Black October 2026: The Cyberattacks That Defined the Month

Every October, the security industry marks Cybersecurity Awareness Month. In 2026, attackers marked it too, draining $6.3 billion from Binance, stealing Pentagon personnel records and turning more than 86,000 Fortinet firewalls into open doors, all within the same 31 days.

Executive Summary for CISOs

October 2026 showed that the controls most organizations relied on did not fail at random. They failed in the same few places across unrelated incidents.

• Vendor and application identities bypassed user-centric controls. In one tenant, a ConnectWise application granted itself Global Administrator, with no user credential or MFA prompt involved. ‍
• Exploitation outpaced patch cycles. Plex2Shell attacks began one day after technical details went public, and PHP2Shell was probed four days before its fix shipped. ‍
• Single providers created mass-victim events. One ransomware attack on IDCF Cloud affected 495 companies and local governments. ‍
• Most incidents had no named attacker at disclosure. Attribution-led threat models had little to work with.

Vendor assurances did not equal safety. PwC said the breached vendor platform held no client data, sensitive personal information or financial records, yet an extortion group still claimed 590 GB.  

Three decisions for the quarter: move internet-facing patching to a KEV-driven weekly cycle, govern non-human identities with the same rigor as privileged users, and require recoverable backups that sit outside every primary cloud provider.

Black October by the Numbers:

• $6.36 billion stolen from Binance in a single night
• 86,644 Fortinet devices compromised in the FortiBleed campaign
• 3.05 million records exposed in the Pentagon DMDC breach
• 1,413 CVEs fixed in Microsoft’s October Patch Tuesday
• 1,127 ransomware leak-site victims, up 25.8% from September

The 27 Incidents at a Glance

Binance Hack in October 2026: The Largest Crypto Theft on Record

What happened: The most severe incident of the month came two days before it ended. On October 29, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it within roughly 20 minutes from 20:05 UTC. The theft was the largest on record and dwarfed the $1.5 billion Bybit theft of 2025.

How it started: Binance pointed to a compromised DevOps engineer laptop and additional points of breach as the preliminary entry route. Freezes recovered about $3 billion on-chain.

Who did it: The FBI attributed the theft to North Korea’s TraderTraitor group on October 31 and published hundreds of attacker wallet addresses.

Government Data Breaches Disclosed in October 2026

Pentagon

Millions of current and former military personnel and their families received breach notices after attackers stole records from the Defense Manpower Data Center (DMDC). The intruders held access from October 2025 to July 2026. The breach affected 2.76 million living individuals and 294,000 deceased individuals. Attackers entered through a vulnerability in an unspecified file-sharing system, and the exposed data included Social Security numbers, names, dates of birth and service details.

Rajasthan Police

ScarlettGroup claimed it held about 70,000 identity records and 59,460 mobile numbers from the Rajasthan Police. The authenticity and full extent of the breach remained unverified. The claim still triggered a probe by the state police cyber team and IT department, and police staff were told to change their email passwords.

Firewall and VPN Attacks in October 2026: FortiBleed, Ivanti and Cisco

FortiBleed

The FBI and US Secret Service warned on October 6 that FortiBleed remained an active, global credential-compromise campaign against FortiGate firewalls and SSL VPN gateways. SOCRadar verified more than 86,644 compromised devices across 194 countries. Fortinet maintained that FortiBleed was not a new vulnerability. It attributed the campaign to reused credentials, brute force against devices without MFA, and offline cracking of legacy password hashes. Fortinet shipped hardening releases on October 22. Hudson Rock’s FortiBleed 2.0 research then found 40,573 records with cleartext secrets in FortiGate configuration reports.

Ivanti Connect Secure

Volexity reported that UTA0576 chained vulnerabilities to gain unauthenticated root access to an appliance running 22.8R2.4, starting October 3. Ivanti disclosed CVE-2026-104935 on October 13, and CISA added it to the KEV catalog the same day. CVE-2026-111357 and CVE-2026-118527 followed into the KEV catalog on October 30.

Cisco ASA and FTD

In late October 2026, attackers abused CVE-2026-76418 to force Cisco ASA and FTD firewalls into unexpected reloads, and Cisco released fixes for the flaw. CISA added it to the KEV catalog on October 29 with a federal due date of November 1. More than 51,000 Cisco ASA SSL VPN devices sat exposed online.

Critical Vulnerabilities in October 2026

Disclosure no longer bought defenders time.

PHP2Shell

PHP shipped emergency releases on October 21 for two flaws rated CVSS 9.2. Details had leaked the day before, and Amazon honeypots recorded an exploitation attempt on October 17, four days before the fix. VirusTotal estimated more than 5.1 million PHP hosts exposed online. Government, school and hospital websites went offline temporarily while operators responded.

Node.js

The project fixed ten vulnerabilities on October 21. The most serious was CVE-2026-111497, a Brotli decoder out-of-bounds write that could lead to remote code execution, alongside DNS and TLS validation flaws.

GitLab

GitLab fixed CVE-2026-110264, rated CVSS 10.0, on October 21. A crafted regular expression let an unauthenticated attacker run code on self-managed servers, and the affected ranges included releases that had fixed the earlier CVE-2026-97229.

Plex2Shell

The exploitation window shrank to a single day. Technical details went public on October 16 and attacks followed on October 17. Attackers deployed cryptocurrency miners and proxy software, and CISA added the four chained vulnerabilities to its KEV catalog on October 20.

Windows

The October Patch Tuesday fixed a record 1,413 CVEs, including CVE-2026-96951, an exploited Windows Shell flaw that let attackers evade Mark of the Web defenses.

Supply Chain and API Key Attacks in October 2026:

Black October’s defining pattern was inherited trust. Attackers rarely forced their way in. They used access that organizations had already granted to vendors, apps and automation.

Storm-0940 and ConnectWise

ConnectWise disclosed unauthorized access to Cloud Backup application identities on October 16. Huntress saw attacker sign-ins in almost 1,000 tenants, more than 300 of them successful, and in one tenant the application granted itself Global Administrator. Microsoft attributed the campaign on October 21 to the China-state-aligned Storm-0940, which used the open-source ARTEX agentic penetration-testing framework. Storm-0940 then tried to access more than 2,250 tenants with the stolen application identities.

LiteLLM PyPI malware

The compromise traced back to one unrevoked secret. An internal master key leaked to a public repository on May 27 and was never revoked. On October 10, an attacker used it to retrieve a privileged GitHub token, which led to malicious artifacts on PyPI and container registries on October 21. The payload ran on every Python start and went after cloud keys, AI API keys, SSH keys and browser passwords.

OpenCode and Railway

AI platforms that stored customer keys became targets in their own right. OpenCode disclosed an October 17 breach of its Console service, tied to a large-scale distillation attack affecting 1.4% of Console users with linked AI provider keys. Anthropic revoked affected Claude API keys, and one user reported $1,700 in losses. Railway found that encrypted customer secrets were exposed and some were decrypted. Its preliminary investigation suggested the attacker wanted AI provider API keys, possibly for model distillation.

Zeabur

Attackers used leaked internal credentials to reach customer environment variables. Investigators found that credentials had not been fully rotated after an August incident. Zeabur later announced it would shut down.

AI-Powered Cyberattacks in October 2026

October 2026 was the month AI-driven intrusion moved from prediction to documented reality.

Cairn

A Chinese-speaking operator used AI agents to attempt more than 1,200 sites and broke into websites of more than 100 companies, including Deere, SharkNinja and Cummins, for roughly $5,000 in token spend. NorForge put the cost at about $50 per successful hack.

Chainalysis

The company said external attackers reached its systems and internal tools in early October using what it described as agentic technology, exposing some customers’ names, email addresses and job titles.

Ransomware, Extortion and Data Breaches in October 2026

Ransomware volume climbed alongside the identity attacks. HackerFeeds counted 1,127 victims on ransomware leak sites in October, up 25.8% from 896 in September.

IDCF Cloud

A single provider outage cascaded into hundreds of victims. Ransomware took down part of SoftBank subsidiary IDC Frontier’s IDCF Cloud on October 7, affecting 495 companies and local governments. The attacker claimed it encrypted 225 databases holding 3.6 PB and wiped 554,153 snapshots.

Ahold Delhaize

The retailer detected malicious activity on October 12 and took brand websites and apps offline while stores stayed open.

Ampath Laboratories

ByteToBreach claimed it took data from at least 10 Ampath databases, including a lab admissions table with 80 million records. Ampath confirmed the hack but found no evidence that medical records, diagnoses or test results were compromised.

PwC

PwC confirmed on October 23 an incident at a third-party vendor hosting employee learning records, one day after Everest claimed it stole 590 GB of company data. Everest listed HR and learning exports, integration documentation, software components and e-learning courses. PwC said the platform held no client data, sensitive personal information or financial records.

Capcom and Sony

Consumer exposures reached eight figures. Capcom confirmed attackers breached CAPCOM ID, exposing more than 11.7 million customer email addresses. In addition, 196 accounts had their passwords changed without authorization. Sony Network Communications confirmed exposure of 2,585,481 So-net and plala records, including 54,401 email addresses with associated email passwords.

SBI and AU Small Finance Bank Data Leaks in October 2026

Indian banks faced a run of leak disclosures.

State Bank of India

SBI disclosed a dataset of about 375,000 records, of which 3,897 contained personal information. The original source was still under investigation.

AU Small Finance Bank

The bank learned of a potential leak on October 29 from a third-party SaaS platform holding about 28.5 lakh vehicle loan customers, which it identified as hosted by Salesforce. ScarlettGroup claimed the data included KYC records, PAN and Aadhaar details, credit reports and bank statements.

The same group was named in the Rajasthan Police claim, linking two of the month’s Indian incidents to one actor. Both followed the July 2026 Bank of Baroda leak, where a compromised employee email account allowed unauthorized access to certain data.

eMudhra Certificate Key Compromise in October 2026

Even the systems behind secure connections broke. CERT-In reported that the affected eMudhra P-384 private keys had values smaller than 256, and one widely cited key reportedly had the value 4. Mozilla blocked the affected certificates through OneCRL and pushed browser updates to extend protection.

Threat Actors Behind the October 2026 Cyberattacks

October 2026 Cyberattacks Mapped to MITRE ATT&CK

Mapped to MITRE ATT&CK, the 27 incidents clustered around a small set of techniques. The pattern showed where defenders lost ground: access that was already trusted, and credentials sitting in places attackers could reach.

Defenses That Didn’t Work in October 2026

• MFA did not protect workload identities - Storm-0940 never needed a user password. Huntress observed attacker sign-ins in almost 1,000 tenants through ConnectWise application identities, and in one tenant the application granted itself Global Administrator. MFA protected people, but the application identities never faced an MFA prompt. ‍
• File-based integrity checking missed in-memory attacks - Ivanti’s own integrity tool may not have detected the UTA0576 activity. The attacker patched library code only in memory and restored the configuration afterward, leaving nothing on disk for the tool to flag. ‍
• Backups on the same platform were destroyed with it - The IDCF Cloud attacker claimed it wiped 554,153 snapshots. Snapshots stored inside the compromised provider were not an independent recovery path. ‍
• Incident recovery without full credential rotation invited a second breach - Zeabur’s investigation found credentials had not been fully rotated after its August incident, and attackers used leaked credentials again in October. ‍
• Deleting a leaked secret did not revoke it - LiteLLM corrected the exposed commit but never revoked the master key, which an attacker used months later. OpenCode’s guidance made the same point: deleting a key from Console did not invalidate a copy someone else had already taken. ‍
• Monthly patching and CVSS-first prioritization lost the race - Plex2Shell exploitation began one day after details went public. KEV also lagged: PHP2Shell was still missing from the October 23 catalog despite reported exploitation attempts. ‍
• “Core systems unaffected” did not mean data was safe - AU Small Finance Bank said its own systems were unaffected, yet the potential leak involved a SaaS platform holding about 28.5 lakh vehicle loan customers. The data lived outside the core, on a platform the bank did not run.  ‍
• Security appliances became the entry point - Firewalls and VPN gateways, deployed to protect the perimeter, carried three of the month’s most severe campaigns: FortiBleed, Ivanti and Cisco. FortiBleed alone reached more than 86,644 compromised devices across 194 countries. ‍
• Key custody alone did not stop the Binance theft - Binance found no evidence that private keys leaked, but TRM assessed that attackers took control of the hot wallet signing infrastructure. Protecting the keys did not protect the system that used them.

What Did Work

Some controls held up under pressure:

• Fast certificate revocation - Mozilla blocked the affected eMudhra certificates through OneCRL and pushed updates. ‍
• On-chain freezes - about $3 billion of the Binance theft was frozen on-chain. ‍
• Provider-side key revocation - Anthropic revoked affected Claude API keys after the OpenCode breach.

What the October 2026 Incidents Proved About the Threat Landscape

1. AI changed both sides of the fight - Storm-0940, the Cairn operator and the Chainalysis intruders ran attacks at machine speed. Meanwhile, OpenCode and Railway showed that platforms storing AI provider keys had become prime targets for model distillation.  ‍
2. Extortion claims outran verification - Ampath, PwC, Rajasthan Police and AU Small Finance Bank all faced leak-site claims that the victims disputed or could not yet confirm.

What to Do Now: A Black October Response Checklist

1. Patch every October KEV entry within a week - Prioritize Ivanti Connect Secure, Cisco ASA/FTD, Plex Media Server and the Windows Shell fix, then PHP, Node.js and self-managed GitLab. ‍
2. Audit FortiGate credentials - Reset administrator and VPN passwords, enforce MFA on every FortiGate and SSL VPN account, upgrade to the October hardening releases, and treat any exported configuration file as exposed. ‍
3. Review third-party apps in Microsoft 365 and Entra ID - Disable unused vendor applications, look for credentials or certificates added since mid-October, and flag any application holding Global Administrator rights. ‍
4. Rotate AI provider and cloud API keys - Revoke keys stored in OpenCode Console, Railway, Zeabur or any environment that ran LiteLLM 1.107.0, then set provider-side spending limits and usage alerts. ‍
5. Lock down CI/CD and developer tokens - Revoke long-lived GitHub tokens, scan public repositories for leaked secrets, and restrict who can trigger release workflows. ‍
6. Map vendor data exposure - List every SaaS and third-party platform holding customer or employee data, including CRM, learning management and backup services. Confirm what each one stores and who can access it. ‍
7. Test backups outside the cloud provider - IDCF Cloud customers lost snapshots stored on the same platform. Keep at least one recoverable copy offline or with a separate provider. ‍
8. Prepare for extortion claims - Build a playbook for verifying leak-site claims, notifying regulators such as CERT-In and the RBI where required, and communicating before attackers set the narrative.

How LOVI Helps Security Teams Stay Ahead

Black October showed that the gap between disclosure and exploitation now runs in hours, not weeks. Closing that gap takes intelligence that is timely, structured and mapped to action. LOVI (Loginsoft Vulnerability Intelligence) delivers it across four areas:

1. Vulnerability intelligence - Every critical CVE gets a structured write-up covering vulnerability type, affected versions, patch status, exploitation activity and CISA KEV status, so teams can prioritize by real-world risk instead of CVSS alone. ‍
2. CISA KEV tracking - LOVI tracks KEV additions as they land and correlates each entry with active threat campaigns, exploit activity and affected products. ‍
3. Threat profiles - LOVI threat profiles document threat actors, malware families and campaigns like the ones behind Black October. Each profile captures actor names and aliases, targeted industries and countries, associated CVEs, malware families, references and a MITRE ATT&CK Navigator layer that maps observed techniques for detection engineering and threat hunting. ‍
4. Weekly and monthly intelligence reports - Recurring reports turn high-volume disclosure periods like Black October into prioritized, readable briefings for SOC teams, vulnerability managers and security leadership.

Questions Every CISO Should Have Asked After October 2026

1. Which third-party applications held privileged rights in Microsoft 365 or Entra ID, and when was each one last reviewed?
2. How many API keys, tokens and service account secrets existed across the environment, and how many had never been rotated?
3. Did at least one recoverable backup sit outside the primary cloud provider?
4. How quickly did internet-facing systems receive patches after a KEV addition: days or weeks?
5. Which vendors held customer or employee data, and what did each contract require them to disclose after a breach?
6. Had every firewall and VPN administrator account been reset and moved to MFA since FortiBleed surfaced?
7. Was there a playbook for verifying an extortion group’s leak-site claim before it became the public narrative?

Conclusion

Black October was not one coordinated campaign. It was a dense cluster of independent incidents that exposed the same structural weaknesses from different angles. Nation-state actors went after edge devices, exchange signing infrastructure and vendor identities. Cybercriminals industrialized credential reuse and AI-driven intrusion. Extortion groups turned unverified leak-site claims into headline events. The organizations that fared best treated KEV additions as same-week deadlines, inventoried every third-party application and API key with access to their environments, and rotated secrets as routine rather than crisis.

LOVI continues to track exploited vulnerabilities, threat actor campaigns and CISA KEV additions, delivering the threat profiles and intelligence security teams need to act before the next Black October arrives.

FAQs

Q1. What was the biggest cyberattack of October 2026?

The Binance hack on October 29 was the largest by financial impact, with about $6.36 billion moved across ten blockchains.

Q2. Who was behind the Binance hack?

The FBI attributed the theft to North Korea’s TraderTraitor group on October 31.

Q3. What was FortiBleed?

FortiBleed was a credential-compromise campaign against internet-facing FortiGate firewalls and SSL VPN gateways, with more than 86,644 compromised devices across 194 countries. Fortinet stated it was not a new vulnerability.

Q4. What is Storm-0940?

Storm-0940 is a China-state-aligned group that Microsoft linked to the ConnectWise Cloud Backup campaign, carried out with the ARTEX agentic framework.

Q5. How many people did the Pentagon breach affect?

The DMDC breach affected 2.76 million living individuals and 294,000 deceased individuals.

Q6. Was Ampath Laboratories hacked?

Ampath confirmed the hack but disputed ByteToBreach’s claim of 80 million records, saying there was no evidence that medical records, diagnoses or test results were compromised.

Q7. What did Everest claim to steal from PwC?

Everest claimed 590 GB of data. PwC confirmed a vendor incident but said the platform held no client data.

Q8. Which Indian organizations were breached in October 2026?

State Bank of India and AU Small Finance Bank disclosed data exposures, and ScarlettGroup claimed a breach of Rajasthan Police that remained unverified.

Q9. What was PHP2Shell?

PHP2Shell was the name for two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, emergency-patched on October 21.