Major Cybersecurity Incidents and Vulnerabilities Reported in October 2026
Summary
The October 2026 roundup covers major thefts, breaches, ransomware and sabotage incidents, an active FortiGate credential campaign, and exploited vulnerabilities, including PHP2Shell.
Key points
- Binance reported about $6.3 billion stolen from hot wallets after a months-long campaign against engineers. The FBI attributed the theft to North Korea and linked laundering to TraderTraitor; Binance said about $3 billion was frozen.
- The FBI and US Secret Service warned that FortiBleed remains active against internet-facing Fortinet devices, with attackers using leaked credentials to gain access, create accounts, steal secrets, and lock organizations out.
- ConnectWise said an attacker abused its Cloud Backup Microsoft 365 application credential; sign-ins succeeded in more than 300 tenants. Microsoft assessed Storm-0940 was responsible. ConnectWise reset credentials and was restoring services.
- PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 enabled remote code execution; exploitation attempts reportedly began before patches. CISA added them to its KEV catalog. The roundup also covers exploited Node2Shell and Plex2Shell flaws.
- IDC Frontier confirmed ransomware encrypted customer virtual machines on IDCF Cloud after an attacker exploited an authentication vulnerability. The incident disrupted 495 organizations; the company reported no customer-VM exfiltration and said backups were retrievable for 206 customers.
- Capcom confirmed exposure of 11,774,247 CAPCOM ID records. Florida’s education department separately disclosed unauthorized access that may have affected about 4.9 million people; it has not disclosed the access method.
- South Korean police said a former penetration tester allegedly used an AI-assisted system in breaches affecting more than 90 organizations. In Denmark, misuse of lookup access exposed records on about 8.8 million people; an individual’s claim about using a former employee’s leaked password remains unconfirmed.
- French authorities attributed remote sabotage of supermarket refrigeration systems to Shahid Kaveh, an IRGC cyber unit, reporting about 700 affected sites and at least 15 fires.
Article Details
- Event Type
- October 2026 multi-incident cybersecurity roundup covering cryptocurrency theft, credential compromise, data breaches, ransomware, vulnerability exploitation, and operational sabotage.
- Impact
- Binance reported about $6.3 billion in losses, with about $3 billion frozen on-chain. The ConnectWise credential was used to attempt sign-ins in almost 1,000 Microsoft Entra ID tenants, with successful sign-ins in more than 300. The CPR register breach exposed records on about 8.8 million people, and the Florida student aid breach may have affected approximately 4.9 million. Ransomware at IDCF Cloud disrupted 495 companies and local governments; no customer-VM exfiltration was found. French authorities reported about 700 retail sites affected by refrigeration sabotage and at least 15 fires. PHP2Shell exploitation attempts were reported before patches were released, but researchers found no evidence of successful access in the scans described.
MITRE ATT&CK
T1078 · Valid AccountsAttackers used credentials from earlier Fortinet leaks and infostealer logs to log in to internet-facing devices and customer tenants.T1098 · Account ManipulationIn at least two tenants, a related ConnectWise app assigned itself the Global Administrator role; FortiBleed operators also created admin accounts for persistence.T1110.003 · Password SprayingThe article describes a password-spraying campaign that Microsoft said shared infrastructure with the ConnectWise compromise.T1190 · Exploit Public-Facing ApplicationAttackers exploited a vulnerability in software behind the IDCF Cloud portal's authentication; the article also describes exploitation attempts against vulnerable internet-facing PHP applications.T1486 · Data Encrypted for ImpactRansomware encrypted customer virtual machines in the IDCF Cloud incident.
CVE
CVE-2026-109618PHP Group · PHP; Siemens · AMIS TS; +105 moreOn October 21, 2026, the PHP project fixed CVE-2026-109618 and CVE-2026-109619, two memory-handling flaws in PHP core known together as PHP2Shell.CVE-2026-109619PHP Group · PHP; Siemens · AMIS TS; +106 moreOn October 21, 2026, the PHP project fixed CVE-2026-109618 and CVE-2026-109619, two memory-handling flaws in PHP core known together as PHP2Shell.CVE-2026-111497Google · Brotli; Siemens · Cloud Connector Configurator; +22 moreNode2Shell: CVE-2026-111497, an out-of-bounds write in the Brotli decompression library rated 9.2 CVSS v4.0, was fixed in Node.js on October 21, 2026, and also affects Python Brotli packages and PHP for Windows builds.CVE-2026-96652Plex · Media ServerPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.CVE-2026-96654Plex · Media ServerPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.CVE-2026-96655Plex · Media ServerPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.CVE-2026-96656Plex · Media ServerPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.
Threat Actors
INCNamed as a ransomware affiliate to which FortiBleed operators passed access, according to the advisory described in the article.Jade SleetThe FBI and other U.S. agencies tied the laundering of funds from the Binance theft to the TraderTraitor cluster; SOCRadar assessed the attribution with high confidence based on the public government statement.LynxNamed as a ransomware affiliate to which FortiBleed operators passed access, according to the advisory described in the article.PayloadNamed as a ransomware affiliate to which FortiBleed operators passed access, according to the advisory described in the article.Shahid KavehFrench authorities attributed the supermarket refrigeration sabotage to Shahid Kaveh, described as a cyber unit of Iran's Islamic Revolutionary Guard Corps. SOCRadar assessed the attribution with high confidence based on the public government statement.Storm-0940Microsoft assessed that Storm-0940 was responsible for the ConnectWise compromise, citing infrastructure shared with an earlier password-spraying campaign. SOCRadar assessed this link with moderate confidence; no government body had publicly attributed the compromise.
Vendors
ConnectWisewallet heist, a backup provider’s cloud credential reached hundreds of Microsoft 365 tenants in the ConnectWise breach, and a supplier’s lookup account exposed records on 8.8 million people in Denmark’s CPR registerCopelandThe alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that theDanfossThe alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that theDixellThe alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that theFortinetjoint advisory warning that FortiBleed, a global credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and Secure Sockets Layer (SSL) VPN gateways, remains active.IDC FrontierIDC Frontier, a SoftBank group cloud provider, confirmed that ransomware hit its IDCF Cloud service on October 7, 2026, disrupting 495 companies and local governments in parts of its East Japan Region 1.Microsoftworkstations in the Binance hot wallet heist, a backup provider’s cloud credential reached hundreds of Microsoft 365 tenants in the ConnectWise breach, and a supplier’s lookup account exposed records on 8.8 millionPlexPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.
Products
CAPCOM IDCapcom Confirms Breach of 11.7 Million CAPCOM ID RecordsConnectWise Cloud BackupConnectWise Cloud Backup Credential Abused Against Microsoft 365 TenantsDanfoss AK-SCThe alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that thee-CAPCOMThe attacker also changed the passwords of 196 accounts, and an October 23, 2026, follow-up said e-CAPCOM store account details were exposed for 19 of them.Fortinet FortiGatewarning that FortiBleed, a global credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and Secure Sockets Layer (SSL) VPN gateways, remains active.IDCF CloudOther attacks disrupted day-to-day operations, from ransomware hitting Japan’s IDCF Cloud platform to Iran-linked remote sabotage of refrigeration systems in French supermarkets.Microsoft 365 Apps for Enterprisein the Binance hot wallet heist, a backup provider’s cloud credential reached hundreds of Microsoft 365 tenants in the ConnectWise breach, and a supplier’s lookup account exposed records on 8.8 millionMicrosoft Entra IDIncident responders saw sign-in attempts in almost 1,000 Microsoft Entra ID tenants, with successful sign-ins in more than 300 of them.Node.jsNode2Shell: CVE-2026-111497, an out-of-bounds write in the Brotli decompression library rated 9.2 CVSS v4.0, was fixed in Node.js on October 21, 2026, and also affects Python Brotli packages and PHP for Windows builds.PHPOn October 21, 2026, the PHP project fixed CVE-2026-109618 and CVE-2026-109619, two memory-handling flaws in PHP core known together as PHP2Shell.Plex Media ServerPlex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server.SkyKickan attacker abused the Microsoft 365 application credential behind its Cloud Backup service, formerly SkyKick, which held standing consent to read the tenants of managed service providers (MSPs) and their customers.XWEBThe alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that the
Tools
Countries
ChinaMicrosoft assessed that Storm-0940, a China state-aligned group, was responsible, citing infrastructure shared with a password-spraying campaign that preceded the compromise.Denmarkin the ConnectWise breach, and a supplier’s lookup account exposed records on 8.8 million people in Denmark’s CPR register breach.FranceFrance Links Supermarket Refrigeration Sabotage to IranIranOther attacks disrupted day-to-day operations, from ransomware hitting Japan’s IDCF Cloud platform to Iran-linked remote sabotage of refrigeration systems in French supermarkets.JapanOther attacks disrupted day-to-day operations, from ransomware hitting Japan’s IDCF Cloud platform to Iran-linked remote sabotage of refrigeration systems in French supermarkets.North KoreaThe Federal Bureau of Investigation (FBI) publicly attributed the theft to North Korea on October 31, 2026, and, with the US Secret Service and Internal Revenue Service Criminal Investigation (IRS-CI), tied theSouth KoreaA former penetration tester allegedly led a group that breached more than 90 South Korean organizations, including private academies, hospitals, golf courses, universities, funeral-service firms and insurance sales
Industries
CryptocurrencyA cryptocurrency exchange lost billions through compromised engineer workstations in the Binance hot wallet heist, a backup provider’s cloud credential reached hundreds of Microsoft 365 tenants in the ConnectWiseEducationDenmark’s Ministry of Research, Education and Digitalisation disclosed on October 5, 2026, that someone misused a private company’s lawful lookup access to the Central Person Register (CPR), the national register behindGovernmentSOCRadar assesses the attribution with high confidence based on that public government statement.Insuranceincluding private academies, hospitals, golf courses, universities, funeral-service firms and insurance sales firms.RetailIn a November 9, 2026, report published by CERT-FR, French authorities counted about 700 affected retail sites and at least 15 fires, and attributed the attack to Shahid Kaveh, a cyber unit of Iran’s Islamic