The month in breaches: what October 2026's cyber attacks tell us

October's incidents landed in four places at once: internet-facing assets nobody had inventoried, vendors and open-source packages trusted by default, compliance obligations that started ticking the moment data leaked, and the AI stack most companies have bolted on in the last two years. Most organisations watch one or two of those surfaces, with separate tools and separate teams. Attackers used all four.

The industry has started calling it "Black October". The label is a little dramatic. This was not one coordinated attack, and many of the intrusions had been running for weeks before anyone disclosed them. But the cluster of disclosures between 11 and 26 October tells a consistent story, and it is one every board in India should hear before their next risk review.

Here is what happened, what it had in common, and what to do about it this quarter.

The attacks that mattered

French supermarket fridges, 11 October

On the night of 11 October, someone logged into refrigeration controllers at up to 700 French supermarkets and switched them to defrost. Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc stores were hit. Cabinets reached 50°C within six hours, some caught fire, and whole aisles of food went in the bin. Loss estimates run into tens of millions of euros. (Wikipedia summary, Guardian)

The entry point was embarrassing. Danfoss controllers sat on the public internet, many end-of-life since 2016 and 2021, with a login of "admin" and a password equal to the current date. The flaws had been disclosed in March 2025. Most stores outsource refrigeration to service contractors, so the people who owned the risk never knew the devices were exposed.

ConnectWise Cloud Backup, 13 to 17 October

Attackers stole an application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a Microsoft 365 backup tool sold through MSPs. Because customers had already granted that app broad access to Exchange, OneDrive, SharePoint and Teams, the attacker needed no user password and no MFA. Huntress counted 162 tenants with unauthorised sign-ins by 16 October; later reports put it at 173. ConnectWise disabled seven app identities and pulled the service on 17 October. (BleepingComputer, SecurityWeek)

Microsoft has reportedly tied the intrusion to a group it tracks as Storm-0940, which used agentic AI tooling to move faster. (Redmond)

eMudhra certificate keys, disclosed 18 to 22 October

Eight international intermediate certificate authorities run by eMudhra, an Indian CA, had private keys generated with weak randomness. According to CERT-In, the keys could be recovered from the public keys. That is enough to mint a trusted certificate for any website. The certificates were revoked on 18 October, Chrome and Firefox blocked them, and Google scheduled removal of the root for 27 October. On 22 October eMudhra exited the global website certificate business. CERT-In says domestic DSC and eSign services use separate keys and were not affected, and no malicious use had been confirmed as of its advisory. (Gujarat Samachar)

State Bank of India, alerted 16 October

CERT-In and the Defence Cyber Agency alerted SBI on 16 October to customer data on the dark web. A seller claimed about 375,000 records. SBI's preliminary review found 3,897 customer records with names, mobile numbers, dates of birth, addresses, CIF numbers and loan details. The bank says core banking was not affected; the source of the leak is still under investigation. (Bloomberg)

Loan details plus a phone number is exactly what a convincing recovery-agent or loan-closure scam needs. Expect the fraud wave to outlast the breach news by months.

PHP2Shell, 21 October

Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Researchers found them with AI-assisted tooling in July. Details leaked on 20 October ahead of coordinated disclosure, Amazon reportedly saw exploitation attempts as early as 17 October, and patches for PHP 8.2 to 8.5 shipped on 21 October as Cloudflare recorded attacks. (Medium summary) If you run PHP and have not patched, assume you are being scanned now.

LiteLLM, 21 October

Attackers used stolen developer tokens to publish LiteLLM 1.107.0 to PyPI and Docker with a credential stealer inside. LiteLLM is the gateway many teams put in front of OpenAI, Anthropic and other model providers, which means it holds every AI API key the company has. Removing the package does not undo the theft. Every key it touched needs rotating.

Onamae Desktop Cloud, 20 to 21 October

GMO Internet confirmed that attackers got into the infrastructure behind its Onamae.com Desktop Cloud and planted malware on up to 26,739 customer servers. The service is popular in Japan for running automated FX trading, and GMO has since warned that trading account logins stored on those servers may have been taken. Every plan was shut down from 21 October with no restart date. (BleepingComputer)

The rest of the week

Cloud platforms Railway and Zeabur disclosed that customer environment variables, the place where database passwords and API keys live, may have been read. A compromised key at UpdraftPlus pushed malicious plugins to connected WordPress sites over 18 and 19 October. OVHcloud's CLI shipped malicious binaries for about 94 minutes on 19 October. GitLab patched a flaw rated 10.0. (CIC Lucknow)

On the ransomware side, Everest claimed 590 GB from PwC on 22 October, with the leak listing pointing to a Cornerstone OnDemand HR environment; the claim is unverified. (Cyber Security News) Closer to home, attackers reportedly demanded ₹30 crore from an unnamed Ahmedabad pharma company. (KonBriefing)

The pattern: four exposures, watched separately

No single control would have stopped this month's incidents. Each one sat in a different part of the risk picture, and most organisations split that picture across different tools, owners and review cycles.

Three things stand out.

First, the risk lived where nobody was looking. Supermarket security teams do not inventory fridge controllers because a contractor installed them. Engineers pull LiteLLM from PyPI without a procurement review because it is free. Neither shows up on a vendor list or an asset register, yet both turned out to be critical.

Second, the gap between disclosure and exploitation is now hours. PHP2Shell was being probed before it was public, and the ConnectWise attackers reportedly used agentic AI to move faster. Annual assessments and quarterly scans cannot keep pace. Only continuous monitoring can.

Third, every incident became a compliance event the moment it happened. CERT-In expects incidents reported within six hours. The DPDP Act carries penalties of up to ₹250 crore for failing to protect personal data. An organisation that cannot show which controls were in place, and when it knew, is exposed twice: once to the attacker and again to the regulator.

What to do this quarter

Work through all four surfaces, starting with what attackers are already scanning for.

Your external exposure

1. Patch PHP to the 21 October releases and check web server logs for exploitation attempts from 17 October onwards. Do the same for GitLab.
2. Check certificate chains for eMudhra intermediates and replace them. These are separate from eMudhra DSCs used for tax filings and tenders, which CERT-In says are unaffected.
3. Find every internet-facing device, including the ones contractors installed. HVAC, refrigeration, CCTV, access control, UPS. If it has a web login and faces the internet, it is yours to secure.
4. Watch the dark web and lookalike domains for your name. The SBI data surfaced there before the bank went public. Leaked customer data feeds phishing and impersonation for months.

Your third parties

5. Audit every app consented into Microsoft 365 and Google Workspace. Remove dormant ones and flag any that can read mail or files across the tenant. If ConnectWise or SkyKick was ever connected, check sign-in logs back to 13 October.
6. Rotate secrets held by hosting providers. Environment variables on Railway or Zeabur and credentials on any hosted server should be treated as exposed.
7. Monitor vendors continuously, not annually. You need to know about a vendor breach the day it is disclosed, and reassess that vendor the same week.

Your AI adoption

8. Inventory the AI tools in use, sanctioned or not. Know which gateways, agents and plugins hold API keys and what data they can reach.
9. Rotate every key that passed through LiteLLM 1.107.0. Uninstalling the package does not un-steal a key. Then pin versions and treat AI packages like vendors with access.

Your compliance posture

10. Test your incident reporting clock. Could you report to CERT-In within six hours, with the facts a regulator will ask for?
11. Move from point-in-time audits to continuous evidence. ISO 27001, RBI and DPDP controls should be monitored against live telemetry, so an incident does not also become an audit finding.

For banks and NBFCs: brief your customer service teams now on SBI-style data being used in loan and KYC scams. Customers will call you about messages that look like they came from you.

The takeaway

None of this month's big incidents needed a sophisticated exploit inside the victim's own estate. They needed one exposed device, one weak vendor, one unvetted AI package, or one control nobody was checking. The organisations that came through cleanly were the ones that could see all of it in one place and act the same day.

That single view is what Foresee Security is built for. Foresee is a cyber risk decision intelligence platform with four modules that share one engine:

• External Exposure Intelligence monitors your attack surface, applications, email and network security, brand impersonation, suspicious domains, and the deep and dark web.
• Third-Party Cyber Risk Intelligence watches your vendors across the same areas, starts a reassessment automatically when one is breached, and makes it far easier for vendors to respond.
• Continuous Compliance Intelligence pulls live telemetry from your stack across 55 frameworks and 182 integrations, with risk management, internal audit and KPI/KRI tracking, cutting audit readiness from months to weeks.
• AI Adoption Intelligence finds the AI in use across your business, lets you monitor or block it according to policy, and keeps spend under control when you run more than one enterprise AI.

Under all four sits Foresee AI, the decision engine. It is shaped by the judgement of a council of senior CISOs, each with 15+ years in the field, and it turns findings from every module into one prioritised list of what to fix first. For teams that need certification, we also take you through ISO 27001 end to end, from readiness to audit, with your choice of certification body.

See the Foresee platform www.foreseesecurity.io or write to us at info@foreseesecurity.io.