October 2026 Cyber Timeline

Hi everyone, I am Nitin Gavhane and In this blog I am putting together a plain list of the cyber incidents that hit in October 2026 so far, with sources and a rough timeline so you can check the original reporting yourself.

October turned messy fast. By the third week people on X started calling it Black October because so many serious things landed in a short window. Most of the noise came from critical PHP flaws, a few supply chain hits, and some large account dumps. Here is what actually showed up in the reporting.

Rough timeline

• 17 October: Amazon detects early PHP2Shell exploitation attempts against its MadPot honeypots.
• 20 October: Onamae Desktop Cloud confirms malware on customer servers. Zeabur breach details surface. eMudhra certificate issues begin circulating.
• 21 October: PHP patches for CVE-2026–109618 and CVE-2026–109619 ship. LiteLLM malicious package appears.
• 22 October: Capcom discloses its account system breach. Educational Testing Service / California student data incident is reported. Multiple outlets start using the "Black October" label.
• 23 October: Broader coverage of SafePay, edge-device credential campaigns, and remaining supply-chain fallout.

PHP2Shell

Two critical remote code execution bugs in the PHP runtime itself, tracked as CVE-2026–109618 and CVE-2026–109619. They scored around 9.8. Patches landed on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon saw exploitation attempts against its honeypots as early as 17 October, four days before the public disclosure. A public proof of concept appeared quickly. Cloudflare and others reported scanning traffic, and some European government sites temporarily went offline while admins applied the fixes. PHP still runs a huge percentage of the web, so the window mattered. Source: Telefonica Tech weekly briefing, 17–23 October and The Hacker News coverage.

Capcom

The Japanese game company confirmed unauthorized access to its CAPCOM ID system. Roughly 11.7 million email addresses and some login metadata were exposed. Attackers also changed passwords on about 196 accounts. Capcom disclosed this around 22–23 October. Source: Infosecurity Magazine and Cyber Breaches incident page.

Educational Testing Service and California student data

A compromised login on an Educational Testing Service server let someone copy years of California student testing records. The potential scale is in the millions of records. This was reported around 22 October. Source: Cyber Breaches.

LiteLLM supply chain hit

A malicious version of LiteLLM 1.107.0 was pushed to PyPI and public Docker registries. The package contained a credential stealer and a backdoor. The compromise happened through stolen developer tokens. LiteLLM is a popular open source proxy for large language models, so a lot of AI tooling was exposed until people rotated keys. Source: Cyber Breaches timeline and Help Net Security.

eMudhra certificates

Researchers found that eight intermediate certificates from the Indian certificate authority eMudhra had weak private keys that could be recovered. Mozilla, Google and Apple blocked the certificates. This raised the risk of forged trusted certificates for a short period in mid to late October. Source: Cyber Breaches and SecurityToday Black October roundup.

Zeabur

The developer platform Zeabur disclosed that an attacker used leaked internal credentials to get into its shared cluster. Data for about 321,810 accounts and millions of environment variable records was exposed. Zeabur announced it would shut down by the end of the year. Source: Cyber Breaches and SecurityToday.

Onamae Desktop Cloud

GMO Internet's Japanese VPS service confirmed unauthorized access and the installation of malicious programs on customer servers. Up to around 26,700 servers were taken offline. This was reported on 20 October. Source: Cyber Breaches.

AOMEI Backupper

Google Threat Intelligence attributed a supply chain compromise of AOMEI Technology's update servers to a cluster tracked as UNC7017. The attackers used the update channel to push a backdoor. Victims were reported in Spain. Source: Telefonica Tech briefing.

SafePay ransomware

A joint advisory from the FBI, German authorities and UK agencies listed SafePay as one of the more active ransomware groups. They tied it to at least 600 organizations in the United States and Europe. The campaign started earlier, but the advisory dropped in October and kept the group in the news. Source: Telefonica Tech briefing and SecurityToday.

Edge device campaigns

Researchers also reported large scale scanning and credential theft against exposed Fortinet FortiGate and Palo Alto GlobalProtect devices. Tens of thousands of credentials were collected. Some of the actors appear linked to ransomware groups. Source: The Hacker News.

There were smaller or secondary reports as well: ConnectWise temporarily suspending certain backup services after unauthorized access to Microsoft 365 application identities, token spraying against Microsoft 365 accounts, and various Japanese e-commerce member data leaks. Nation state activity continued in the background, including suspected Chinese APT use of a UEFI bootkit called BlackX against diplomatic targets in Central Asia.

None of these incidents is isolated. Many of them share the same root causes: unrotated credentials, weak key generation, unpatched critical software, and supply chain trust that is still too easy to abuse. The PHP2Shell case is especially useful as a reminder that runtime patches matter more than just updating the application layer.

A live tracker that tries to keep the full October list updated is available at AgentBeam's October 2026 attacks page.

Which of these hit closest to the tools or infrastructure you actually run day to day?