{"id":25120,"date":"2026-10-22T09:42:50","date_gmt":"2026-10-22T09:42:50","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=25120"},"modified":"2026-10-22T13:19:35","modified_gmt":"2026-10-22T13:19:35","slug":"black-october-many-attacks-had-been-running-for-months","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/22\/black-october-many-attacks-had-been-running-for-months\/","title":{"rendered":"Black October: Many attacks had been running for months"},"content":{"rendered":"<p><strong>A widely shared X post called this week \u201cBlack October\u201d and cybersecurity&#8217;s worst 48 hours. The surge was mainly in disclosures; many attacks began weeks or months earlier. Many cases share a pattern of stolen credentials, compromised delivery channels and platforms serving large customer bases.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">The surge mainly concerns disclosures.<\/strong> Possible access at Paradigm Healthcare Services occurred in October 2025; the AOMEI Backupper incidents occurred in May and July 2026.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Stolen credentials and keys expose platforms with many customers.<\/strong> Data from 321,810 accounts was stolen at Zeabur, while an estimated 400,000 websites were vulnerable through UpdraftPlus.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">AI helped find vulnerabilities in individual cases.<\/strong> Wiz Research says the PHP2Shell vulnerabilities were discovered using frontier AI models; the UK&#8217;s National Cyber Security Centre (NCSC) has advised preparing for a patch wave since May.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/19\/when-the-security-stack-outgrows-the-strategy\/\">When the security stack grows faster than the strategy<\/a> &nbsp;\u00b7&nbsp; <a href=\"https:\/\/www.securitytoday.de\/2026\/10\/15\/openssl-cra-post-quantum-verantwortung\/\">OpenSSL: What vendors must now demonstrate<\/a><\/p>\n<h2>A term from an X post<\/h2>\n<p>At 03:42 UTC on 22 October, the AISafetyMemes account published a widely shared X post. It described the preceding 48 hours as <a href=\"https:\/\/x.com\/AISafetyMemes\/status\/2113113711644737835\">the worst in cybersecurity history<\/a>, adding the name \u201cBlack October\u201d. Its numbered list ranged from PHP2Shell, certificate authority eMudhra, California&#8217;s student data and the Railway and Zeabur platforms to LiteLLM, GitLab, Cairn, Ahold Delhaize and Onamae.<\/p>\n<p>Between 19 and 22 October, authorities, vendors and researchers did disclose a long series of serious incidents. The underlying attacks often date back weeks or months.<\/p>\n<p><strong>What is a supply chain attack?<\/strong> In a supply chain attack, attackers tamper with a vendor&#8217;s software, services or distribution channels to enter customer systems through regular deliveries such as updates. The malicious code comes from a source customers trust. At AOMEI Backupper, changing two configuration files on the vendor&#8217;s servers was enough.<\/p>\n<h2>Attacks predating the disclosure week<\/h2>\n<p>An attack on Educational Testing Service (ETS), a testing contractor for the California Department of Education (CDE), exposed data on <a href=\"https:\/\/therecord.media\/california-warns-all-public-school-students-of-data-breach\">all children who attended public schools in the past three years<\/a>, including disability status and testing accommodations. Attackers copied the data from 22 May to 18 September through an SFTP site, a server for Secure File Transfer Protocol transfers. Access came through a <a href=\"https:\/\/www.securityweek.com\/one-compromised-login-exposed-millions-of-california-students-records\/\">compromised login<\/a>. ETS discovered the breach on 25 September; notification of families began on 16 October. According to the Los Angeles Times, the number affected is <a href=\"https:\/\/www.latimes.com\/california\/story\/2026-10-16\/state-testing-student-data-hack\">well above the current 5.7 million students<\/a>, because the records extend back to 2023 enrolments.<\/p>\n<div style=\"overflow-x:auto;-webkit-overflow-scrolling:touch;margin:24px 0;\">\n<table style=\"width:100%;min-width:640px;border-collapse:collapse;font-size:0.92em;\">\n<thead style=\"\">\n<tr style=\"border-bottom:2px solid #69d8ed;\">\n<th style=\"text-align:left;padding:12px 14px;\">Fact<\/th>\n<th style=\"text-align:left;padding:12px 14px;\">Source<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">According to ETS, attackers copied the data from 22 May to 18 September 2026 through an SFTP site. ETS discovered the breach on 25 September; the state began notifying families on 16 October, with notifications continuing into November.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/therecord.media\/california-warns-all-public-school-students-of-data-breach\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Paradigm detected unauthorised access on 13 October 2025; files containing names, dates of birth, gender and Medi-Cal membership numbers may have been viewed between 8 and 15 October 2025. Notification letters are dated 14 September 2026.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.securityweek.com\/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach\/\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Palo Alto Networks disclosed and patched CVE-2026-0257 on 13 May, initially rating it medium severity; Rapid7 reported attacks from 17 May.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257\/\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Three windows are confirmed: 28 May 2026 (10 minutes), 16 July 2026 (6 minutes) and 20 July 2026 (5 minutes). Affected organisations included IT service providers, telecommunications companies and universities in 11 countries.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">PingCAP, the vendor behind the TiDB database, reported that an unauthorised party used stolen service account credentials to access internal systems between 9 September and 7 October 2026, copying data and stealing source code. It said there was no evidence that data stored in TiDB was affected.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Kaspersky&#8217;s Global Research and Analysis Team (GReAT) presented Operation FlashHole, a cyberespionage campaign attributed to the Lazarus group. Active since at least July 2025, it targeted at least three South Korean organisations in construction, software and wired communications equipment manufacturing.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.kaspersky.com\/about\/press-releases\/kaspersky-identifies-new-lazarus-apt-campaign-utilizing-ai-and-post-quantum-encryption\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">A security researcher documented attackers using 333 compromised Tor exit relays from 2 October 2026 to redirect Secure Shell (SSH) connections to twelve interception servers and steal passwords. The relays represented around ten per cent of exit relays. They were blocked and shut down by 5 October 2026.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/kaba.cx\/posts\/20261020_Tor\/\">Source<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Paradigm Healthcare Services, a billing provider for California&#8217;s Medicaid programme Medi-Cal, detected unauthorised access on 13 October 2025 and has now reported <a href=\"https:\/\/www.securityweek.com\/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach\/\">more than 970,000 people affected<\/a> to the US Department of Health and Human Services (HHS).<\/p>\n<p>CVE-2026-0257 in Palo Alto Networks&#8217; PAN-OS has been patched since 13 May; Rapid7 reported attacks <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257\/\">from 17 May<\/a>. Since <a href=\"https:\/\/unit42.paloaltonetworks.com\/active-exploitation-of-pan-os-cve-2026-0257\/\">early June<\/a>, Unit 42 has investigated cases in sectors including education, finance and healthcare. Unit 42 has observed exploitation attempts by the ransomware groups Qilin and Inc, which encrypt data and demand ransoms.<\/p>\n<h2>Stolen credentials and keys<\/h2>\n<p>At PingCAP, the vendor behind the TiDB database, an unauthorised party accessed internal systems <a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\">between 9 September and 7 October<\/a>. The attacker used stolen credentials for a service account, a technical account, and stole source code. Zeabur is shutting down after its second incident in two months. An attacker used internal credentials stored in plaintext and stole data from <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zeabur-shutting-down-after-second-security-breach-in-two-months\/\">321,810 accounts<\/a>, along with around 3.2 million environment variable records, where applications store configuration values and keys. The admin tokens never expired and had not been rotated since January 2024.<\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:16px;margin:32px 0;\">\n<div style=\"flex:1 1 200px;min-width:0;background:#003340;border:1px solid rgba(105,216,237,0.28);border-radius:10px;padding:22px 20px;box-sizing:border-box;\">\n<div style=\"font-size:1.7em;font-weight:800;color:#69d8ed;line-height:1.1;word-break:keep-all;\">321,810<\/div>\n<p style=\"margin:10px 0 0;font-size:0.88em;color:#e6e3da;line-height:1.5;\">Report on developer platform Zeabur&#8217;s second security incident in two months: an attacker used internal credentials stored in plaintext, read the platform database and stole data from 321,810 accounts and around 3.2 million environment variable records. The admin tokens never expired and had not been rotated since January 2024. Zeabur is shutting down. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zeabur-shutting-down-after-second-security-breach-in-two-months\/\" style=\"font-size:0.78em;color:#8fa3ab;\">Source<\/a><\/p>\n<\/div>\n<div style=\"flex:1 1 200px;min-width:0;background:#003340;border:1px solid rgba(105,216,237,0.28);border-radius:10px;padding:22px 20px;box-sizing:border-box;\">\n<div style=\"font-size:1.7em;font-weight:800;color:#69d8ed;line-height:1.1;word-break:keep-all;\">26,739<\/div>\n<p style=\"margin:10px 0 0;font-size:0.88em;color:#e6e3da;line-height:1.5;\">On 20 October 2026, GMO confirmed unauthorised access to Onamae.com Desktop Cloud and the installation of unauthorised programs in some customer server environments. The number of potentially affected servers is 26,739; all plans are being shut down in stages from 4:00 local time on 21 October 2026. <a href=\"https:\/\/www.onamae.com\/news\/article\/11584\" style=\"font-size:0.78em;color:#8fa3ab;\">Source<\/a><\/p>\n<\/div>\n<\/div>\n<p>On <a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\">21 October<\/a>, Railway reported that an unauthorised party may have accessed encrypted environment variables and decrypted some of them. The platform paused all deployments and recommended rotating all variables, application programming interface (API) keys and registry credentials.<\/p>\n<p>Cairn is an <a href=\"https:\/\/www.securityweek.com\/ai-platform-cairn-abused-to-hack-over-100-organizations\/\">open-source AI platform<\/a> that coordinates AI agents towards a goal and can operate as an autonomous penetration testing engine. NorForge found <a href=\"https:\/\/norforge.com\/blog\/inside_cairn\">more than 20 control panels exposed online<\/a>, which attackers likely used to automate attacks with Cairn. Of hundreds of secrets in the panel data, 11 per cent were valid. According to Reuters, the largest cluster, which was Chinese-speaking, breached over 100 companies, including John Deere and SharkNinja.<\/p>\n<p>On 20 October, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), US Secret Service, Rhineland-Palatinate State Criminal Police Office and British investigators jointly warned about the ransomware group SafePay, with <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa26-293a\">at least 600 victims<\/a>. Its entry points include stolen or guessed passwords, vulnerabilities in security products and phishing.<\/p>\n<h2>Delivery channels and platforms with broad reach<\/h2>\n<p>At AOMEI Backupper, attackers changed <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/20\/aomei-backupper-compromised-supply-chain\/\">two configuration files<\/a> on the vendor&#8217;s servers. The software then downloaded the CROSSROAD dropper, which installed Radmin and the SHINYROAD backdoor. Google Threat Intelligence Group and Mandiant attribute the <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/investigating-ephemeral-supply-chain-tampering\">brief tampering windows<\/a> to UNC7017. <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">Three are confirmed<\/a>: 10 minutes on 28 May, 6 minutes on 16 July and 5 minutes on 20 July.<\/p>\n<p>At OVHcloud, an attacker took over a developer&#8217;s GitHub account and modified versions 0.11.0 to 0.15.0 of the command-line interface (CLI). The tampered version was available on 19 October <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets\/\">from 14:47 to 16:21<\/a>.<\/p>\n<p>Through teamupdraft.com, an attacker used the connection to customer sites over the <a href=\"https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/\">weekend of 17\/18 October<\/a>, creating admin accounts and installing malicious plugins. Patchstack counted <a href=\"http:\/\/patchstack.com\/articles\/updraftcentral-key-compromise-wordpress-backdoors\/\">99 different names<\/a> for these backdoors. An estimated <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites\/\">400,000 websites<\/a> with an UpdraftCentral or Migrator key were vulnerable. Updates 1.26.13 and 2.26.13, respectively, released on 19 October, revoke the UpdraftCentral keys. For the AI gateway library LiteLLM, all <a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/47826\">version 1.107.0<\/a> wheel packages on the Python Package Index (PyPI) contained a credential stealer and a loader for external code.<\/p>\n<p>At GMO Internet, <a href=\"https:\/\/www.onamae.com\/news\/article\/11584\">26,739 Onamae.com Desktop Cloud servers<\/a> may be affected; all plans have been going offline in stages since 21 October. Bullhorn, which says it serves <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack\/\">more than 10,000 customers<\/a>, shut down its recruiting platform. Following the <a href=\"https:\/\/newsroom.aholddelhaize.com\/ahold-delhaize-update-on-status-of-cybersecurity-incident\/\">incident reported on 12 October<\/a>, Ahold Delhaize took most brands&#8217; websites and apps offline in Europe and the US; stores remained open.<\/p>\n<h2>AI in vulnerability discovery and exploitation<\/h2>\n<p>The week&#8217;s warnings do not attribute the surge itself to AI. Evidence supports broader findings and individual cases such as the abuse of the AI tool Cairn. The UK&#8217;s NCSC has advised all organisations <a href=\"https:\/\/www.ncsc.gov.uk\/blogs\/prepare-for-vulnerability-patch-wave\">since 1 May<\/a> to prepare for a patch wave. It says AI in capable hands can exploit technical debt quickly and at scale.<\/p>\n<p>In its PHP2Shell warning on 21 October, the NCSC explicitly refers to this advice and recommends <a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\">taking unpatched systems offline if necessary<\/a>. The two vulnerabilities can allow unauthenticated code execution on all PHP installations serving web requests. Versions <a href=\"https:\/\/www.php.net\/archive\/2026.php\">8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/a> fix the flaws. The article <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/22\/php-flaws-security-agencies-advise-shutdowns\/\">PHP vulnerabilities: Security authorities advise shutting systems down<\/a> describes how authorities in Germany, Austria and the Netherlands responded.<\/p>\n<p>According to Wiz Research, the vulnerabilities were found using frontier AI models; the bugs had been in the code <a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\">for more than a decade<\/a>. Rapid7 says <a href=\"https:\/\/www.rapid7.com\/blog\/post\/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days\/\">8 per cent of the threat reports analysed<\/a> identified AI as an operational component of attacks.<\/p>\n<p>From next Monday, <a href=\"https:\/\/www.theregister.com\/security\/2026\/10\/20\/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche\/5304198\">26 October<\/a>, the curl project will make low- and medium-severity vulnerability reports public. The project cites a flood of reports overwhelming the team. PostgreSQL 19 has been delayed and is now scheduled for 19 November. According to committer Peter Eisentraut, code reviews assisted by large language models (LLMs) found many bugs much faster; <a href=\"https:\/\/www.theregister.com\/databases\/2026\/10\/16\/postgres-19-delayed-after-ai-reviewers-find-more-bugs-than-humans-can-fix\/5303471\">eight to ten major features<\/a> were deferred.<\/p>\n<h2>Three checks after the disclosure week<\/h2>\n<p>&#8211; <strong>Set expiry dates for secrets and rotate them:<\/strong> Zeabur&#8217;s admin tokens never expired; after its incident, Railway recommended rotating all variables, API keys and registry credentials. &#8211; <strong>Lock down update and release channels:<\/strong> OVHcloud&#8217;s CLI versions could be replaced because GitHub release immutability was disabled. &#8211; <strong>Measure patching time against exploitation time:<\/strong> Rapid7 recorded an average of three days between disclosure and exploitation of severe vulnerabilities in the third quarter, yet the PAN-OS vulnerability patched on 13 May remains under attack.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is locked. Tap to unlock the answer.<\/p>\n<details>\n<summary><strong>Is the Signal vulnerability in RingRTC already being exploited?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The US agency CISA&#8217;s Known Exploited Vulnerabilities Catalog does not list CVE-2026-113380. If a call participant overloads the event queue, this vulnerability, rated <a href=\"https:\/\/www.theregister.com\/security\/2026\/10\/21\/signal-bug-could-keep-your-mic-and-camera-on-after-hangup\/5304528\">9.3 under the Common Vulnerability Scoring System (CVSS)<\/a>, can prevent a call from ending, leaving audio and potentially video active. It has been fixed since September in RingRTC 2.72.0.<\/p>\n<\/details>\n<details>\n<summary><strong>How serious are the new NGINX vulnerabilities?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">F5 rates three memory bugs <a href=\"https:\/\/thehackernews.com\/2026\/10\/nginx-fixes-5-flaws-including-possible.html\">9.2, classifying them as critical<\/a>. The NGINX project rates the same vulnerabilities <a href=\"https:\/\/nginx.org\/en\/security_advisories.html\">\u201cmedium\u201d<\/a>. Each requires an explicitly configured directive; versions <a href=\"https:\/\/nginx.org\/\">1.30.6 and 1.31.7<\/a>, released on 14 October, fix them.<\/p>\n<\/details>\n<details>\n<summary><strong>Which Siemens vulnerability is being actively exploited?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Siemens confirms attacks on CVE-2026-110936 in Siemens Software Center; CISA added the vulnerability to its <a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-orders-federal-agencies-to-patch.html\">Known Exploited Vulnerabilities Catalog<\/a> on Tuesday. Exploiting the flaw, which has a <a href=\"https:\/\/www.securityweek.com\/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks\/\">CVSS v4 score of 8.4<\/a>, attackers combined a validly signed program copy with their own dynamic-link library (DLL) files, which version 3.5.8.7 loaded without verification. It is fixed in <a href=\"https:\/\/productcert.siemens.com\/news\/2026\/10\/19\/active-exploitation-of-cve-2026-110936-in-siemens-software-center\/\">version 4.0.9.8<\/a>; Siemens attributes the attacks to the Romulus ClickFix campaign.<\/p>\n<\/details>\n<aside data-element=\"sources\">\n<details class=\"evm-sources\">\n<summary>Sources and reporting dates <span class=\"evm-sources-count\">(37)<\/span><\/summary>\n<ul>\n<li><a href=\"https:\/\/therecord.media\/california-warns-all-public-school-students-of-data-breach\" rel=\"noopener\" target=\"_blank\">therecord.media: California warns all public school students of data stolen in contractor breach, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.securityweek.com\/one-compromised-login-exposed-millions-of-california-students-records\/\" rel=\"noopener\" target=\"_blank\">SecurityWeek: One Compromised Login Exposed Millions of California Students&#8217; Records, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.latimes.com\/california\/story\/2026-10-16\/state-testing-student-data-hack\" rel=\"noopener\" target=\"_blank\">Los Angeles Times: Hackers steal personal data of millions of California students in massive breach, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.securityweek.com\/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach\/\" rel=\"noopener\" target=\"_blank\">SecurityWeek: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257\/\" rel=\"noopener\" target=\"_blank\">Help Net Security: Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/active-exploitation-of-pan-os-cve-2026-0257\/\" rel=\"noopener\" target=\"_blank\">Unit 42: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20), October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\" rel=\"noopener\" target=\"_blank\">TiDB: Security Update &#8211; October 2026 Security Incident Report: Unauthorized Access to PingCAP Cloud Resources, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zeabur-shutting-down-after-second-security-breach-in-two-months\/\" rel=\"noopener\" target=\"_blank\">BleepingComputer: Zeabur shutting down after second security breach in two months, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\" rel=\"noopener\" target=\"_blank\">Railway Blog: Security Disclosure: Wednesday October 21st, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.securityweek.com\/ai-platform-cairn-abused-to-hack-over-100-organizations\/\" rel=\"noopener\" target=\"_blank\">SecurityWeek: AI Platform Cairn Abused to Hack Over 100 Organizations, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/norforge.com\/blog\/inside_cairn\" rel=\"noopener\" target=\"_blank\">NorForge: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa26-293a\" rel=\"noopener\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency CISA: #StopRansomware: SafePay Ransomware | CISA, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/20\/aomei-backupper-compromised-supply-chain\/\" rel=\"noopener\" target=\"_blank\">Help Net Security: AOMEI Backupper servers hijacked for minutes at a time to push backdoor, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/investigating-ephemeral-supply-chain-tampering\" rel=\"noopener\" target=\"_blank\">Google Cloud Blog: Investigating Ephemeral Supply Chain Tampering, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\" rel=\"noopener\" target=\"_blank\">The Hacker News: Attackers Tampered with AOMEI Backupper&#8217;s Update Servers for Minutes to Deliver a Backdoor, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets\/\" rel=\"noopener\" target=\"_blank\">BleepingComputer: OVHcloud CLI releases backdoored on GitHub to steal developer secrets, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/\" rel=\"noopener\" target=\"_blank\">TeamUpdraft: TeamUpdraft security incident: What customers need to know, October 2026<\/a><\/li>\n<li><a href=\"http:\/\/patchstack.com\/articles\/updraftcentral-key-compromise-wordpress-backdoors\/\" rel=\"noopener\" target=\"_blank\">Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites\/\" rel=\"noopener\" target=\"_blank\">BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/47826\" rel=\"noopener\" target=\"_blank\">GitHub: [SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest\/main-stable removed): cook.pth \u2026, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.onamae.com\/news\/article\/11584\" rel=\"noopener\" target=\"_blank\">onamae.com: 26,739 servers, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack\/\" rel=\"noopener\" target=\"_blank\">BleepingComputer: Bullhorn takes staffing platform offline to contain cyberattack, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/newsroom.aholddelhaize.com\/ahold-delhaize-update-on-status-of-cybersecurity-incident\/\" rel=\"noopener\" target=\"_blank\">Ahold Delhaize update on status of cybersecurity incident, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/blogs\/prepare-for-vulnerability-patch-wave\" rel=\"noopener\" target=\"_blank\">National Cyber Security Centre: Preparing for a \u2018vulnerability patch wave\u2019, May 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" rel=\"noopener\" target=\"_blank\">National Cyber Security Centre: Critical security issue affecting PHP, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php\" rel=\"noopener\" target=\"_blank\">php.net: PHP: News Archive &#8211; 2026, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" rel=\"noopener\" target=\"_blank\">wiz.io: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.rapid7.com\/blog\/post\/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days\/\" rel=\"noopener\" target=\"_blank\">Rapid7: Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.theregister.com\/security\/2026\/10\/20\/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche\/5304198\" rel=\"noopener\" target=\"_blank\">theregister: Swamped curl maintainers take low-level flaws public to survive vulnerability, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.theregister.com\/databases\/2026\/10\/16\/postgres-19-delayed-after-ai-reviewers-find-more-bugs-than-humans-can-fix\/5303471\" rel=\"noopener\" target=\"_blank\">theregister: Postgres 19 delayed after AI reviewers find more bugs than humans can fix, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.theregister.com\/security\/2026\/10\/21\/signal-bug-could-keep-your-mic-and-camera-on-after-hangup\/5304528\" rel=\"noopener\" target=\"_blank\">theregister: Signal bug could keep your mic &#8211; and camera &#8211; on after hangup, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/nginx-fixes-5-flaws-including-possible.html\" rel=\"noopener\" target=\"_blank\">The Hacker News: NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/nginx.org\/en\/security_advisories.html\" rel=\"noopener\" target=\"_blank\">nginx.org: nginx security advisories, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/nginx.org\/\" rel=\"noopener\" target=\"_blank\">nginx.org: nginx, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-orders-federal-agencies-to-patch.html\" rel=\"noopener\" target=\"_blank\">The Hacker News: CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.securityweek.com\/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks\/\" rel=\"noopener\" target=\"_blank\">SecurityWeek: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/productcert.siemens.com\/news\/2026\/10\/19\/active-exploitation-of-cve-2026-110936-in-siemens-software-center\/\" rel=\"noopener\" target=\"_blank\">productcert.siemens.com: Active Exploitation of CVE-2026-110936 in Siemens Software Center &#8211; Siemens ProductCERT, October 2026<\/a><\/li>\n<\/ul>\n<\/details>\n<\/aside>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/10\/14\/google-counters-meta-with-top-tier-ai-at-half-the-price\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-google-kontert-meta-mit-spitzen-ki-zum-h-23817082.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Google counters Meta with top AI at half the price<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/microsoft-germany-tops-eu-in-cyberattacks\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-microsoft-deutschland-ist-eu-spitze-bei-91597426-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Microsoft: Germany Is EU\u2019s Top Cyberattack Target<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (October 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"Serious security disclosures mounted between 19 and 22 October. Many of the attacks began weeks or months earlier.","protected":false},"author":10,"featured_media":25107,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Black October","_yoast_wpseo_title":"Black October: Many attacks had been running for months","_yoast_wpseo_metadesc":"Serious security disclosures mounted between 19 and 22 October. Many of the underlying attacks had begun weeks or months earlier.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[251],"tags":[],"class_list":["post-25120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"evm_reading_time_minutes":13,"wpml_language":"en","wpml_translation_of":25104,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=25120"}],"version-history":[{"count":9,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25120\/revisions"}],"predecessor-version":[{"id":25194,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25120\/revisions\/25194"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/25107"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=25120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=25120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=25120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}