Security incidents in October 2026

Ransomware is targeting Synology NAS storage devices running outdated DSM. Update to the latest DSM your model supports, enable automatic updates and keep the management interface off the public internet. Fixes are available.

A low-rated Broadcom VMware ESX flaw (CVE-2026-41709) that lets an admin act without leaving logs is now on CISA's exploited list. Mainly a business issue: if you run ESX 8.0, 9.0 or 9.1, install the July builds. No workaround exists.

Cisco says attackers are exploiting CVE-2026-76418, which lets anyone on the internet make ASA and FTD firewalls with SSL VPN reload. Fixed releases are out. Businesses and IT providers should upgrade now; homes are unlikely to run these.

CISA says attackers are using CVE-2026-48356, a critical file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026. Store owners should apply the July patch for their version and check for files uploaded earlier, since patching doesn't remove them.

Attackers are using a critical flaw in Nextcloud's optional Built-in CODE Server app (richdocumentscode) to plant web shells. Update it to 26.4.303 or remove it; disabling is not enough. Check for unknown PHP files if it was exposed.

Arista's on-premises VeloCloud Orchestrator has a critical SQL injection flaw (CVE-2026-114625) that attackers are exploiting. Fixes are out: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you run it, update and limit who can reach its web interface.

Attackers are targeting a Brotli flaw in business software and potentially WordPress hosting. Ask IT or your website host to patch every affected library and bundled copy, then restart or redeploy services. Some vendor fixes remain pending.

Attackers are exploiting SiteGuard Server Edition’s statistics feature to run commands with full server privileges. Website operators should preserve diagnostic information, then install the fixed version or vendor patch.

PHP2Shell lets attackers run code on vulnerable web servers without logging in. The original two flaws have PHP fixes, but bundled-product updates remain uneven and a separate follow-up awaits release. Ask your website host or IT team to confirm protection.

Plex2Shell attacks target internet-accessible Plex Media Servers, installing miners and routing strangers’ traffic through victims’ connections. Update to 1.43.3.10861 or later; an already compromised server also needs cleaning or rebuilding.

Fortinet says CVE-2025-61624, a CLI file write/delete flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, is exploited. It needs a privileged login. Update to FortiOS 7.4.10/7.6.5 or later; older branches have no fix and must migrate.

BeyondTrust Remote Support has a critical login-bypass flaw (CVE-2026-102764) attackers used from late August. Cloud customers are already patched. Self-hosted IT teams should apply BT26-05-RS now and check for earlier compromise.

Siemens Software Center before V4.0.9.8 has a DLL side-loading flaw (CVE-2026-110936) that attackers are using, tied to the Romulus ClickFix campaign. Update to V4.0.9.8 or later, get Siemens software only from Siemens, and never paste web-page commands into Run or PowerShell.

Palo Alto PAN-OS firewalls and Panorama have a flaw (CVE-2026-0322) that lets someone with a management login run code as root. Attacks are confirmed but limited. Update to your branch's fixed version and keep the management interface off the internet.

Cisco Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) is being exploited. A crafted email attachment can give an unauthenticated attacker root. Fixes exist (15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525). Businesses running the gateway should update now.

Ivanti Connect Secure VPN appliances have a login-bypass flaw (CVE-2026-104935) that lets attackers run commands without an account, and it is being used in attacks. If you run one, update now: 25.1.1.2, 25.1.3.x or 22.8R2.5. Home users are not affected.

Microsoft fixed CVE-2026-96951 on 13 Oct 2026, a Windows Shell flaw already used in attacks to bypass Mark of the Web warnings on downloaded files. CISA lists it as exploited. Install the October Windows updates now and be wary of unexpected files.

GitLab's CVSS 10 flaw CVE-2026-97229 lets anyone run code on a self-managed GitLab server without logging in, and CISA says it's being exploited. Fixed in 19.4.2, 19.3.5 and 19.2.8. If you run your own GitLab, update now. GitLab.com is already patched.

A 2015 flaw in the BIND DNS server (CVE-2015-5477) was added to CISA's exploited list on 8 Oct 2026. One crafted packet can crash named. Fixed since 2015 in 9.9.7-P2 and 9.10.2-P3. Home users: nothing to do. Anyone running old BIND: update.

CISA says attackers are using a 2023 Strapi flaw (CVE-2023-22894) that leaks user password hashes and reset tokens, and that can be chained to run code. Fixed in Strapi 4.8.0. If you run Strapi, update to the latest v4 and move off v3.

CISA says attackers are using CVE-2015-3306, a 2015 ProFTPD flaw that lets anyone read and write files via SITE CPFR/CPTO. If you run ProFTPD with mod_copy, update it or disable mod_copy. Home users are unlikely to be affected.

CISA says attackers are exploiting CVE-2021-3199, a 2021 flaw in old ONLYOFFICE Docs servers (before 5.6.3, JWT in use) that can give them remote code execution. If your organisation runs ONLYOFFICE Docs, confirm it is current; ONLYOFFICE recommends 10.0.

CISA says attackers are using CVE-2016-3081, an old Apache Struts 2 flaw that lets them run code on a server. Fixes have existed for years. Businesses running Struts 2.3.20 to 2.3.28 should update to 2.3.20.3, 2.3.24.3 or 2.3.28.1, or switch off Dynamic Method Invocation.

A critical Atlassian flaw (CVE-2026-21589) lets anyone on the internet read files in Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye Data Center. It is being exploited. Patch now, or take the server off the internet.

Attackers are chaining two flaws in Ahsay's AhsayCBS backup server to run commands without a password. Ahsay's first patches were incomplete. IT providers should install hotfix v10.3.4.45 or v9.15.2.70, reboot, and check for web shells and miners.

Attackers are using CVE-2026-88779 to disrupt Citrix NetScaler ADC and Gateway appliances configured for SAML single sign-on. Fixes cover all affected supported branches. Ask your IT provider to check and update, even after earlier NetScaler patches.

Two Zammad helpdesk flaws, CVE-2026-102489 (remote code execution, 6.5 and older) and CVE-2026-102490 (local root, DEB/RPM packages), were used against DIVD. Update to Zammad 7.2.2 or later; 6.5 and older get no regular security fixes.

Fortinet FortiMail email gateways have a critical flaw (CVE-2026-104286) that lets anyone on the internet write files without logging in. It is being exploited. Update to 8.0.2, 7.6.7 or 7.4.9; 7.2 awaits 7.2.10 and 7.0 has no fix. Cloud is already fixed.

Four critical Chrome flaws could let malicious web pages run code, including outside Chrome's protective sandbox. Fixes are available for desktop and Android. Update Chrome and relaunch it; Chromebook users should install the latest ChromeOS update.

Eight eMudhra certificate keys could be recovered and used to impersonate websites. Major browsers have protections, but some apps still need separate fixes. Update browsers, operating systems and apps; malicious interception remains unconfirmed.

Revolve says an attacker may have obtained shoppers’ saved card numbers, expiry dates and contact details. A filing tracker puts the potential total at 1.5 million. Check your breach notice, review transactions and contact your card issuer.

Binance is expanding withdrawals after a US$6.34 billion theft. It now reports 98% of affected tokens replenished and says it will cover losses. Customers should check their exact asset and network in Binance’s official app or website.

Florida says a student financial aid website breach may affect 4.9 million people. Past applicants should check the official notice, review financial accounts and credit reports, and consider a credit freeze or fraud alert.

UNM Health's 26 October cyberattack disrupted patient care. UNM says clinical services are restored, although an IT disruption alert remains open. Confirm cancelled care with your clinic and ignore anyone offering attack-related compensation.

Quest Diagnostics says an intruder accessed patient records in Quanum LSM, the system clients use to order tests and get results. Quest says it is remediated, but the data and patient count are unknown. Watch for phishing and wait for a Quest letter.

Indian exchange CoinDCX lost about US$16M in USDT on 21 Oct from old deposit addresses it said were retired. It says it absorbed the loss and user balances are unaffected; Tether froze about US$2.2M. Customers need not act, but keep funds off any exchange you don't need.

GMO’s Onamae.com Desktop Cloud breach affects customers using hosted desktops, including FX traders. GMO revised its shutdown advice on 28 October: scan and back up before reusing PCs, reset trading passwords from another device and end all sessions.

Sony’s Japanese So-net service lost 2,585,481 customer records, including plala (S Course) customers, plus 54,401 email credentials. Affected email users must reset their passwords through So-net’s official website. Watch for impersonation scams.

Capcom says attackers took 11.77 million CAPCOM ID records (emails, login dates, last IP address) and changed passwords on 196 accounts, now reset. Expect phishing pretending to be Capcom. Don't click links in unexpected messages; no card data was involved.

Targeted advertisements delivered Candiru spyware to Al Jazeera devices without a click. Advertising platforms restricted Discover-Tech, but no complete remedy is confirmed. Block ads and seek specialist help if you face targeted surveillance.

Ahold Delhaize’s cyberattack disrupted supermarket apps and orders across Europe and the US. Services returned in stages, but a group-wide all-clear remains unconfirmed. Check orders and refunds directly through your supermarket.

ASOS customers got a rogue 'ASOS HACKED' app alert on 6 Oct after attackers used a phished employee login. Names, contact details and search history were taken; ASOS says cards and passwords weren't. Ignore its link and treat unexpected ASOS messages with suspicion.

Denmark's population register exposed names, addresses and CPR identification numbers for about 8.8 million people through misused company access. Access was blocked; investigations continue. Treat callers who know these details with caution.

Attackers accessed Burger King Japan’s app membership system on 2–7 October, exposing about 11.18 million records. Card numbers were not held there; password leakage was not confirmed. Watch for impersonation emails, texts and calls.

An intruder copied California pupils’ records from ETS, including disability information for some. Current and former pupils are affected. Use CDE’s official notice to enrol in two years of free identity protection by 19 March 2027.

Unauthorised access at Amadeus exposed airline booking data, including some passport numbers. JAL reports 92,000 affected customers, ANA 37,800 and Cathay 53,000 bookings. Check airline notices and verify unexpected travel messages directly.

Malicious Claude Code extensions in Cursor potentially exposed up to 5,000 developers. Distribution has stopped, but affected computers need investigation and cleanup: updating or uninstalling the extension alone does not remove its backdoor components.

Socket found 264 more Chrome extensions that redirect searches through the operators' servers, bringing the total to 319 and about 13.4 million installs. Check your extensions list and default search engine, and remove anything you didn't choose.

A hijacked website script stole about US$2.7 million from Polymarket traders. Trading has resumed and refunds are automatic, but reimbursement is not confirmed complete. Check your positions, balances and refund amount.

Ledger wallets sold through CryptoBilis contained cryptocurrency-stealing implants; one Trezor Safe 5 is also suspected. Affected buyers should move funds to a trusted, newly created wallet with a new recovery phrase. Reusing the old phrase leaves funds exposed.

Bitdefender found Midnight Mimosa malware preinstalled in cheap MediaTek Android phones (Doogee, Cubot, fake-brand clones) in 150+ countries. It can silently install apps and use the phone as a proxy. Can't be uninstalled; check for a maker firmware update or replace the phone.

A fake Padre Terminal app on Apple's App Store took imported Solana wallet keys and is linked to about US$23,000 stolen from 27 wallets. Apple removed it. Never import wallet keys into an app; the real Padre/Terminal service is web-only.