PHP2Shell dominated the second half of October, bringing renewed attention to an old weakness in PHP's memory handling. CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution vulnerabilities in PHP itself, both rated CVSS 9.2. The underlying out-of-memory issue had been identified in 2020 and revisited in 2024, but remained unresolved because practical exploitation had not been demonstrated. Amazon recorded an attempt against a honeypot on 17 October, while the flaws were still under embargo. PHP moved its fixes forward to 21 October, followed by a dispute over whether Chainguard's fixed images had appeared more than six hours before the coordinated release. Chainguard denied leaking the information. Cloudflare reported a surge in attempts from thousands to millions, while a UK minister told the House of Lords that 32 government services had been taken offline, largely as a precaution.

Evidence of successful exploitation emerged more gradually. WatchTowr found that much of the circulating proof-of-concept code crashed its target. Sophos confirmed one compromise, while CrowdStrike found no successful exploitation in its investigations, citing the difficulty of matching a target's PHP, container and application versions. On 24 October, a researcher's honeypots recorded 35 shell executions using a deliberately favourable, single-worker mod_php configuration. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October but did not disclose the evidence behind its decision. The most consequential reported intrusion involved firewall infrastructure. Dream described suspected Chinese attackers chaining PHP2Shell with the Fragnesia Linux kernel vulnerability to gain root access to 25 servers, including PAN-OS firewalls. In one case involving a US government-affiliated organisation, the attackers reportedly tunnelled into the internal network. Palo Alto Networks said approximately 0.02% of its installed base had an exposed management interface and was affected. Unit 42 estimated that more than 22.6 million instances might be exposed, although this figure represents potential exposure rather than confirmed vulnerable systems or successful intrusions.

Other major incidents highlighted compromises of trusted access and software distribution. LiteLLM version 1.107.0 reached PyPI after a master key exposed in May led to the theft of GitHub tokens and the manipulation of its release process. OVHcloud CLI binaries were replaced on five existing releases for approximately 94 minutes because release immutability was not enabled. A trojanised Claude Code extension remained available through Cursor's marketplace for 11 hours, potentially reaching up to 5,000 users. ConnectWise Cloud Backup credentials were used to access at least 162 Microsoft 365 tenants. In Denmark, the CPR register's data on 8.8 million people was exposed through a private company's lawful access, while researchers recovered private keys for eight eMudhra intermediate certificates in under a second. Binance's $6.3 billion theft was attributed to North Korea's TraderTraitor by TRM Labs and Chainalysis, but Binance has not published a root cause.

Law enforcement operations continued alongside the major incidents. Operation KillSwitch seized KillSec's leak site, Germany arrested a suspected Qilin leader, and INTERPOL's Operation Serengeti III resulted in 1,462 arrests across 21 countries. AI also featured in reports of attacker activity, including Microsoft's account of the ARTEX framework and an agentic intrusion involving the Dutch Institute for Vulnerability Disclosure's Zammad system. The PHP2Shell investigation provided a contrasting example: AI-assisted analysis can help identify and develop attack techniques, but does not by itself make a complex exploit reliable across different environments.

CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution flaws in PHP, both rated CVSS 9.2 and fixed on 21 October. Amazon recorded an attempt on 17 October while the flaws were under embargo, honeypots logged working shell execution on 24 October, and CISA added both to its KEV catalogue on 26 October. Dream also reported a campaign chaining them with the Fragnesia Linux kernel bug to root 25 servers, including PAN-OS firewalls, though CrowdStrike and WatchTowr found reliable exploitation harder than the volume of scanning implies.

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, rated 9.2, that affects Node.js, Bun, Envoy, Istio and the Python Brotli and brotlicffi packages. Python packages were initially unmapped in advisory databases, so common dependency scanners did not flag them. CISA added the flaw to KEV on 27 October, and Qualys telemetry showed only about 42,000 of roughly three million Node.js installations patched, with 1.7 million on end-of-life versions.

Atlassian's CVE-2026-21589 was attacked within hours of a public proof of concept, and watchTowr showed a leaked Jira crowd.properties file could lead to administrator access. SonicWall's maximum-severity SMA1000 SSRF was exploited three days after patching, Cisco's vManage authentication bypass exposed around 1,500 devices, and Citrix's NetScaler SAML flaw became the sixth exploited NetScaler issue on KEV this year. Ivanti Connect Secure was hit through a chain of three zero-days, and Cisco's Secure Email Gateway flaw allowed root commands through a crafted attachment before a fix existed.

A master key leaked in May let attackers publish malicious litellm 1.107.0 on 21 October, which was downloaded about 49,000 times in under two hours. OVHcloud CLI releases were swapped for 94 minutes because release immutability was disabled, the Gheist campaign planted secret-dumping workflows across more than 850 compromised GitHub accounts, and a trojanized Claude Code extension reached up to 5,000 Cursor users over 11 hours. In each case the attackers used legitimate credentials and distribution channels rather than a software vulnerability.

An attacker used a compromised ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens, with Huntress confirming 162 affected tenants. In one tenant the attacker granted a second application Global Administrator rights and added secrets to others, so resetting the original credential did not remove every access path. ConnectWise suspended three services, and Microsoft attributes the activity to China-aligned Storm-0940 using the ARTEX agentic framework.

The Dutch Institute for Vulnerability Disclosure said an agentic attack chained two Zammad zero-days from session hijacking to root, and Horizon3 used Anthropic's Mythos to build a working Rejetto HFS exploit that was attacked within a day. ARTEX was used against South Korean financial organisations, while Booz Allen's tests showed frontier models completing all eight industrial control scenarios under human approval. Anthropic and OpenAI separately disclosed models exceeding intended limits in testing and removed live internet access from evaluation and training environments.

Binance said a compromised DevOps engineer's laptop may have given an attacker access to a service container, and later reported additional points of breach. TRM Labs described a single transaction carrying 50 pre-signed authorisations that moved the hot wallet's entire balance minutes later. TRM Labs and Chainalysis attribute the theft to North Korea's TraderTraitor with high confidence, while Elliptic notes slower laundering than usual, and about $3.33 billion remains with the attacker beyond issuers' reach.

Ledger confirmed an unauthorised hardware implant in devices sold through Southeast Asian reseller CryptoBilis, with on-chain researchers estimating suspected losses above $93 million. Trezor later reported a credible but unverified case of an extra board with a cellular module inside a Safe 5 bought from the same reseller, said to transmit the recovery phrase over a mobile network. Trezor has received no loss reports and advises buyers since March 2026 to move funds to a new wallet with a new seed.

Attackers abused a private company's lawful search access to Denmark's Central Person Register and retrieved names, addresses and CPR numbers for about 8.8 million people. The access belonged to Pays ApS, which confirmed it was abused, and the claimant reportedly said it was protected by the password 123456. The unusual searches ran through September and were noticed on the evening of 2 October.

Researchers recovered private keys for eight eMudhra intermediate CAs in under a second, prompting blocks in Mozilla, Chrome and Apple and eMudhra's exit from the global TLS business. About 30,800 unexpired certificates still chained to the emSign ECC G3 root on 21 October. Separately, attackers compromised the .gh, .sl and .as registries, altered DNS records and obtained valid certificates for several Google domains, which Chrome blocked through CRLSets.

Attackers reportedly abused the defrost function in older Danfoss refrigeration control software, forcing temperatures up to around 50°C and spoiling fresh and frozen food. Initial reports cited about 300 Intermarché and Netto stores and fewer than 100 Système U stores, with later reporting putting the total near 700 supermarkets and mentioning fires. France's ANSSI is investigating with European counterparts, and Danfoss says affected stores ran outdated firmware.

Operation KillSwitch seized KillSec's leak site holding at least 110 terabytes and covered about 1,000 suspected attacks, while Germany arrested a suspected Qilin leader after Japanese police detained him. A suspected ShinyHunters member was detained in Jordan and a Canadian ransomware negotiation executive was arrested in Pennsylvania, and INTERPOL's Serengeti III produced 1,462 arrests across 21 countries. In the US, 14 people were charged over a North Korean remote IT worker scheme in which 187 laptops were seized.