Threat and Vulnerabilities Report - October 2026

Executive Summary

October marked CybersecurityAwareness Month, yet threat actors treated the month as an open invitationrather than a warning. Defenders faced a steady stream of newly weaponizedflaws, a crowded CISA KEV catalog, and ransomware operations that showed nosign of slowing. The month underscored a simple truth: awareness alone did notclose the gap between disclosure and exploitation.

CISA added 36 vulnerabilitiesto the Known Exploited Vulnerabilities (KEV) catalog in October, confirmingreal-world exploitation across a wide spread of enterprise and consumertechnologies. Plex led the vendor tally with four additions, while Ivanti, Cisco,and Zammad each contributed two entries to the list. The PHP2Shellvulnerability also earned a place in the catalog, alongside Fortinet, a vendorthat has become a recurring name in KEV updates. The volume of additionsreflected how quickly attackers moved from disclosure to active abuse, leavingorganizations with shrinking windows to patch.

Beyond the KEV additions,active exploitation surfaced across a broad mix of perimeter, application, andendpoint technologies. Network and security appliances from Palo Alto Networks,Cisco, Fortinet, and SonicWall remained prime targets, reinforcing the attackerfocus on edge devices that offered direct paths into corporate networks.Exploitation also extended to Redis, MediaWiki, and WordPress Core, exposingdatabases and widely deployed web platforms to compromise. AMD Radeon Graphicsrounded out the list, a reminder that driver and hardware-level components alsodrew adversary attention during the month.

The ransomware landscape inOctober was defined by a two-horse race at the top. The Gentlemen claimed thelead with 138 affected organizations, edging out Qilin, which listed 132victims and maintained the relentless pace seen in previous months. A steepdrop followed, with Akira reporting 32 victims, Silent Ransom 30, and Everest25. Together, the top five groups accounted for 357 affected organizations,with The Gentlemen and Qilin alone responsible for more than 75 percent of thattotal, signaling a concentration of ransomware activity among a small number ofhighly active operations.