Cutting through the noise to highlight the cybersecurity developments most likely to affect your organization: the threats worth acting on and the incidents worth learning from.
Cyber Matters is Withum’s bi-weekly brief on the cyber threats and incidents that deserve leadership attention. Each edition filters two weeks of government alerts, vendor research and incident reporting down to the developments that change risk, and pairs each with practical steps. This edition covers October 12 through October 26, 2026.
Three themes defined the period. Attackers kept coming through the front door, with zero-days in Ivanti Connect Secure and BeyondTrust Remote Support exploited before customers could patch. Speed kept rising, as AI helped researchers find a critical flaw in PHP itself and helped ransomware crews run intrusions at scale. Additionally, systems that organizations rely on but do not run failed repeatedly, from supermarket refrigeration controllers to an AI software release pipeline, a hosted-server platform and a national lab-ordering portal. Microsoft’s October Patch Tuesday added to the load: by BleepingComputer’s count it fixed a record 1,411 flaws, including one actively exploited zero-day (CVE-2026-96951).
Attackers kept coming through the front door this cycle, exploiting remote-access tools before customers could patch. AI made them faster, and much of the damage landed through systems organizations rely on but do not run.
Overall risk this cycle: HIGH
Attackers exploited zero-days in Ivanti Connect Secure and BeyondTrust Remote Support before customers could patch; a critical PHP flaw was probed before its fix shipped; and attacks on supermarket refrigeration controllers, an AI software release pipeline, a lab-ordering portal and a hosting platform hit organizations through systems they rely on but do not run.
New and evolving attack methods to be aware of and steps to reduce your exposure.
On October 13, Ivanti disclosed CVE-2026-104935, an authentication bypass in its Connect Secure VPN gateway that lets a remote, unauthenticated attacker run commands on the appliance. Ivanti confirmed exploitation affecting a limited number of customers, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day. According to Volexity’s investigation, as summarized by Beazley Security, an actor tracked as UTA0576 repeatedly exploited a fully patched 22.8R2.4 appliance starting October 3 and chained the bug with a second, still-unpatched privilege-escalation flaw to gain root and steal Active Directory secrets. The attackers left no web shell or backdoor, patched code in memory only, deleted log entries and evaded Ivanti’s Integrity Checker Tool. A clean scan does not mean a clean appliance.
Sources: Beazley Security Labs, “High-Severity Authentication Bypass Vulnerability in Ivanti Connect Secure Under Active Exploitation (CVE-2026-104935),” October 13, 2026; Ivanti, “Security Advisory Ivanti Connect Secure (CVE-2026-104935),” October 13, 2026
BeyondTrust disclosed CVE-2026-102764 on October 15, a critical flaw (CVSS 4.0 score 9.3) in self-hosted Remote Support versions 26.2.3 and earlier. Google Threat Intelligence Group and Mandiant attribute zero-day exploitation, beginning August 29, to a suspected China-nexus espionage group they track as ARMORY CASTLE (formerly UNC5221). Mandiant reports that the actor escalated to root, installed a web shell and a tunneling tool, harvested credentials, deleted logs and then used the platform’s own administrator access to reach internal systems. CISA added the flaw to its KEV catalog on October 16; BeyondTrust-hosted (SaaS) deployments are already patched. The group’s documented targets include legal services, SaaS providers and business-process outsourcers, so a compromise at a provider can become a path into its customers.
Sources: CISA, “CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support,” October 16, 2026; Cloud Security Alliance AI Safety Initiative, “BeyondTrust Remote Support Zero-Day: Armory Castle Appliance Takeover,” October 18, 2026
On October 21, the PHP project shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) to fix CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 that allow unauthenticated remote code execution. The bugs sit in PHP itself, not in a plugin, and PHP warns that all web deployments are affected, including Apache modules, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Researchers used AI tools to find and validate the flaws. Amazon’s honeypots logged exploitation attempts on October 17, four days before the fix; dozens of companies and government services took websites offline while they patched, and Cloudflare recorded millions of attack attempts. Branches 8.1 and older are end-of-life and received only minimal source backports. Exploitation is rated high complexity, which buys some time, but not much.
Sources: Datadog Security Labs, Nick Frichette, Emile Spir and Eslam Salem, “PHP2Shell – Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619),” October 21, 2026 (updated October 23); Kaspersky, “Critical PHP vulnerabilities put millions of websites worldwide at risk,” updated October 23, 2026
On October 21, Group-IB and NyxLab published an investigation into an actor known as k0t, who scans the internet for exposed Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices, exploits flaws or brute-forces logins, and then decrypts stored configuration secrets with a known default FortiOS key (CVE-2019-6693) to recover LDAP and Active Directory credentials. The researchers tied more than 70,000 exposed credentials to the campaign. Many victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, though the relationship remains unconfirmed. A day earlier, CISA, the FBI and international partners warned that SafePay ransomware has hit at least 600 critical infrastructure organizations since August 2024, entering through exposed credentials, brute-force attacks and VPN access. The pattern is the same: weak or reused credentials on internet-facing devices.
Sources: The Hacker News, Ravie Lakshmanan, “Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials,” October 23, 2026; BleepingComputer, Sergiu Gatlan, “CISA: SafePay ransomware hit over 600 critical infrastructure orgs,” October 21, 2026
SOCRadar found an exposed server run by affiliates of the INC and The Gentlemen ransomware groups and recovered their AI tooling, including a framework the operators call Phantom. The model is “AI-executed, human-approved”: an operator writes a victim-specific prompt and approves each step, while commercial AI models plan reconnaissance, generate commands, triage stolen data and draft extortion reports. The logs held 8,257 messages across 133 sessions and more than $23,000 in AI spending. The crew exploited FortiClient EMS, SimpleHelp, cPanel and VPN gateways at scale, targeted an estimated 62 organizations and staged 46 encryptor builds for an October 1 deployment. AI did not invent new attacks here. It let a small team exploit known weaknesses faster and across more victims.
Sources: The Hacker News, Ravie Lakshmanan, “Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions,” October 23, 2026; SOCRadar Threat Research Unit, “INC and The Gentlemen Ransomware: Exposed AI Infrastructure,” October 20, 2026
Real-world breaches and the lessons they carry for organizations like yours.
Overnight on October 11 to 12, attackers took control of refrigeration controllers at hundreds of French supermarkets. Retailers told AFP that at least 300 Intermarché or Netto stores and more than 100 Coopérative U outlets were targeted; Carrefour reported 80 stores, Monoprix about 5 percent of its stores, and E.Leclerc several. Fridges and freezers reached 50°C (122°F), food was destroyed and small fires broke out, with reported losses in the tens of millions of euros. Danfoss said the affected units ran outdated firmware. CERT-FR confirmed compromises involving Danfoss, Copeland and Dixell controllers and warned the campaign was probably still active, and Sekoia reported activity in Spain, Portugal, Poland, Germany and Belgium. No zero-day was needed: exposed, out-of-date equipment, often managed by outside contractors, did the rest.
Sources: Reuters, Leo Marchandon and Gabriel Stargardter, “Hackers heat French supermarket fridges, sparking fires and spoiling food,” October 12, 2026; Al Jazeera, “Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack,” October 13, 2026; INCIBE-CERT, “Cyberattack on Supermarket Refrigeration Systems in France,” October 20, 2026
On October 21, attackers used stolen GitHub tokens belonging to three LiteLLM engineers to push a malicious version 1.107.0 of the popular open-source AI gateway, which sees about 23 million weekly downloads, through the project’s own release pipeline. The package was live on PyPI and in official Docker images for about two hours. It installed a credential stealer that runs whenever Python starts, even if an application never imports LiteLLM, and it targeted cloud, developer, AI-tool, browser and LiteLLM proxy credentials. LiteLLM believes the tokens leaked through an internet-exposed internal deployment whose logs captured AI coding-assistant sessions, and it had relaxed release approvals two days earlier. Wiz observed the attacker testing stolen AWS credentials about 4.5 hours after exfiltration. AI tooling now sits in the software supply chain, and its logs can hold the keys.
Sources: Datadog Security Labs, Ian Kretz, “LiteLLM supply chain compromise: What you need to know,” October 21, 2026; LiteLLM, Oliver Jensen and Mateo Wang, “The attack chain behind the v1.107.0 LiteLLM release,” October 23, 2026; SOCRadar, “New LiteLLM Supply Chain Attack Hits PyPI and Docker,” October 22, 2026 (updated October 23)
Quest Diagnostics learned on October 21 of unauthorized access to Quanum Lab Services Manager, the platform clients use to place test orders and look up results, and disclosed the breach to the SEC. The company believes the intruder accessed certain patient records; the number of patients and the types of data remain under investigation, and no group had claimed the attack at the time of reporting. Quest notified federal law enforcement, engaged outside experts and stopped the system, directing clients to paper requisitions or Quanum eLabs. Quest told the Associated Press the breach was unrelated to the PHP flaws. Quest says it serves one in three U.S. adults each year, so the reach of this incident could extend across many physician practices and health systems.
Sources: BleepingComputer, Bill Toulas, “Quest Diagnostics confirms data breach exposed patient records,” October 23, 2026; AP News, “Quest Diagnostics reports cyber breach affecting ‘certain patient records’,” October 22, 2026
GMO Internet confirmed on October 20 that an outside party had installed malicious programs on customer servers in its Onamae.com Desktop Cloud, a Japanese hosted-server service marketed for automated foreign-exchange trading. Starting at 4:00 a.m. local time on October 21, it shut down servers on all plans; up to 26,739 servers are potentially affected. Customers then reported unauthorized operations on their trading accounts, and GMO warned that trading-tool passwords stored on the servers may have been viewed. It consulted police on October 22 and has set no restart date. GMO also cautioned that changing a password may not end an attacker’s open session with a broker. When the provider is breached, your own controls do not decide the outcome.
Sources: BleepingComputer, Bill Toulas, “Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected,” October 21, 2026; GMO Internet, “Notice and Apology Regarding Unauthorized Access to ‘Onamae.com Desktop Cloud’ (Second Report),” October 22, 2026
Three themes tie this cycle together. First, the front door remains the target: Ivanti, BeyondTrust and the k0t campaign all turned remote-access and edge appliances into entry points, and two left little evidence on the device. Second, speed favors the attacker: AI helped find PHP2Shell, attackers probed it before the fix shipped, and ransomware affiliates used AI agents to work dozens of targets. Third, much of your risk lives in systems you do not run: a refrigeration controller, a release pipeline, a lab portal and a hosting platform each failed on someone else’s watch.
Want help assessing how these developments could affect your organization? Withum’s Risk Advisory and Assurance Services Team can help identify potential exposure and prioritize next steps.
This brief is for general informational purposes only and is not legal or professional advice. It reflects public reporting available as of October 26, 2026.
It is Cybersecurity Awareness Month again. Along with the ubiquitous ads hawking pumpkin spice this and pumpkin spice that, it is also the time of the year where you become inundated with why you should employ cybersecurity and what could, and will, happen if you don’t. Given the volume of data your organization protects and…
Cybersecurity Awareness Month reinforces the importance of employee awareness and sound security practices. As highlighted in our recent article on cyber risk and the changing threat landscape, organizations face increasingly sophisticated threats. But training and technical safeguards can only go so far without appropriate verification and oversight. Employees routinely approve financial transactions, manage access to…
Reporting window: September 28 – October 12 (trailing 14 days) This period had one defining pattern. Attackers came in through access someone else had already approved: a vendor’s login to a national register, an employee’s cloud credentials, a customer portal, and the consoles that manage whole networks. One ransomware attack on a cloud provider then…
