October 2026 Security Briefing Covers Ransomware, Exploited Flaws and AI-Driven Attacks
Summary
Sysdig’s October 2026 briefing summarizes ransomware and grocery-sector disruptions, rapidly exploited PHP and Node.js flaws, Linux and Microsoft patches, a reported AI-agent-assisted breach of DIVD, and pickle-based model-loading bypasses.
Key points
- IDC Frontier confirmed a ransomware attack that it said affected nearly 500 companies and local governments. The 3.6 PB encryption figure was allegedly shown in customer messages, and the ransomware group claimed it deleted snapshots.
- Hackers reportedly forced refrigerators in hundreds of French grocery stores into continuous defrost mode. Danfoss said outdated or end-of-life firmware left equipment exposed to the internet.
- PHP released emergency patches for CVE-2026-109618 and CVE-2026-109619 after exploitation attempts began before the fixes; Amazon reported an attempt on October 17.
- Node.js fixed an out-of-bounds write in its bundled Brotli decoder; exploitation attempts were reported within days. The decoder is also used in Bun, Python Brotli packages, and some Envoy configurations.
- Sysdig says an attacker breached the Dutch Institute for Vulnerability Disclosure by exploiting two Zammad flaws, CVE-2026-102489 and CVE-2026-102490. The article says Zammad had received a report about the first flaw before the breach.
- Sysdig researchers documented six pickle-based bypasses of model-loading defenses in PyTorch, Keras, and picklescan, and recommend using safetensors where possible.
- The roundup also covers Microsoft’s reported patching of 1,411 flaws, an actively exploited zero-day, and Microsoft’s account of Storm-0940 using agents to target more than 2,250 ConnectWise tenants.
Article Details
- Event Type
- October 2026 cybersecurity news roundup covering ransomware, operational technology disruption, vulnerability disclosures and exploitation, and reported nation-state activity.
- Impact
- IDC Frontier confirmed a ransomware attack affecting nearly 500 companies and local governments; claims that 3.6 PB of data was encrypted and snapshots deleted were attributed to customers and the ransomware group. In France, refrigerators in hundreds of grocery stores were reportedly forced into defrost mode, causing fires and potentially tens of millions of dollars in spoiled food. The article also reports exploitation of PHP vulnerabilities before patches were available, confirmed exploitation attempts involving Node2Shell, and Storm-0940 activity against ConnectWise customers.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers exploited PHP vulnerabilities using HTTP requests, and an attacker exploited vulnerabilities in the Zammad helpdesk tool to breach DIVD.T1486 · Data Encrypted for ImpactThe ransomware incident at IDC Frontier reportedly involved data encryption; customers saw messages claiming 3.6 PB had been encrypted.T1490 · Inhibit System RecoveryThe ransomware group claimed to have deleted snapshots during the IDC Frontier attack.
CVE
CVE-2026-102489Zammad GmbH · ZammadThe attacker exploited two vulnerabilities in the Zammad open source helpdesk tool. These were identified as CVE-2026-102489, a remote code execution flaw, and CVE-2026-102490, a local privilege escalation flaw. CVE-2026-102490Zammad GmbH · ZammadThe attacker exploited two vulnerabilities in the Zammad open source helpdesk tool. These were identified as CVE-2026-102489, a remote code execution flaw, and CVE-2026-102490, a local privilege escalation flaw. CVE-2026-109618Vendor / Product unavailablePHP shipped two emergency releases on October 21 for CVE-2026-109618 and CVE-2026-109619. CVE-2026-109619Vendor / Product unavailablePHP shipped two emergency releases on October 21 for CVE-2026-109618 and CVE-2026-109619. CVE-2026-43284Linux · Linux; Red Hat · NVIDIA for RHEL 10; +28 moreZDI-CAN-33367 is a local privilege escalation in skb_zerocopy() with a public proof of concept. It’s another gap in the Dirty Frag fix (CVE-2026-43284) from May. CVE-2026-96951Vendor / Product unavailableto prioritize reachability and exploitation. This month included one actively exploited zero-day (CVE-2026-96951), two publicly disclosed ones, and 70 critical flaws.
Threat Actors
Vendors
DanfossThe Danish manufacturer, Danfoss, said the stores were running outdated firmware or had reached end-of-life support, which left equipment exposed to the internet. MicrosoftMicrosoft patches a record 1,411 flaws: Vulnerability discovery is quickly outpacing security teams’ capability to remediate. KrebsOnSecurity said the prior month’s record of 972 patched flaws was 10 times a “normal”ZammadThe attacker exploited two vulnerabilities in the Zammad open source helpdesk tool. These were identified as CVE-2026-102489, a remote code execution flaw, and CVE-2026-102490, a local privilege escalation flaw.
Products
BunThe decoder also ships in Bun, Python Brotli packages, and some Envoy configurations.ConnectWisethreat actors using agentic AI: China-affiliated threat group Storm-0940 used agents to compromise ConnectWise customers, according to Microsoft on October 21. The group used the open source ARTEX framework toConnManTrend Micro’s Zero Day Initiative (ZDI) sent five Linux kernel reports to the Linux kernel security team and one report to the ConnMan mailing list, all of which went out to the broader public mailing lists. EnvoyThe decoder also ships in Bun, Python Brotli packages, and some Envoy configurations.KerasSix documented CVE bypasses beat PyTorch weights_only, Keras safe_mode, and picklescan. The check and the loader disagreed about what the file was in each case.Linux kernelTrend Micro’s Zero Day Initiative (ZDI) sent five Linux kernel reports to the Linux kernel security team and one report to the ConnMan mailing list, all of which went out to the broader public mailing lists. Node.jsNode2Shell, also known as HTTP2Shell, landed on organizations’ radars after Node.js fixed an out-of-bounds write in its bundled Brotli decoder on October 21. PHPPHP shipped two emergency releases on October 21 for CVE-2026-109618 and CVE-2026-109619. PyTorchSix documented CVE bypasses beat PyTorch weights_only, Keras safe_mode, and picklescan. The check and the loader disagreed about what the file was in each case.ZammadThe attacker exploited two vulnerabilities in the Zammad open source helpdesk tool. These were identified as CVE-2026-102489, a remote code execution flaw, and CVE-2026-102490, a local privilege escalation flaw.
Tools
ARTEXto compromise ConnectWise customers, according to Microsoft on October 21. The group used the open source ARTEX framework to attempt sign-ins to more than 2,250 tenants. In multiple cases, the actors moved fromPicklescanSix documented CVE bypasses beat PyTorch weights_only, Keras safe_mode, and picklescan. The check and the loader disagreed about what the file was in each case.
Countries
ChinaNation-state threat actors using agentic AI: China-affiliated threat group Storm-0940 used agents to compromise ConnectWise customers, according to Microsoft on October 21. The group used the open source ARTEX frameworkFranceOvernight, between October 11 and 12, hackers forced refrigerators in hundreds of grocery stores across France into continuous defrost mode. Japancybersecurity best practices during Cybersecurity Awareness Month. A cloud region was knocked offline in Japan. Grocery stores across the US and Europe were either taken offline temporarily or lost produce. An AIUnited StatesCybersecurity Awareness Month. A cloud region was knocked offline in Japan. Grocery stores across the US and Europe were either taken offline temporarily or lost produce. An AI agent chained two vulnerabilities
Industries
Cloud infrastructureOct. 7: Ransomware takes down Japanese cloud infrastructureCybersecurityAttackers were definitely testing our cybersecurity best practices during Cybersecurity Awareness Month. A cloud region was knocked offline in Japan. Grocery stores across the US and Europe were either taken offline