details or passwords. Entry point not stated.
Zeabur and Railway (hosting)	Zeabur: 3.2M env-var records / 321,810 accounts. Railway: limited, not quantified	Zeabur: attack on 14–15 Oct using leaked internal credentials including admin tokens not rotated since January 2024, its second breach in two months; services end by 31 Dec. Railway: detected 21 Oct, encrypted customer environment variables accessed and some reportedly decrypted; Railway says it may be part of a wider series of attacks on platform companies aimed at AI inference providers.
US Department of Homeland Security	40,000+ employees (~21,000 CBP, ~10,000 ICE/HSI, just under 1,000 CISA)	A hacker calling themselves Department of Peace published names, titles, work contact details and records of which internal systems each account can reach, claiming the data came from DHS's Okta single sign-on system. Okta says it has no evidence its systems were compromised; records reviewed by TechCrunch suggest the copy was made around mid-August. DHS says it is investigating a potential breach. Reported 28 Oct.
Chainalysis	Not disclosed	Disclosed 30 Oct. An intruder described by Chainalysis as using "offensive agentic techniques" viewed customer user IDs, names, emails and role labels. Chainalysis reports no evidence of access to investigation content, query results, plaintext passwords, MFA secrets or session tokens, says the incident is unrelated to the Binance theft, and has not said how many customers are affected.
Nikkei	~1.83M records	Stolen credentials used on a cloud development system on 7 Oct; about 150K records held an identifier. Its third incident in about a month.

Unverified claims: PwC (Everest claims ~590 GB, posted 22 Oct; PwC confirms only an incident at a third-party platform that hosts employee learning records), JAMIS Prime outage (cause, timeline, and scope rest on one post by Corporate Results, Inc., a firm that sells recovery and ERP migration services, plus unnamed community updates; no JAMIS statement or other coverage was found); a report that the FBI has formally attributed the Binance theft to North Korea (seen only as a headline from one outlet; the sources reviewed attribute it to blockchain analytics firms, and Binance has named no culprit)

Law enforcement and research

Volt Typhoon "Silent Train"

Lumen's Black Lotus Labs reported on 29 Oct that China-linked Volt Typhoon runs a relay network of rented servers and compromised routers and IoT devices, averaging about four hops before a US address, tracked since November 2023. Lumen lists four confirmed zero-days used for access (Versa Director, N-able N-central, Cisco Catalyst SD-WAN CVE-2026-20127 and VeloCloud Orchestrator CVE-2026-16812) and one likely (Quest KACE, moderate confidence). Targets include telecoms, government, defense contractors, MSPs and critical infrastructure; Lumen cannot confirm motive but says the pattern fits pre-positioning.

Virtualine takedown

Reported 28 Oct: the FBI seized the main domain of Virtualine, a bulletproof hosting service sold on cybercrime forums under five other names, and Dutch police took dozens of physical servers in Limburg offline and recovered data on more than 3,000 customers. No arrests were reported. TRM put ransomware at about 5% of its financial flows and a Russian drug marketplace at about 44%; parts of the service were still partly online.

eMudhra CA

Eight intermediate CA certificates (six TLS, two code signing) were generated with too little randomness, so each private key was smaller than 256 and could be recovered from the public certificate. Found 17 Oct, revoked by eMudhra 18 Oct and blocked by Apple 19 Oct and Microsoft 20 Oct, the day Mozilla made the incident public. eMudhra says only one of the eight was deployed, none issued end-entity certificates and its infrastructure was not breached. On 22 Oct it said it would exit the global SSL/TLS business.

Pwn2Own Ireland

98 zero-days and $1.262M paid out. Samsung's Galaxy S26 was compromised several times (outlets differ on the exact count) and Google Pixel 10 exploits earned $560,000.

Flax Typhoon advisory

A joint advisory from the US, UK, Australia, Canada, Japan, New Zealand, and Spain ties Flax Typhoon operations to China-based Integrity Technology Group. It covers eight exploited vulnerabilities used for initial access, email and credential theft, and VPN persistence, and warns of positioning in critical infrastructure networks. CISA added five older flaws (ProFTPD, ONLYOFFICE Docs, Apache Struts, ISC BIND, Strapi) to KEV on 8 Oct after abuse by the group.

GlobalProtect ransomware

ReliaQuest reported on 9 Oct that the Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass that was patched in May. Patching alone may not remove access gained earlier.

Operational attacks, Japan and Europe

IDC Frontier (SoftBank): ransomware on 7 Oct disrupted 495 companies and local governments, and Japan's cybersecurity strategy head described a "state of emergency in cyberspace" on 15 Oct after attacks on more than 20 major companies. Ahold Delhaize: systems offline from about 12 Oct, with Albert Heijn, Delhaize, Stop & Shop, Hannaford and Giant Food sites and apps down while stores stayed open; no evidence of customer data theft and no ransomware group claim reported. GMO Onamae Desktop Cloud: confirmed 20 Oct, an outside party installed malware and GMO shut down customer servers, up to about 26.7K affected; entry method not disclosed and no data leak confirmed.

What to do

Patch PHP everywhere and hunt for web shells on internet-facing PHP hosts, checking vendor changelogs for the two CVEs.

Replace any certificate chaining to eMudhra.

Patch Ivanti (including the two 30 Oct KEV additions), FortiMail, NetScaler, Cisco Secure Email Gateway and ASA/FTD, PAN-OS, BeyondTrust, AhsayCBS, GitLab and Atlassian Data Center, then check those devices for signs of prior compromise, because patching does not remove an attacker who is already in. After patching GlobalProtect, also terminate active sessions and disable authentication override cookies where they are not needed.

Apply October Patch Tuesday, starting with the exploited Windows Shell Mark of the Web bypass (CVE-2026-96951), then update Brotli consumers (Node.js, PHP, Bun, .NET), Adobe Commerce and Magento, Drupal Commerce and Linux kernels listed in KEV.

Audit third-party app identities in Microsoft 365 (backup, MSP, and RMM tools), rotate their secrets, and keep ConnectWise integrations disabled until restoration is confirmed.

Check Python environments for LiteLLM 1.107.0, move to 1.106.2, and rotate secrets on any host that installed it.

Replace long-lived admin tokens and plaintext environment variables at hosting providers with short-lived, scoped credentials, rotate anything stored at Railway or Zeabur, and treat engineer workstations with access to production signing or withdrawal services as top-tier assets.

If you run hosted JAMIS Prime, document when the system went down and how manual timecards were collected, signed, and approved, ask JAMIS in writing whether the rebuilt environment keeps your FedRAMP equivalency and security boundary, and decide whether DFARS 252.204-7012 reporting applies to CUI held in the instance.