Black October: Many attacks had been running for months
A widely shared X post called this week “Black October” and cybersecurity’s worst 48 hours. The surge was mainly in disclosures; many attacks began weeks or months earlier. Many cases share a pattern of stolen credentials, compromised delivery channels and platforms serving large customer bases.
Key takeaways
- The surge mainly concerns disclosures. Possible access at Paradigm Healthcare Services occurred in October 2025; the AOMEI Backupper incidents occurred in May and July 2026.
- Stolen credentials and keys expose platforms with many customers. Data from 321,810 accounts was stolen at Zeabur, while an estimated 400,000 websites were vulnerable through UpdraftPlus.
- AI helped find vulnerabilities in individual cases. Wiz Research says the PHP2Shell vulnerabilities were discovered using frontier AI models; the UK’s National Cyber Security Centre (NCSC) has advised preparing for a patch wave since May.
Related: When the security stack grows faster than the strategy · OpenSSL: What vendors must now demonstrate
A term from an X post
At 03:42 UTC on 22 October, the AISafetyMemes account published a widely shared X post. It described the preceding 48 hours as the worst in cybersecurity history, adding the name “Black October”. Its numbered list ranged from PHP2Shell, certificate authority eMudhra, California’s student data and the Railway and Zeabur platforms to LiteLLM, GitLab, Cairn, Ahold Delhaize and Onamae.
Between 19 and 22 October, authorities, vendors and researchers did disclose a long series of serious incidents. The underlying attacks often date back weeks or months.
What is a supply chain attack? In a supply chain attack, attackers tamper with a vendor’s software, services or distribution channels to enter customer systems through regular deliveries such as updates. The malicious code comes from a source customers trust. At AOMEI Backupper, changing two configuration files on the vendor’s servers was enough.
Attacks predating the disclosure week
An attack on Educational Testing Service (ETS), a testing contractor for the California Department of Education (CDE), exposed data on all children who attended public schools in the past three years, including disability status and testing accommodations. Attackers copied the data from 22 May to 18 September through an SFTP site, a server for Secure File Transfer Protocol transfers. Access came through a compromised login. ETS discovered the breach on 25 September; notification of families began on 16 October. According to the Los Angeles Times, the number affected is well above the current 5.7 million students, because the records extend back to 2023 enrolments.
| Fact | Source |
|---|---|
| According to ETS, attackers copied the data from 22 May to 18 September 2026 through an SFTP site. ETS discovered the breach on 25 September; the state began notifying families on 16 October, with notifications continuing into November. | Source |
| Paradigm detected unauthorised access on 13 October 2025; files containing names, dates of birth, gender and Medi-Cal membership numbers may have been viewed between 8 and 15 October 2025. Notification letters are dated 14 September 2026. | Source |
| Palo Alto Networks disclosed and patched CVE-2026-0257 on 13 May, initially rating it medium severity; Rapid7 reported attacks from 17 May. | Source |
| Three windows are confirmed: 28 May 2026 (10 minutes), 16 July 2026 (6 minutes) and 20 July 2026 (5 minutes). Affected organisations included IT service providers, telecommunications companies and universities in 11 countries. | Source |
| PingCAP, the vendor behind the TiDB database, reported that an unauthorised party used stolen service account credentials to access internal systems between 9 September and 7 October 2026, copying data and stealing source code. It said there was no evidence that data stored in TiDB was affected. | Source |
| Kaspersky’s Global Research and Analysis Team (GReAT) presented Operation FlashHole, a cyberespionage campaign attributed to the Lazarus group. Active since at least July 2025, it targeted at least three South Korean organisations in construction, software and wired communications equipment manufacturing. | Source |
| A security researcher documented attackers using 333 compromised Tor exit relays from 2 October 2026 to redirect Secure Shell (SSH) connections to twelve interception servers and steal passwords. The relays represented around ten per cent of exit relays. They were blocked and shut down by 5 October 2026. | Source |
Paradigm Healthcare Services, a billing provider for California’s Medicaid programme Medi-Cal, detected unauthorised access on 13 October 2025 and has now reported more than 970,000 people affected to the US Department of Health and Human Services (HHS).
CVE-2026-0257 in Palo Alto Networks’ PAN-OS has been patched since 13 May; Rapid7 reported attacks from 17 May. Since early June, Unit 42 has investigated cases in sectors including education, finance and healthcare. Unit 42 has observed exploitation attempts by the ransomware groups Qilin and Inc, which encrypt data and demand ransoms.
Stolen credentials and keys
At PingCAP, the vendor behind the TiDB database, an unauthorised party accessed internal systems between 9 September and 7 October. The attacker used stolen credentials for a service account, a technical account, and stole source code. Zeabur is shutting down after its second incident in two months. An attacker used internal credentials stored in plaintext and stole data from 321,810 accounts, along with around 3.2 million environment variable records, where applications store configuration values and keys. The admin tokens never expired and had not been rotated since January 2024.
Report on developer platform Zeabur’s second security incident in two months: an attacker used internal credentials stored in plaintext, read the platform database and stole data from 321,810 accounts and around 3.2 million environment variable records. The admin tokens never expired and had not been rotated since January 2024. Zeabur is shutting down. Source
On 20 October 2026, GMO confirmed unauthorised access to Onamae.com Desktop Cloud and the installation of unauthorised programs in some customer server environments. The number of potentially affected servers is 26,739; all plans are being shut down in stages from 4:00 local time on 21 October 2026. Source
On 21 October, Railway reported that an unauthorised party may have accessed encrypted environment variables and decrypted some of them. The platform paused all deployments and recommended rotating all variables, application programming interface (API) keys and registry credentials.
Cairn is an open-source AI platform that coordinates AI agents towards a goal and can operate as an autonomous penetration testing engine. NorForge found more than 20 control panels exposed online, which attackers likely used to automate attacks with Cairn. Of hundreds of secrets in the panel data, 11 per cent were valid. According to Reuters, the largest cluster, which was Chinese-speaking, breached over 100 companies, including John Deere and SharkNinja.
On 20 October, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), US Secret Service, Rhineland-Palatinate State Criminal Police Office and British investigators jointly warned about the ransomware group SafePay, with at least 600 victims. Its entry points include stolen or guessed passwords, vulnerabilities in security products and phishing.
Delivery channels and platforms with broad reach
At AOMEI Backupper, attackers changed two configuration files on the vendor’s servers. The software then downloaded the CROSSROAD dropper, which installed Radmin and the SHINYROAD backdoor. Google Threat Intelligence Group and Mandiant attribute the brief tampering windows to UNC7017. Three are confirmed: 10 minutes on 28 May, 6 minutes on 16 July and 5 minutes on 20 July.
At OVHcloud, an attacker took over a developer’s GitHub account and modified versions 0.11.0 to 0.15.0 of the command-line interface (CLI). The tampered version was available on 19 October from 14:47 to 16:21.
Through teamupdraft.com, an attacker used the connection to customer sites over the weekend of 17/18 October, creating admin accounts and installing malicious plugins. Patchstack counted 99 different names for these backdoors. An estimated 400,000 websites with an UpdraftCentral or Migrator key were vulnerable. Updates 1.26.13 and 2.26.13, respectively, released on 19 October, revoke the UpdraftCentral keys. For the AI gateway library LiteLLM, all version 1.107.0 wheel packages on the Python Package Index (PyPI) contained a credential stealer and a loader for external code.
At GMO Internet, 26,739 Onamae.com Desktop Cloud servers may be affected; all plans have been going offline in stages since 21 October. Bullhorn, which says it serves more than 10,000 customers, shut down its recruiting platform. Following the incident reported on 12 October, Ahold Delhaize took most brands’ websites and apps offline in Europe and the US; stores remained open.
AI in vulnerability discovery and exploitation
The week’s warnings do not attribute the surge itself to AI. Evidence supports broader findings and individual cases such as the abuse of the AI tool Cairn. The UK’s NCSC has advised all organisations since 1 May to prepare for a patch wave. It says AI in capable hands can exploit technical debt quickly and at scale.
In its PHP2Shell warning on 21 October, the NCSC explicitly refers to this advice and recommends taking unpatched systems offline if necessary. The two vulnerabilities can allow unauthenticated code execution on all PHP installations serving web requests. Versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the flaws. The article PHP vulnerabilities: Security authorities advise shutting systems down describes how authorities in Germany, Austria and the Netherlands responded.
According to Wiz Research, the vulnerabilities were found using frontier AI models; the bugs had been in the code for more than a decade. Rapid7 says 8 per cent of the threat reports analysed identified AI as an operational component of attacks.
From next Monday, 26 October, the curl project will make low- and medium-severity vulnerability reports public. The project cites a flood of reports overwhelming the team. PostgreSQL 19 has been delayed and is now scheduled for 19 November. According to committer Peter Eisentraut, code reviews assisted by large language models (LLMs) found many bugs much faster; eight to ten major features were deferred.
Three checks after the disclosure week
– Set expiry dates for secrets and rotate them: Zeabur’s admin tokens never expired; after its incident, Railway recommended rotating all variables, API keys and registry credentials. – Lock down update and release channels: OVHcloud’s CLI versions could be replaced because GitHub release immutability was disabled. – Measure patching time against exploitation time: Rapid7 recorded an average of three days between disclosure and exploitation of severe vulnerabilities in the third quarter, yet the PAN-OS vulnerability patched on 13 May remains under attack.
Frequently asked questions
Each question is locked. Tap to unlock the answer.
Is the Signal vulnerability in RingRTC already being exploited?
The US agency CISA’s Known Exploited Vulnerabilities Catalog does not list CVE-2026-113380. If a call participant overloads the event queue, this vulnerability, rated 9.3 under the Common Vulnerability Scoring System (CVSS), can prevent a call from ending, leaving audio and potentially video active. It has been fixed since September in RingRTC 2.72.0.
How serious are the new NGINX vulnerabilities?
F5 rates three memory bugs 9.2, classifying them as critical. The NGINX project rates the same vulnerabilities “medium”. Each requires an explicitly configured directive; versions 1.30.6 and 1.31.7, released on 14 October, fix them.
Which Siemens vulnerability is being actively exploited?
Siemens confirms attacks on CVE-2026-110936 in Siemens Software Center; CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on Tuesday. Exploiting the flaw, which has a CVSS v4 score of 8.4, attackers combined a validly signed program copy with their own dynamic-link library (DLL) files, which version 3.5.8.7 loaded without verification. It is fixed in version 4.0.9.8; Siemens attributes the attacks to the Romulus ClickFix campaign.
More from the MBF Media Network
cloudmagazinGoogle counters Meta with top AI at half the priceDigital ChiefsMicrosoft: Germany Is EU’s Top Cyberattack Target
Image source: AI-generated (October 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
