October 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

October 2026 was a month of supply-chain and credential-driven attacks far more than classic network break-ins. Critical flaws in PHP itself, a poisoned LiteLLM release, a backup-platform compromise, and a run of large data breaches across government, education and hosting all landed inside a few weeks. This is an independent, attributed digest: every figure is sourced, each item is marked confirmed, claimed or rumoured, with a defensive takeaway. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party’s conduct.

Method, and a note on the severity scores

We checked each item against primary reporting and vendor statements, corrected numbers where sources disagreed, and dropped or flagged anything we could not stand up. We left out one widely-circulated item — a claimed Capcom breach of ~11.7 million accounts — because we found no October 2026 reporting for it; the only matching public record is the unrelated 2020 Capcom incident, so treat that number as unverified.

The editorial severity beside each entry is a subjective PlayCISO reading out of ten — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is not CVSS, not EPSS and not any recognised standard; use it as a quick relative signal only. Note too that several of the highest-profile numbers this month are unverified threat-actor claims, not confirmed facts.

Confirmed: critical flaws and supply-chain compromises

Microsoft October Patch Tuesday — a record ~1,413 CVEs, including an exploited zero-day. Status: Confirmed. Editorial severity: 7/10. Microsoft’s October 2026 update was its largest ever by volume and included CVE-2026-96951, a Windows Shell security-feature-bypass flaw exploited in the wild, plus a publicly-disclosed .NET issue (CVE-2026-108398). Takeaway: do not try to swallow 1,400+ fixes at once — rank by "actively exploited / public proof-of-concept" and patch the zero-day first.

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619). PHP’s security team emergency-patched two unauthenticated remote-code-execution flaws in PHP core on 21 October after details leaked, affecting essentially every web-facing PHP install. PHP rates them CVSS 9.2 (the “10.0” that circulated was a leaker’s guess), says there is no complete mitigation, and exploitation in the wild has been reported. Status: Confirmed. Editorial severity: 9/10. Takeaway: patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now, and hunt for every PHP install, not just the obvious ones.
• LiteLLM 1.107.0 poisoned release. A malicious version of the popular LLM gateway shipped to PyPI and official Docker images for about two hours on 21 October, carrying a credential stealer that ran on Python startup plus a remote-access backdoor; LiteLLM attributes it to abuse of engineers’ GitHub tokens. Status: Confirmed. Editorial severity: 7/10. Takeaway: if any system pulled 1.107.0 in the window, assume compromise, rebuild from clean images and rotate every reachable credential. Our LiteLLM exposure check helps you tell quickly.
• ConnectWise Cloud Backup (formerly SkyKick). ConnectWise suspended its Cloud Backup service after attackers abused application identities to reach Microsoft 365 tenants from 15 October; Huntress first counted at least 162 compromised tenants in its own environment, and by 17 October saw sign-ins from the attacker IP across nearly 1,000 Entra tenants with over 300 successful. Status: Confirmed (intrusion). Note: claims that a China-linked actor used AI agents were not supported by the primary sources we checked — treat that framing as unverified. Editorial severity: 9/10. Takeaway: independently review your own and your customers’ M365 tenants; revoke and re-consent third-party OAuth app permissions. See our full ConnectWise write-up.
• eMudhra weak certificate keys. Researchers reported on 17 October that the private keys of eight eMudhra intermediate CA certificates could be recovered from the public certificates; Chrome, Firefox, Apple and Microsoft blocked them within days, and Chrome plans to remove the parent root on 27 October. Status: Confirmed. Editorial severity: 8/10. Takeaway: inventory certificates chaining to affected roots before the removal breaks legitimate sites.
• Arista VeloCloud Orchestrator zero-day. Arista patched a maximum-severity, actively-exploited VeloCloud Orchestrator flaw (CVE-2026-93952) added to the CISA KEV catalog. Status: Confirmed, but dated: this was disclosed in late September 2026 rather than October, carrying into the month. Editorial severity: 7/10. Takeaway: if you run on-prem VCO, confirm you are patched and hunt for prior exploitation.

Confirmed: major data breaches

Oracle Health (Cerner) — roughly 20 million patients. Status: Confirmed. Editorial severity: 8/10. State attorney-general filings through early-to-mid October 2026 (Texas reported about 2.99 million residents, Oregon about 1.98 million, South Carolina about 0.28 million) point to a breach of Oracle Health’s legacy Cerner infrastructure affecting roughly 20 million people across dozens of US hospital systems. Reporting traces the intrusion to compromised customer credentials used against legacy systems in 2025, with the mass notifications landing in October 2026; Oracle has declined to comment on a victim count. Takeaway: "old" intrusions surface as this year’s incident through the slow drip of breach-notification filings — track state AG portals, not just the federal one, and treat acquired/legacy infrastructure as in-scope.

IDC Frontier (Japan cloud provider) — reported ransomware outage. Status: Reported (details still emerging). Editorial severity: 7/10. Regional threat trackers reported a ransomware attack on the Japanese cloud provider that took a large number of customer organisations offline, with the group claiming a very large volume of data encrypted; specifics were still firming up at the time of writing, so treat the numbers as unconfirmed. Takeaway: a provider-side ransomware event is concentration risk — know your hosting/cloud dependencies and your fallback if one goes dark.

• Educational Testing Service (ETS) — California students. The California Department of Education disclosed on 16 October that a compromised login let an intruder copy student files between May and September; reporting puts the scale at roughly 5.7 to 7 million students (names, dates of birth, addresses, disability status, test results; officials say no SSNs or financial data). Status: Confirmed. Editorial severity: 8/10. Takeaway: children’s records carry long-tail identity risk; enforce MFA on data-transfer systems.
• Denmark central population register (CPR). Danish authorities disclosed on 5 October that attackers reached the national register by breaching a company with legitimate access and brute-forcing CPR numbers, affecting about 8.8 million people — roughly 80% of the population. Status: Confirmed. Editorial severity: 8/10. Takeaway: your third parties’ access to your crown-jewel data is your risk; monitor and rate-limit it.
• Zeabur (hosting). The platform disclosed that an attacker used leaked internal credentials — including a non-expiring admin token — to read its database and 3,218,965 environment-variable records across 321,810 accounts between 14–15 October. Zeabur is shutting down by 31 December 2026. Status: Confirmed. Editorial severity: 8/10. Takeaway: if you ever used Zeabur, treat every variable as leaked and rotate now.
• Railway (hosting). Railway disclosed on 21 October that an unauthorised party may have reached customer environment variables, some decrypted — which can hold API keys and database or registry credentials — and linked it to a broader campaign targeting platform and AI-inference providers. Status: Confirmed (scope per Railway, limited to a subset). Editorial severity: 7/10. Takeaway: rotate every environment variable and registry credential and review logs.
• Burger King Japan. Operator BK Japan confirmed around 13 October that unauthorised access on 2–7 October exposed roughly 11.18 million app member records (IDs, emails, phone numbers, dates of birth, gender, prefecture); it says no card numbers were stored on the affected server. Status: Confirmed. Editorial severity: 6/10. Takeaway: expect phishing and smishing against affected customers; prepare comms.
• GMO Onamae Desktop Cloud (Japan). GMO Internet announced on 21 October that attackers planted malware on customer servers, with potential impact to about 26,739 servers; it is shutting servers down sequentially and urging credential changes. No confirmed data leak as of the announcement. Status: Confirmed. Editorial severity: 6/10. Takeaway: rotate any credentials stored on hosted virtual desktops.
• Nikkei. The Japanese media group disclosed a breach of about 1.83 million records via stolen credentials to a cloud development service (around 150,000 records held identifiers) — reported as its third breach in roughly a month. Status: Confirmed (the “third in a month” framing rests largely on one outlet). Editorial severity: 5/10. Takeaway: repeated incidents point to a systemic identity or monitoring gap, not bad luck.
• UK Legal Aid Agency — 1978 records. An October 2026 forensic update on the agency’s April 2025 breach confirmed roughly 250,000 records predate 2007, with the earliest dating to 1978; stolen data includes applicant contact details, criminal history and financial information. Status: Confirmed (a 2025 breach, with October 2026 disclosure). Editorial severity: 6/10. Takeaway: retention is a breach-surface decision — you cannot lose data you no longer hold.

Claimed and unverified: treat as threat-actor marketing

• PwC / Everest (590 GB claim). The Everest group listed PwC on 22 October claiming ~590.69 GB; PwC confirmed only a narrow incident at a third-party vendor hosting employee learning records, with no client or sensitive data on the affected site and no samples published. Status: Incident confirmed; 590 GB volume claimed (unverified). Editorial severity: 6/10. Takeaway: see our dedicated PwC / Everest analysis for the confirmed-vs-claimed split.
• Anne Arundel County, Maryland / Rhysida (2.6 TB claim). The county confirmed an unauthorised actor copied files after detecting activity on 28 August; Rhysida claims 2.6 TB across 814,500 files at 25 bitcoin, alleging SSNs, driver’s licences and banking data. Status: Breach confirmed; 2.6 TB volume and contents claimed (unverified). Editorial severity: 7/10. Takeaway: do not confirm an attacker’s scope figures in your own comms until you have verified them.

Still developing / rumoured

• City of Columbia, South Carolina. The State Law Enforcement Division is investigating suspicious activity on the city’s network; select applications and services were affected while public-safety and utility systems reportedly stayed operational. Scope and cause are not yet public. Status: Confirmed investigation, limited detail. Editorial severity: 5/10.
• White House Military Office (phishing rumour). We could not verify any October 2026 incident here; the only matching public record is an unrelated 2015 spear-phishing episode. Status: Rumoured / unconfirmed — no credible October 2026 sourcing found; no data confirmed lost. Editorial severity: 4/10. We include it only to mark it as unsubstantiated.

Is AI really doing the hacking now?

The phrase is everywhere, so it is worth being precise. The clearly-documented milestone is Anthropic’s November 2025 report that a China-linked group used its Claude Code tool to run a largely automated espionage campaign against roughly 30 targets, with the model performing an estimated 80–90% of tactical operations — while also hallucinating data and overstating success, so humans still had to validate.

By contrast, two specific claims circulating this October did not hold up against primary sources: that AI agents drove the ConnectWise campaign, and that a Chinese group ran about 3,000 sign-in attempts a minute — Microsoft’s own reporting on that botnet describes a deliberately low-and-slow pattern, often one attempt per account per day. What is unambiguous is that attackers are automating at scale and increasingly targeting the AI toolchain itself: the poisoned LiteLLM release and the Railway campaign aimed at AI-inference providers are this month’s proof. Either way the defensive lesson holds — assume faster, higher-volume attacks and make identity and supply-chain controls the priority. On the risk of ungoverned models in your own stack, see our primer on abliterated models.

Separately, regional reporting — single-source at the time of writing, so treat it as unverified — claimed AI was used in intrusions at 16 South Korean financial institutions. The honest read across all of this: AI is clearly accelerating and scaling parts of attacks (reconnaissance, phishing, credential attacks, triage), but sweeping "the AI did the whole hack" headlines have repeatedly outrun the evidence this year. Weight confirmed disclosures over threat-actor and second-hand claims.

What to do this week

• Patch PHP2Shell everywhere — there is no partial mitigation — and audit for LiteLLM 1.107.0, rebuilding and rotating anything it touched.
• Rotate secrets held with any affected hosting platform (Zeabur, Railway) and review access logs for misuse.
• Lock down application identities and OAuth tokens — the recurring entry point this month — with least privilege, expiry and regular re-consent.
• Treat SaaS as in-scope vendor risk. Inventory learning, HR, backup and developer platforms and what data each holds; score them with our Vendor Risk Scorecard.
• Build in layers so one compromised credential is not game over — see defense in depth — and put a defensible figure on exposure with the Breach Cost calculator.

Frequently asked questions

Biggest attacks of October 2026? The PHP2Shell RCE flaws, the poisoned LiteLLM 1.107.0 package and the ConnectWise Cloud Backup compromise; plus breaches at ETS, Denmark’s population register, Zeabur, Railway, Burger King Japan, GMO Onamae and Nikkei.

How were the severity scores decided? A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only.

Is AI now attacking on its own? The documented case is Anthropic’s November 2025 report of a largely AI-run espionage campaign. Several specific October claims about AI agents and extreme-rate logins were not supported by primary sources.

Were the ransomware gangs’ numbers real? Treat them as unverified marketing: Everest’s 590 GB PwC figure and Rhysida’s 2.6 TB Anne Arundel figure are claims the organisations did not confirm.

What to do first? Patch PHP2Shell, audit for LiteLLM 1.107.0, rotate hosting-platform secrets, lock down OAuth app identities, and treat SaaS as in-scope vendor risk.