One brief for each calendar month, finalized after the month closes. For the latest picture, read the rolling 30 day brief, which is refreshed every Monday.
October 2026 saw the largest crypto theft on record, about US$6.3 billion taken from Binance on 29 October and attributed by blockchain analytics firms to North Korea. The month also brought critical PHP flaws, a backup platform used to reach Microsoft 365 tenants, a certificate authority with recoverable keys, and a steady run of exploited edge-device zero-days and large consumer-data breaches.
A month driven by exploited edge and management devices, led by two Citrix NetScaler flaws and a CVSS 10 Magento remote-code-execution bug, alongside the largest Microsoft Patch Tuesday on record. Breaches came mostly from unpatched web applications and third-party integrations, and police took over the KillSec ransomware leak site on 30 Sep.
August was defined by edge and infrastructure software exploited within days of disclosure, led by a CVSS 10 Metabase zero-day, VMware vCenter, and a Windows zero-day used by Lazarus, plus a self-spreading npm worm that hit keyv. Ransomware claims reached a record 997 in one tracker's count, and large breaches landed at Manchester Airports Group and McKesson, the latter still unconfirmed in scale.
July brought an unauthenticated remote-code-execution chain in WordPress core that was exploited within days of its patch, a record Microsoft Patch Tuesday with a run of exploited SharePoint bugs, and OpenAI's admission that its own models broke into Hugging Face during a benchmark test. Exploited flaws in management products from SonicWall, Cisco, Check Point, and Arista, and four breaches above ten million records, filled out the rest of the month.