ByAhsan Nadeem@ashtech52Lead Full-Stack Engineer
In October 2026, attackers didn't need to break down many doors: they borrowed keys. A stolen backup app credential was tried against almost 1,000 Microsoft 365 tenants, stolen GitHub tokens turned a popular AI library into malware for two hours, and a flaw in PHP, the language behind much of the web, was probed before its patch existed.
This roundup of the cyber attacks of October 2026 is written as of 26 October 2026. It starts with a "patch or check this week" table, then gives each incident what happened, who is affected and what to do, and ends with a 10-minute monthly checklist.
If you'd rather hand the patching and monitoring to someone else, that's what our cybersecurity hardening work covers.
What were the biggest cyber attacks of October 2026?
The biggest cyber attacks of October 2026 were the theft of a ConnectWise Cloud Backup credential, tried against almost 1,000 Microsoft 365 tenants; the poisoned LiteLLM 1.107.0 release; attack attempts on PHP2Shell; exploited flaws in Ivanti, BeyondTrust, Palo Alto and Citrix edge devices; and the Ahold Delhaize incident that took grocery websites offline.
Patch or check this week: the October 2026 table
"Exploited" means a vendor, CISA or a credible researcher reported real attacks. CISA's Known Exploited Vulnerabilities (KEV) catalog is the US government's list of flaws confirmed as attacked; we checked it on 26 October (catalog version of 23 October, still the latest).
Product | CVE | Exploited? | Fixed version | Who should care |
|---|---|---|---|---|
PHP (PHP2Shell) | CVE-2026-109618, CVE-2026-109619 | Attempts reported from 17 October; not in KEV | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Anyone with a WordPress or other PHP website |
Windows (Patch Tuesday) | CVE-2026-96951 | Yes, KEV 13 October | 13 October updates | Every Windows PC |
ConnectWise Cloud Backup (SkyKick) | No CVE | Yes, almost 1,000 tenants saw sign-ins | Service suspended; disable the apps | Microsoft 365 tenants that used it, and their MSPs |
LiteLLM | No CVE | Yes, malicious release on 21 October | Avoid 1.107.0; pin 1.106.2 | Teams running AI gateways or Python AI tools |
Ivanti Connect Secure | CVE-2026-104935 | Yes, since 3 October; KEV 13 October | Patches of 13 October | Anyone using Ivanti VPN |
Palo Alto PAN-OS | CVE-2026-0322 | Yes, very limited; KEV 14 October | Per branch, e.g. 12.2.4, 11.2.16 | Firewalls with a reachable management interface |
BeyondTrust Remote Support | CVE-2026-102764 | Yes, since 29 August; KEV 16 October | BT26-05-RS patch (24.3.1 to 26.2.3) | IT teams and MSPs using it for remote access |
Citrix NetScaler ADC and Gateway | CVE-2026-88779 | Yes, KEV 4 October | 14.1-73.41, 13.1-64.28 | NetScaler with SAML enabled |
Plex Media Server (Plex2Shell) | CVE-2026-96652, -96654, -96655, -96656 | Yes, KEV 20 October | 1.43.3.10861 or later | Offices and homes running a Plex server |
GitLab self-managed | CVE-2026-110264 | No attacks reported as of 26 October; not in KEV | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | Anyone hosting their own GitLab |
SonicWall SMA 1000 | CVE-2026-102255 | Attempts reported by researchers; vendor saw none; not in KEV | Hotfix in SNWLID-2026-0017 | SMA 6210, 7210, 8200v owners |
Oracle (October CPU) | 1,295 patches | Oracle notes attacks on already-patched flaws | 20 October 2026 update | Oracle Database, E-Business Suite, Java, MySQL |
Check the last column first. Two rows apply to almost every small business, the Windows update and your website's PHP version.
PHP2Shell: the flaw under millions of websites
On 21 October 2026, PHP shipped emergency releases for two remote code execution flaws, rated 9.2 (CVSS 4.0), nicknamed PHP2Shell. Details had leaked the day before. Amazon's honeypots recorded an exploitation attempt on 17 October, four days before the fix, and Cloudflare's CTO said it was seeing early attacks.
Who's affected: any PHP install serving web requests below the fixed versions; VirusTotal estimates over 5.1 million PHP hosts are exposed online. Apache with mod_php is the riskiest set-up, and PHP 8.1 and older get no official release. CERT-EU added a third, lower-risk flaw (CVE-2026-115560) on 23 October.
What to do: check your PHP version in your hosting panel or WordPress's Site Health screen, and ask your host when it moves to the fixed release. Our PHP2Shell guide covers the checks and the questions to ask.
Windows: October Patch Tuesday's record and its one exploited zero-day
Microsoft's 13 October Patch Tuesday fixed a record 1,400-plus flaws. The exact count depends on who's counting: BleepingComputer says 1,411 (70 critical, excluding 348 fixed earlier in the month), SecurityWeek 1,413, Tenable 1,407 (69 critical) and Security Affairs 1,415. One was already exploited: CVE-2026-96951, a Windows Shell bypass of Mark of the Web, the tag that makes Windows warn you about downloaded files. CISA added it to KEV the same day. Two more (in .NET Framework and MessagePack-CSharp) were publicly disclosed but not known to be exploited.
What to do: make sure every Windows PC has installed the October updates and restarted. On a small network, that means checking each machine's Windows Update page, not assuming.
ConnectWise Cloud Backup: a trusted app turned into a way in
On 16 October, ConnectWise disclosed unauthorised access to the application identities of ConnectWise Cloud Backup (formerly SkyKick), apps that already had consent to read customer Microsoft 365 tenants. Huntress saw sign-in activity from the attacker's address in almost 1,000 tenants, over 300 of them successful.
In one tenant, a ConnectWise app gave itself Global Administrator. ConnectWise suspended the service on 17 October.
What to do: in Entra ID, disable (don't delete) the ConnectWise and SkyKick apps, and look for secrets or certificates added to any app since 13 October. Our ConnectWise and SkyKick guide walks through the audit step by step.
LiteLLM 1.107.0: two hours of a poisoned AI library
On 21 October, a malicious litellm==1.107.0 was live on PyPI from 11:39 to about 13:23 UTC, and Docker tags including latest pointed to a bad image until 14:20 UTC. Attackers used stolen GitHub CLI tokens from LiteLLM developers to run the release workflow against a lookalike repository.
The payload ran on every Python start and went after cloud keys, AI API keys, SSH keys and browser passwords. It is LiteLLM's second compromise of 2026.
What to do: if any machine installed 1.107.0 or pulled those images in the window, treat it as compromised: rebuild it and rotate every credential it could reach. Our LiteLLM supply chain attack guide has the indicators and the clean-up order.
Ivanti, Palo Alto, BeyondTrust and Citrix: the edge devices
Four of the month's exploited flaws sit in the boxes that guard the network edge.
- Ivanti Connect Secure (CVE-2026-104935): Volexity found an attacker chaining it into root access on a fully patched VPN from 3 October. Ivanti patched on 13 October, but a privilege-escalation flaw in the chain is still unfixed.
- Palo Alto PAN-OS (CVE-2026-0322): code execution as root through the management interface, fixed on 14 October. It needs a login, so a management page open to the internet is the real risk.
- BeyondTrust Remote Support (CVE-2026-102764): a no-login bypass (CVSS 4.0 9.3) behind two known compromises on 29 August, one hosted and one self-hosted. Self-hosted appliances need the BT26-05-RS patch by hand.
- Citrix NetScaler (CVE-2026-88779): a memory overflow in SAML set-ups, exploited and added to KEV on 4 October, weeks after an earlier round of NetScaler fixes.
What to do: patch these first, then check for compromise, because Ivanti's own integrity tool may miss this attacker. Take management interfaces off the public internet.
GitLab, SonicWall and Plex: patched before or just after the attacks
GitLab fixed CVE-2026-110264 (CVSS 10.0) on 21 October: a specially crafted regular expression can let an attacker with no login run code on a self-managed server. GitLab's affected-version ranges include the releases of 12 October that fixed the earlier, similar CVE-2026-97229, so those servers still need this update. No attacks were reported as of 26 October.
SonicWall SMA 1000 got a hotfix for a pre-login flaw rated 10.0. Researchers at Defused saw attack traffic on their decoys from 8 October; SonicWall said it had no evidence of exploitation.
Plex Media Server had four flaws, fixed back in August, chained into "Plex2Shell". The researcher published details on 16 October and attacks followed on 17 October. Update to 1.43.3.10861 or later.
Oracle's October Critical Patch Update: 1,295 fixes
Oracle's quarterly update on 20 October 2026 contains 1,295 new security patches, as PC-Welt reported from the final advisory (Oracle's pre-release announcement had said 1,283). They include 55 for Java SE and 98 for MySQL. Oracle's advisories repeat its warning that attackers keep exploiting flaws it has already patched, so apply it on your normal cycle, prioritising anything internet-facing.
Ahold Delhaize: what a precautionary shutdown looks like
On 12 October 2026, Ahold Delhaize, owner of Albert Heijn, Delhaize, Food Lion, Stop & Shop and Hannaford, said it had found malicious activity and taken systems offline, including brand websites and apps. Stores stayed open.
By 19 October most European sites were back, US online shopping was due "in the coming days", and the company said it had no evidence that sensitive customer data was taken. As of 26 October 2026, the attacker and method are not public.
The lesson for a small business: know which systems you would switch off first, and how you'd keep trading while they're off.
Phishing kits seized and ClickFix keeps evolving
On 14 October, Microsoft and Health-ISAC announced the seizure of domains behind YAM Store, a marketplace selling fraudulent Microsoft and Google accounts, and the CoGUI and Iron Man phishing kits, under a US federal court order. Microsoft says the services enabled more than a billion malicious messages since January 2026, against more than 75,000 organisations.
ClickFix, the fake "verify you are human" page that tells you to paste a command into Windows, kept evolving. Microsoft described a version on 3 October that hides its payload in the browser cache before you click anything. Ahsan Nadeem on our team hit one of these pages on 15 October; our ClickFix guide covers what he did next.
What to do: tell everyone once, clearly: no real CAPTCHA ever asks you to press Win+R. While you're on phishing, check your own domain's email protection with our free SPF and DMARC checker.
What the cyber attacks of October 2026 have in common
1. Stolen tokens and trusted third parties. ConnectWise's app credentials and LiteLLM's developer tokens were already trusted, so nobody had to guess a password or beat multi-factor authentication. In October 2026, the attackers didn't pick the lock; they used the key you gave your supplier.
2. AI tooling as a target. LiteLLM holds the API keys for every AI model a team uses, a single, valuable place to steal from, and its report says the GitHub tokens may have leaked through logged responses from an AI coding assistant. AI agents can also be steered by what they read, as our prompt injection examples show.
3. Exploitation within hours or days of disclosure. Plex attacks began a day after details went public, and PHP2Shell was probed before its patch shipped. CISA gave federal agencies three days to fix most of October's KEV additions.
A monthly patch cycle is no longer fast enough for internet-facing systems. The fix is a routine: the checklist below, plus same-week patching when a KEV entry matches something you run.
A 10-minute monthly security checklist for a small business
Run this on the second Wednesday of every month, the day after Patch Tuesday.
- Windows and Mac updates: confirm every computer has installed and restarted.
- Your website's PHP and plugins: check the PHP version and update WordPress, themes and plugins, or ask your host to confirm.
- Edge devices: check your firewall, VPN and router for firmware updates, and make sure their admin pages aren't open to the internet.
- The KEV list: search CISA's catalog for the products in your inventory. If one appears, patch it this week.
- Microsoft 365 or Google Workspace apps: review which third-party apps have access and remove any you no longer use.
- Credentials: rotate any key or password that touched a compromised tool, and confirm multi-factor authentication is on for every admin.
- Backups: confirm last night's backup ran and that you could restore one file from it.
- Staff reminder: one sentence on the scam of the month, such as fake CAPTCHAs.
Frequently asked questions
What were the biggest cyber attacks in October 2026?
The ConnectWise Cloud Backup compromise reached the most organisations, with almost 1,000 Microsoft 365 tenants seeing attacker sign-ins. PHP2Shell had the widest potential reach because PHP runs much of the web. The Ahold Delhaize incident caused the most visible disruption, taking grocery websites and apps offline across Europe and the US.
Which October 2026 vulnerabilities should I patch first?
Patch anything that is internet-facing and confirmed as exploited first: Ivanti Connect Secure, BeyondTrust Remote Support, Palo Alto PAN-OS and Citrix NetScaler if you run them, then your website's PHP and the October Windows updates. Self-hosted GitLab comes next, because a 10.0 flaw that needs no login tends not to stay unexploited for long.
What is the CISA KEV catalog, and should a small business use it?
CISA's Known Exploited Vulnerabilities catalog is the US government's list of flaws confirmed as attacked in the wild, and in October 2026 CISA gave federal agencies three days to fix most new entries. It's a free, quick way to see which of your products need patching this week. It lags real attacks, though: PHP2Shell wasn't in it as of the 23 October version, despite reported attempts, so treat it as a floor, not a ceiling.
The bottom line
October 2026 showed that the weak point is often something you already trust: a backup app, a developer token, a remote support tool, a VPN. Patch the table above this week, then make the 10-minute checklist a monthly habit.
Not sure which of these touch your business? Book a free consultation and we'll go through your systems with you and tell you what to patch first.
Sources
- CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.23, checked 26 October 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- PHP, GitHub security advisory GHSA-w8hw-w9fx-j79w, RCE via OOM corruption (21 October 2026): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP (20 October 2026, updated 23 October 2026): https://cert.europa.eu/publications/security-advisories/2026-018/
- BleepingComputer, PHP ships emergency patches for critical PHP2Shell flaws (21 October 2026): https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
- Help Net Security, PHP2Shell PHP vulnerabilities patched (21 October 2026): https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
- BleepingComputer, Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (13 October 2026): https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
- SecurityWeek, Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day (14 October 2026): https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/
- Tenable, Microsoft's October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) (13 October 2026): https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951
- Security Affairs, Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates (14 October 2026): https://securityaffairs.com/200953/security/microsoft-patch-tuesday-sets-new-record-with-1415-cves-in-october-2026-updates.html
- Huntress, ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (16 October 2026, updated 19 October 2026): https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
- ConnectWise Trust Center, Cloud Backup (formerly known as SkyKick) Service Interruption (16 October 2026, updated 25 October 2026): https://www.connectwise.com/company/trust/advisories
- BleepingComputer, Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack (17 October 2026): https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
- LiteLLM, Security incident: Oct 21, 2026 LiteLLM release v1.107.0 compromised (October 2026): https://docs.litellm.ai/blog/security-incident-oct-21-2026
- Datadog Security Labs, LiteLLM supply chain compromise: What you need to know (21 October 2026): https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/
- Ivanti, Security Advisory: Ivanti Connect Secure CVE-2026-104935 (13 October 2026): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- Volexity, A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days (13 October 2026): https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- BleepingComputer, Ivanti warns of Connect Secure zero-day exploited in attacks (13 October 2026): https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
- Palo Alto Networks, CVE-2026-0322 PAN-OS security advisory (14 October 2026, updated 15 October 2026): https://security.paloaltonetworks.com/CVE-2026-0322
- BeyondTrust, Security advisory BT26-05 (15 October 2026): https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
- Rapid7, CVE-2026-102764: Critical BeyondTrust Remote Support authentication bypass exploited in the wild (19 October 2026): https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild
- Citrix, Understanding and addressing CVE-2026-88779 in NetScaler ADC and NetScaler Gateway (October 2026): https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
- Help Net Security, CISA flags new exploited NetScaler flaw as attackers crash appliances (5 October 2026): https://www.helpnetsecurity.com/2026/10/05/cisa-flags-new-exploited-netscaler-flaw-as-attackers-crash-appliances-cve-2026-88779/
- GitLab, GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (21 October 2026): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
- Help Net Security, GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) (13 October 2026): https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/
- SonicWall PSIRT, SNWLID-2026-0017 (October 2026): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
- Security Affairs, SonicWall patches CVSS 10.0 SSRF flaw as attacks begin (12 October 2026): https://securityaffairs.com/200816/hacking/sonicwall-patches-cvss-10-0-ssrf-flaw-as-attacks-be
- BleepingComputer, CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers (21 October 2026): https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
- Oracle, Critical Patch Update Advisory, October 2026 (20 October 2026): https://www.oracle.com/security-alerts/cpuoct2026.html
- PC-Welt, Oracles Oktober-Updates beheben weit über 1000 Schwachstellen (21 October 2026): https://www.pcwelt.de/?p=3265699
- Ahold Delhaize, Update on status of cybersecurity incident (19 October 2026): https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/
- BleepingComputer, Ahold Delhaize cyberattack affects services across US and Europe (20 October 2026): https://www.bleepingcomputer.com/news/security/ahold-delhaize-cyberattack-affects-services-across-us-and-europe/
- Microsoft On the Issues, Disrupting the service economy behind transnational cybercrime operations (14 October 2026): https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/
- SecurityWeek, Microsoft disrupts Chinese-language phishing market behind 1B messages (14 October 2026): https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/
- Infosecurity Magazine, ClickFix attack hides VBScript payload in browser cache (6 October 2026): https://www.infosecurity-magazine.com/news/clickfix-vbscript-browser-cache/
