CTI Report — October 2026: Edge Exploits and a $6.3 Billion Heist

Section 01Executive summary

October 2026 ended with the largest crypto theft on record: Binance confirmed about US$6.3 billion in unauthorised withdrawals from its hot wallets on 29 October. As of 31 October withdrawals were still suspended and Binance reported 90% of the stolen assets replenished (Binance Update #2; Binance Update #3). The attribution to North Korea's TraderTraitor comes only from blockchain-analytics firms. Binance and the US government have not attributed the theft (Elliptic). Around that event, the month's technical picture was dominated by exploited edge and enterprise software. CISA added 36 CVEs to its Known Exploited Vulnerabilities (KEV) catalog between 1 and 30 October, led by Ivanti Connect Secure (three chained CVEs), Cisco (two), Fortinet (two), BeyondTrust, Palo Alto Networks, PHP and Citrix (CISA KEV CSV). Other confirmed incidents of the month were a ransomware attack on SoftBank's IDC Frontier cloud that affected 495 Japanese customers, a refrigeration-system attack on hundreds of French supermarkets now under investigation by the Paris prosecutor, and a run of very large Japanese and Danish personal-data breaches. Researchers also documented the first widely reported real-world abuse of an agentic-AI attack framework, ARTEX, by several China-linked clusters.

Section 02How confirmation is labelled in this report

Every claim below carries one of these labels, and the label shows how far that claim has been confirmed:

Section 03October day by day: the verified timeline

Section 04Thirty-six KEV additions show edge appliances drew the most exploitation

The KEV catalog is the cleanest record of what was confirmed exploited in October. A fresh download on 31 October holds exactly 36 entries dated 1–30 October and none dated 31 October (CISA KEV CSV). Cisco Catalyst SD-WAN Manager CVE-2026-76504 was added on 30 September, so it is not part of the October count. Most entries came with very short federal due dates of about three days under BOD 26-04 ("Prioritizing Security Updates Based on Risk"), and many carry a forensic-triage requirement (CISA KEV CSV). Several "October" entries were patched months earlier and only became KEV-listed now: Adobe Commerce (July), Fortinet CVE-2025-61624 (April), VMware ESX (July), Plex (September), Zammad (late September), Linux Fragnesia (disclosed May) and five 2015–2023 CVEs. The KEV date should not be reported as the disclosure date.

October KEV additions by type of software36 CVEs · CISA KEV

Edge, VPN, mail and remote-access appliances11

Web apps and open-source components13

Other enterprise and consumer software9

Operating systems and hypervisors3

Ivanti's three-CVE chain was the month's longest-running exploitation story

The Ivanti story ran all month. CISA's 13 October alert said attackers were exploiting CVE-2026-104935, an authentication bypass allowing remote unauthenticated command execution, for credential theft and data exfiltration. It warned that "Ivanti's Integrity Checker Tool may not detect exploitation" because commands execute in memory (CISA). Volexity, which CISA's alert recommends, describes three stages. First, requests reach protected CGIs via an X-DSCGI-PATH header. Second, a Perl script uploaded with a .zip extension executes in a race window as the cgi-server user. Third, in-memory patching of libdsplibs.so makes the dsinvoked process run Perl as root. Volexity dates exploitation from 3 October, attributes it to UTA0576 (assessed with low confidence as criminally motivated), and says Ivanti patched the root-escalation step on 29 October (Volexity). CISA added the root-escalation flaw CVE-2026-111357 (CVSS 3.1 7.0) and the predictable-identifier upload flaw CVE-2026-118527 (no NVD record yet) to KEV on 30 October, with KEV text saying both chain with CVE-2026-104935 (NVD; CISA KEV CSV).

Sources conflict on versions and are flagged here. CISA lists ICS 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. Canada's Cyber Centre lists 25.1.1.1, 25.2.2 and 22.8R2.4 and prior (CCCS AV26-1035). NVD pins CVE-2026-111357 to 22.8R2.4. Ivanti's advisory renders only with JavaScript and could not be read, and secondary sources disagree on whether exploitation began on 3 or 8 October. A plausible reconciliation, which remains an inference, is that 22.8R2.5 fixed the initial bypass and CISA later counted it as affected because the root step was fixed only on 29 October. Until Ivanti's own advisory can be checked, the safest guidance is to update to the latest Ivanti release issued on or after 29 October rather than to a specific build.

The other edge-device zero-days were confirmed by their own vendors

For most of the other headline flaws, the vendor itself confirmed exploitation, which is the strongest kind of confirmation. Fortinet's FG-IR-26-175 marks FortiMail CVE-2026-104286 (CVSS 3.1 9.8, unauthenticated path traversal via IBE) as exploited. Fixes are 8.0.2, 7.6.7, 7.4.9 and 7.2.10 ("upcoming" at the time), and FortiMail 7.0 must migrate (FortiGuard; NVD). Cisco's PSIRT stated it "became aware of active exploitation" of Secure Email Gateway CVE-2026-76519 (CVSS 9.8) and of ASA/FTD CVE-2026-76418 (CVSS 8.6), a no-login denial of service on SSL VPN tunnel groups with secondary authentication (Cisco SEG; Cisco ASA/FTD). Palo Alto rates PAN-OS CVE-2026-0322 CVSS v4.0 8.6 with exploit maturity "ATTACKED" and says "very limited exploitation has been observed" (Palo Alto). For BeyondTrust CVE-2026-102764, confirmation comes from CISA, which describes initial access followed by persistence, privilege escalation and lateral movement, and asks defenders to image and rebuild appliances and rotate every credential they stored or injected (CISA). The claim that Google attributed BeyondTrust exploitation to a China-linked cluster "Armory Castle" since 29 August is secondary only (BleepingComputer). Arista said it detected exploitation of VeloCloud Orchestrator CVE-2026-114625 itself, and Siemens ProductCERT "validated" exploitation of Software Center CVE-2026-110936. In the Siemens case, attackers side-loaded malicious DLLs beside a genuine signed binary distributed outside Siemens channels, and Siemens' warning against pasting commands into Run or PowerShell suggests ClickFix-style delivery (Arista; Siemens).

PHP, Brotli and GitLab put open-source infrastructure in the KEV list

The PHP pair was the month's widest-reaching open-source event. PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October for CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale request state), both rated CVSS v4.0 9.2. PHP warned that its mitigations "do not make an installation safe" and that mod_php is highest risk (PHP). CISA added both to KEV on 26 October and said unsupported PHP 8.1 and earlier systems should be taken offline until patched (CISA). Its KEV entry for Linux kernel CVE-2026-46300 ("Fragnesia"), added 28 October, says the flaw "can be chained with" the PHP CVEs to implant webshells and run commands as root (CISA KEV CSV). Google Brotli CVE-2026-111497, a decoder buffer overflow fixed in 1.0.10, 1.1.1 and 1.2.1, reached Node.js releases (v26.12.1, v24.22.1, v22.23.4) and PHP's Windows builds. The only basis for the exploitation claim is CISA's KEV listing; no vendor statement of in-the-wild use was found (NVD; Node.js). GitLab CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex) is fixed in 19.2.8, 19.3.5 and 19.4.2. A Metasploit module exists, and the Ruby team published related regexp fixes on 23 October (NVD; Ruby).

The full October 2026 KEV list

The table gives the KEV date and due date from the CISA CSV, CVSS and versions from NVD or the vendor, and the party that confirmed exploitation. "KEV only" means no vendor or researcher statement of exploitation was found beyond CISA's listing. A dash means the field could not be confirmed; it is unknown, not zero.

The 8 October batch (rows 5–9) is not a random set of old bugs. CISA's AA26-281A advisory, published the same day, lists exactly those five CVEs, marked as newly added to KEV, among the flaws successfully exploited by actors enabled by Integrity Technology Group (CISA AA26-281A). October's KEV list has no Juniper, SonicWall, F5, Zimbra, Jenkins or WordPress entries; those vendors' latest KEV entries date from September or earlier (CISA KEV CSV).

Section 05Patch days were heavy in volume but light on exploited flaws

Microsoft's 13 October Patch Tuesday counts differ by method: 1,407 CVEs per Tenable (69 Critical) and 1,411 per BleepingComputer, which excludes 348 flaws fixed earlier in the month (Tenable; BleepingComputer). Only CVE-2026-96951 (Windows Shell MotW bypass, CVSS 8.8) was exploited. BleepingComputer counts two more zero-days that were publicly disclosed but not exploited: CVE-2026-108398, a .NET Framework WDAC bypass credited to James Forshaw, and CVE-2026-92707, a MessagePack-CSharp DoS that Tenable does not count as a zero-day (NVD; NVD). SAP's 13 October Patch Day had 16 new notes and 4 GitHub advisories. The headline items were CVE-2026-89111 (Cloud SDK for Python OAuth2 SSRF, CVSS 10.0), CVE-2026-89110 and CVE-2026-89107 (9.9) and CVE-2026-89108 (9.1) (SAP). Oracle's 20 October CPU had 1,295 new security patches, 194 of them for E-Business Suite. Tenable counted 1,209 unique CVEs, Oracle flagged none as exploited, and the next CPU is 19 January 2027 (Oracle; SecurityWeek).

Browsers and mobile were quiet on exploitation. Google's October Android bulletin (patch level 2026-10-01) fixed 25 CVEs, seven of them Critical, and contains no exploitation statement. A Secarma claim of "limited, targeted exploitation" is therefore not supported by Google's bulletin (Android). The Chrome Releases feed for October has no "in the wild" statement. Chrome 156 on 27 October carried 52 security fixes (4 Critical), followed by 21 more on 29 October (Chrome Releases). Mozilla fixed no exploited flaw. Firefox 158.0.1 (20 October) blocked a compromised eMudhra intermediate certificate, which OneCRL had blocked on 17 October (MFSA2026-111). Apple's only October security content verified here is the 26 October iOS/iPadOS 18.7.11 backport of the September CoreGraphics zero-day (Apple 149225). On ICS Patch Tuesday, Siemens issued 17 advisories and Rockwell fixed two 1732E ArmorBlock flaws. These details come from a SecurityWeek search snippet and lack CVE-level confirmation (SecurityWeek).

Section 06Binance's $6.3B loss is confirmed; who did it is not

Binance's own statements are the only confirmed facts about the cause and scale. Update #2 says hot wallets were compromised at about 20:05 UTC on 29 October and roughly $6.3B in token assets were withdrawn without authorisation. The initial suspicion of a compromised DevOps engineer's laptop gave way to "additional breach points", and there was no evidence that private keys leaked. More than $6.34B was set aside to absorb the loss (Binance Update #1; Update #2). Update #3 (31 October) raised coverage to 90%, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed. The funding comes from SAFU, part of the Futures insurance fund and corporate treasury. Binance said it remained "on track" to reopen withdrawals on 1 November. It gave no root cause, frozen-funds figure or attribution (Update #3). Co-CEO Richard Teng, quoted by Elliptic, said the attack "was not carried out by one person" and that an EIP-7702 delegation "did not pass through our normal approval controls" (Elliptic).

Binance: stolen and frozen, by who is countingUS$ billions · 29–31 Oct

StolenFrozen

Binance$3.0B · $6.3B

TRM Labs$2.7B · $6.36B

Elliptic$2.85B · $6.43B

Chainalysis$2.8B · $6.4B

$0B$1B$2B$3B$4B$5B$6B$7B

US authorities confirmed involvement but not attribution. The FBI said it is "aware of the incident" and coordinating with partners. A US Secret Service spokesperson said investigators were working with private partners "including Circle, to identify, freeze, trace and recover funds" (Bloomberg; Decrypt). The issuers' freezes were confirmed by their executives, quoted in press. Tether CEO Paolo Ardoino said Tether "froze more than 1.567B USDT", and Circle's Jeremy Allaire said Circle froze more than $800M in USDC (Decrypt).

The attribution is a private-sector assessment, and the three firms worded it differently. TRM Labs attributes the theft "with high confidence" to TraderTraitor, prices it at $6.36B, and describes an EIP-7702 delegation using 50 pre-signed authorisations prepared at least 36 hours in advance (TRM). Elliptic says it is "likely" TraderTraitor, puts the loss at $6.43B, and states that "No government or law enforcement agency has confirmed attribution" (Elliptic). Chainalysis assesses it as TraderTraitor's work without a confidence level, citing commingling with proceeds of the September Bitget theft (Chainalysis). In short: Blockchain-analytics firms TRM Labs (high confidence), Elliptic ('likely') and Chainalysis attribute the theft to North Korea's TraderTraitor. Binance and the US government have not attributed it. On 30 October Chainalysis also disclosed its own, unrelated breach: an attacker using "AI-driven techniques" exposed user IDs, names, emails and role labels. Chainalysis says it is unrelated to Binance, and the two should not be conflated (Chainalysis incident).

Section 07Japan, Denmark and France supplied the month's largest confirmed breaches

The table separates what victims confirmed from what attackers claimed. Japanese figures come from press quoting the companies' notices, cross-checked across several outlets. The company sites themselves were not fetched.

Largest breaches confirmed by the organisation itselfmillions of records or people

Skyticket14.64M customers

Capcom11.77M CAPCOM ID records

Yakiniku King10.79M app members

Daiichi Kosho8.72M records

Florida Dept of Education4.90M people

Sony Network Communications2.59M records

DTU (Denmark)up to 200K users

Daiwa Securities (via vendor)110K people

JAL / JTA (via Amadeus)92K people

Several incidents first reported earlier in the month were updated by their victims:

Two reporting lessons follow. First, both October SEC filings used Item 8.01, the voluntary "other events" item, so neither Quest nor Revolve should be described as filing a "material cybersecurity incident" (SEC Quest). Second, the accurate headlines are "SBI confirms 3,897 customer records exposed", "Ampath confirms cyberattack, disputes 80M figure" and "H&M says no evidence of breach". "Ampath 80M patients", "SBI 375K" and "Xuanye hacked H&M" are all inaccurate: the Xuanye claim concerned ASOS, not H&M (Beinsure).

Section 08Ransomware claims topped 1,100, but few victims confirmed them

Leak-site trackers measure claims, not confirmed attacks. HackerFeeds, which aggregates ransomware.live, counted 1,119 claimed victims for 1–31 October (partial), up from 894 in September. The leaders were N0n (154), The Gentlemen (143) and Qilin (139), with Akira (35), SilentRansomGroup (33), Booba Project (31), Emperador (28), SafePay (27), Everest (25) and INC (23) behind them. The US accounted for 33.6% of claims, and manufacturing was the top sector (HackerFeeds). HackerFeeds itself warns these listings are unverified. The ransomware incidents that victims or authorities actually confirmed are a short list: IDC Frontier (no group named), SESAME (no group named), Oneonta City School District (local reporting; no group), the KillSec takedown and the Stryzhak sentencing (@IT; ISEC).

Ransomware leak-site claims by group, October 2026claims · not confirmed attacks

N0n154

The Gentlemen143

Qilin139

Akira35

SilentRansomGroup33

Booba Project31

Emperador28

SafePay27

Everest25

INC23

The joint #StopRansomware SafePay advisory (AA26-293A, released 20 October) is the authoritative profile of one group. It was co-authored by the FBI, CISA, USSS, Germany's LKA Rheinland-Pfalz, the UK NCA and the North West ROCU. It reports at least 600 victims since August 2024. Initial access comes through stolen or brute-forced credentials, VPNs, phishing and exposed services, with named CVEs CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. Encryption is hybrid ChaCha20/RSA, and the group factory-resets NAS devices and deletes backups (CISA AA26-293A). The 6 October FBI/USSS FortiBleed advisory reportedly names INC/Lynx and Payload as downstream affiliates using stolen FortiGate credentials. That detail is secondary, as is SOCRadar's figure of 86,644 compromised devices, which is a vendor number and not the government's (The Hacker News). Europol's KillSec action shows how young this ecosystem can be: the suspected principal operator is 16, a suspected developer turned 18 in August, and police secured at least 110 TB of stolen data (BleepingComputer).

Section 09Governments named China twice; vendors named everyone else

Only two joint government advisories in October named state-linked actors. The research found no other October joint CISA/FBI/NSA/Five Eyes advisory on Russia-, Iran- or DPRK-linked actors. The latest Russia-focused one (AA26-194A on FSB Center 16 routers) is from July (CISA AA26-194A). AA26-281A (8 October) describes Integrity Technology Group as a China-based, for-profit company linked to the Chinese government that builds tools, hosts infrastructure and compromises networks for others. The activity is "consistent with" Flax Typhoon, Ethereal Panda and Red Juliett, with a caveat that these names may not map one-to-one. Victims span US government, critical manufacturing, healthcare and IT, plus law enforcement, education and religious organisations in North America, Southeast Asia and Africa. The advisory was co-sealed by the UK NCSC, ASD's ACSC, the Canadian Cyber Centre, Japan's NPA and NCO, NCSC-NZ and Spain's CNI (CISA AA26-281A).

Government action against North Korea in October came as prosecution and sanctions rather than an advisory. DOJ's 13 October action charged 14 people in a remote IT-worker scheme affecting more than 70 US employers and seized about 187 devices from more than 40 Texas "laptop farms". OFAC followed on 28 October by designating 10 individuals and the First Financial and Technical Development Center (DOJ; Chainalysis summary of OFAC). Microsoft's 29 October report rates DPRK AI adoption "high" but says operations remain human-led. It places Jade, Coral and Jasper Sleet at the "operationalized" stage and reports that Onyx and Pearl Sleet used ARTEX from late October (Microsoft). Other attributions are vendor assessments. Warp Panda's reported zero-day use of VMware ESX CVE-2026-41709 against US legal firms comes from press (SecurityWeek). ESET's 28 October APT report covers April–September and describes renewed Iran-aligned activity (MuddyWater and the OilRig subgroup FilthyFeline, mostly against Israel) and Belarus-aligned activity converging with Russia's war priorities (WeLiveSecurity). The US also offered up to $10M for MSS-linked Zhang Yu over the Hafnium Exchange campaign (SecurityWeek).

Section 10ARTEX made agentic AI an operational attack tool

ARTEX is an open-source autonomous penetration-testing framework. A Chinese developer published it on GitHub in July 2026; GTIG names the GitHub user as Autumn-27. It won Baidu's "Agent+" red-team challenge in September. It uses a planner agent directing worker agents that run nmap, curl and Impacket against a shared findings graph. The sources disagree on what happened to it in October: Wiz says it was made closed-source on 8 October with over 12,000 forks, while GTIG says the repository was "taken down" (Wiz; GTIG). The two also disagree on when abuse began. GTIG dates adoption from late August, while Wiz's earliest in-the-wild artifacts are from late September, in attacks on South Korean banks.

Four vendors track its abuse under different names, and they do not all agree. Microsoft (21 October) calls Storm-0940 "China-state aligned". It says the group used ARTEX from as early as September and "assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise", in which compromised ConnectWise app identities were used to attempt sign-ins to more than 2,250 tenants (Microsoft). Wiz (22 October) tracks an ARTEX actor that "overlaps" with Storm-0940 and targets identity providers and Microsoft 365 integrations at IT and software vendors (Wiz). GTIG (30 October) tracks the Wiz-reported campaign as UNC7228, which it says overlaps with Storm-0940, and notes that extortion groups also use ARTEX (GTIG). CrowdStrike (29 October) links ARTEX controller infrastructure to the China-nexus actor VAPOR PANDA and says this activity is separate from Storm-0940. It reports more than 200 organisations reached in at least 14 countries and nine confirmed intrusions over 11 days from 17 October, using DeepSeek and the BLOODALCHEMY backdoor; one intrusion consumed about 1.4 billion input tokens (CrowdStrike). Recorded Future's TAG-217 (South Korean finance) is unlinked to any of these (SecurityWeek). The analytic conclusion is that ARTEX is commodity tooling, not an attribution marker.

ConnectWise's own statements confirm far less than the vendors' reports. The company confirmed that a Microsoft 365 application identity tied to Cloud Backup (formerly SkyKick) was abused. It disabled seven application identities on 17 October, suspended SaaS Security and Cloud Management as a precaution, and reset credentials by 20 October. It said it had "no indicators to date that Cloud Backup partner backup data has been compromised", but it also said it cannot determine independently whether a given tenant saw unauthorised activity (Help Net Security; Dark Reading). ConnectWise has not named an attacker; the Storm-0940 link rests on Microsoft's assessment alone. Tenant counts come from third parties and conflict: Huntress reported 162 organisations with suspicious sign-ins, and Microsoft reported more than 2,250 tenants attempted (CSO Online).

Section 11Stolen maintainer credentials drove a dense supply-chain wave

October's software supply-chain incidents mostly began with stolen or unrotated credentials rather than new CVEs, and many explicitly targeted AI-provider keys. LiteLLM confirmed that malicious litellm==1.107.0 builds reached PyPI, Docker Hub and GHCR on 21 October for roughly 100–160 minutes. The artifacts were built from an attacker-controlled lookalike repository after GitHub CLI OAuth tokens were (suspectedly) stolen from logs. The compromised images carry a valid old-key cosign signature, so users must verify image digests. LiteLLM advises users to "assume exfiltration succeeded" (LiteLLM). OVHcloud CLI binaries on releases v0.11.0–v0.15.0 were swapped for an infostealer for about 94 minutes on 19 October through a compromised contributor account. The CEO cited release immutability not being enabled. Sources conflict on whether Homebrew users were exposed (BleepingComputer; StepSecurity). Tensorlake npm 0.5.144 carried a self-replicating Shai-Hulud variant with a wiper dead-man's switch (Aikido). SubQuery @subql/common 5.8.3 was a release-pipeline compromise; StepSecurity explicitly says it was not trusted-publishing abuse (StepSecurity). The GhostAction wave swept 345 repositories, per StepSecurity. Corgea's "tens of thousands" conflicts with that figure (StepSecurity; Corgea).

WordPress and developer-platform incidents followed the same pattern. Rank Math PRO 3.0.123 copies downloaded between 15 October 20:02 and 16 October 07:12 UTC contained a hidden backdoor (CVE-2026-111862; Wordfence CVSS 9.8). Rank Math has disclosed neither the customer count nor the root cause (The Hacker News). TeamUpdraft believes its customer database was accessed with a compromised key. Connection keys were then used to create admin accounts and install malicious plugins on "a small number" of sites (TeamUpdraft). Railway confirmed anomalous access to environment-variable storage, with some values decrypted, and frames it as part of "a series of attacks recently targeting platform companies" (Railway). Zeabur confirmed exposure of 3,218,965 env-var records and 321,810 accounts through long-lived plaintext cluster-admin tokens. The initial credential source is unconfirmed, and Zeabur will shut down on 31 December 2026 (Zeabur). No vendor has tied these incidents to a single actor.

Section 12Law enforcement paired arrests with seizures and sanctions

Beyond KillSec, Serengeti III and Stryzhak, three large actions stood out. INTERPOL's Serengeti III reported 1,462 arrests, 10,909 networks disrupted, 65,929 victims identified, more than $105M recovered and losses exceeding $385M (INTERPOL). DOJ's Joint Disruption Week (6–9 October, hosted by the UK NCA) reported 28 arrests in Ghana and Nigeria and the removal of more than 3.7M Meta accounts, Pages and Groups (DOJ; Meta). The account of who led that operation is disputed: Ghana's Cyber Security Authority said its operation was planned and executed domestically and gave different figures (Time News). The DPRK IT-worker indictment and OFAC designations are described in the nation-state section above.

The DOJ Computer Crime and Intellectual Property Section (CCIPS) listing adds smaller cases. On 7 October a Florida ransomware-remediation company owner was charged with misleading victims. On 8 October Oleg Korniev pleaded guilty to running a money-laundering organisation for cybercriminals; a search summary instead said 22 October. On 23 October Zheng Zhao was extradited over a crypto investment scam, and on 30 October Alexander Gurevich was extradited over the Nomad bridge exploit (DOJ CCIPS). OFAC and the State Department also added five Chinese entities under PAIPA on 19 October (OFAC; State). No verified October security-breach fine from the ICO, EU DPAs, SEC, FTC, FCC or NYDFS was found, so none is reported here.

Section 13Policy moved in London and Brussels; Morocco focused on capacity

In the EU, CRA reporting through ENISA's Single Reporting Platform became mandatory for manufacturers on 11 September 2026. It requires a 24-hour early warning, a 72-hour notification and final reports, and open-source stewards follow from 11 December 2027 (European Commission). On 21 October the Council agreed its position on the Digital Omnibus (procedure 2025/0360), which amends acts including NIS2 and GDPR. A legal summary reports the Council keeps the GDPR definition of personal data and extends the breach-notification deadline; trilogue awaits Parliament's position (Consilium; Lovguiden). Austria's NIS2 law reportedly entered into force on 1 October; that comes from secondary trackers (nisd2.eu).

In the US, CISA 2030 sets 60-, 180- and 365-day milestones and shifts from passive defence towards finding and reducing malicious access to critical infrastructure (CISA). The 2015 information-sharing law runs on short extensions, reportedly through December under a September continuing resolution (Federal News Network). A report that the CIRCIA final rule went to OMB on 1 October rests on a single secondary source (Paubox). In the UK, the Cyber Security and Resilience (NIS) Bill completed Lords report stage on 26 October with government defeats. The amendments cover voluntary near-miss reporting, protection for good-faith researchers and an SME support service. Third reading is set for 2 November, and the Commons may reverse the amendments (UK Parliament; VinciWorks).

In Morocco and Africa, the DGSSI director-general presented cybersecurity as a pillar of digital sovereignty at the national cybersecurity week in Rabat (12–14 October). He announced plans to adapt the legal framework, strengthen detection and audit, and expand SME support (MAP Express; Le Brief). On 21 October DGSSI issued a critical alert on the two PHP flaws and urged migration off PHP 8.1 and earlier (Hespress). No notable Moroccan cyber incident in October was found. The Jabaroot leak, which the DGSN and DGST denied as an intrusion, dates from about late August and falls outside the window (Demócrata). Elsewhere in Africa, the month's verified items are Serengeti III across 20 African states, Joint Disruption Week in Ghana and Nigeria, Ampath's confirmed attack in South Africa, and African victims named in AA26-281A.

Section 14Claims this report does not confirm, and why

These items circulated during October but could not be confirmed from a primary source, fell outside the reporting window, or were contradicted. They are listed so readers can see what was checked and left out.

Section 15Conclusion

October 2026 changes the practical prioritisation question more than it changes the threat cast. Five of the most damaging exploited flaws scored below 9.0. Six Cisco, Palo Alto, Ivanti and Fortinet entries sit on firewalls, VPNs and mail gateways, and CISA's BeyondTrust and Ivanti guidance tells defenders to image, rebuild and rotate credentials rather than just patch. "Patched" and "clean" are therefore separate states, and remediation should be ordered by KEV status and trust position rather than by CVSS. The month's two largest losses, Binance and the ConnectWise app identities, involved neither a stolen private key nor a novel CVE: legitimate signing and authorisation paths were abused. That pattern also runs through the LiteLLM valid-signature releases and the OVHcloud mutable releases, which shows that provenance controls fail if the release or approval path itself is compromised.

For defenders, the practical lesson is to separate confirmation from assessment. In October the most consequential attributions came from vendors: TraderTraitor for Binance, Storm-0940 for ConnectWise and VAPOR PANDA for ARTEX intrusions. In each case the victim or the government had confirmed less than the headline implied. Several stories also moved after first disclosure: Florida's scope was published within hours, Ahold Delhaize updated its position a week later, and Binance's figures changed daily. Re-check every victim statement against its latest update before acting on it, and treat attackers' numbers as claims until the victim confirms them.

Section 16References

All URLs are original domains with tracking parameters removed.

Government and authorities

• [1]CISA Known Exploited Vulnerabilities catalog (CSV): https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
• [2]CISA, Ivanti Connect Secure alert (13 Oct, rev. 30 Oct): https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
• [3]CISA, BeyondTrust Remote Support alert (16 Oct): https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
• [4]CISA, PHP alert (21 Oct, rev. 26 Oct): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• [5]CISA KEV alerts: https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog ; https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
• [6]CISA AA26-281A (Integrity Technology Group): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a and news release https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat
• [7]CISA AA26-293A (SafePay): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a and news release https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical
• [8]CISA AA26-194A (July, context): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
• [9]CISA 2030: https://www.cisa.gov/news-events/news/cisa-unveils-new-strategy-strengthen-national-cyber-defense-and-critical-infrastructure-security ; https://www.cisa.gov/CISA2030
• [10]FBI/IC3 FortiBleed advisory: https://www.ic3.gov/CSA/2026/261006.pdf
• [11]DOJ, Stryzhak sentencing: https://www.justice.gov/opa/pr/ukrainian-national-sentenced-role-hacking-hospitals-businesses-and-governments-part
• [12]DOJ, DPRK IT workers: https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker ; https://www.justice.gov/usao-ndoh/pr/14-indicted-north-korean-remote-it-worker-conspiracy-affecting-more-70-us-companies
• [13]DOJ, Joint Disruption Week: https://www.justice.gov/opa/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint-disruption
• [14]DOJ CCIPS news: https://www.justice.gov/criminal/criminal-ccips
• [15]OFAC Recent Actions, 19 Oct: https://ofac.treasury.gov/recent-actions/20261019 ; Treasury sb0669 (not opened directly): https://home.treasury.gov/news/press-releases/sb0669/
• [16]US State Department, PAIPA sanctions: https://www.state.gov/releases/office-of-the-spokesman/2026/10/imposing-sanctions-to-protect-americans-from-intellectual-property-theft/
• [17]Europol, KillSec: https://www.europol.europa.eu/media-press/newsroom/news/teenager-suspected-of-leading-killsec-ransomware-group-law-enforcement-seizes-servers-and-leak-site
• [18]INTERPOL, Serengeti III: https://www.interpol.int/en/News-and-Events/News/2026/Cybercrime-crackdown-in-Africa-nets-1-462-arrests-recovers-over-USD-105-million
• [19]Swiss Confederation (BLW), PUBLICA supplier: https://www.blw.admin.ch/en/newnsb/FjG4XOIms04s
• [20]Florida Department of Education: https://www.fldoe.org/newsroom/latest-news/florida-department-of-education-is-aware-of-a-data-breach-incident-involving-unauthorized-criminal-access-to-department-information.stml
• [21]Belgian federal news (403 to fetch): https://news.belgium.be/fr/node/44757/pdf
• [22]European Commission, CRA reporting: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
• [23]Council of the EU, digital rulebook: https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/
• [24]UK Parliament, CS&R Bill: https://bills.parliament.uk/bills/4035
• [25]Canadian Centre for Cyber Security, AV26-1035: https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035 ; AL26-025: https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764
• [26]CSA Singapore AD-2026-007: https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-007/
• [27]NVD CVE records (examples cited inline): https://nvd.nist.gov/vuln/detail/CVE-2026-104935 , https://nvd.nist.gov/vuln/detail/CVE-2026-111357 , https://nvd.nist.gov/vuln/detail/CVE-2026-102764 , https://nvd.nist.gov/vuln/detail/CVE-2026-97229 , https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• [28]JVN: https://jvn.jp/en/jp/JVN88474777/

Vendors and victims (primary)

• [29]Binance Update #1: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7 ; Update #2: https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751 ; Update #3: https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62
• [30]Cisco SEG: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp ; Cisco ASA/FTD: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
• [31]Palo Alto Networks CVE-2026-0322: https://security.paloaltonetworks.com/CVE-2026-0322
• [32]Ivanti advisory (JavaScript-only): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• [33]BeyondTrust BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
• [34]FortiGuard FG-IR-26-175: https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; FG-IR-26-122: https://fortiguard.fortinet.com/psirt/FG-IR-26-122
• [35]Atlassian CVE-2026-21589: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
• [36]Arista SA-0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• [37]Siemens ProductCERT: https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/ ; SSA-580366: https://cert-portal.siemens.com/productcert/html/ssa-580366.html
• [38]Collabora GHSA: https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
• [39]Zammad advisory: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 ; community: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
• [40]Ahsay: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
• [41]Plex forum: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
• [42]EG Secure Solutions: https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
• [43]Adobe APSB26-73 (403 to fetch): https://helpx.adobe.com/security/products/magento/apsb26-73.html
• [44]GitLab 19.4.2: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; Ruby: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
• [45]PHP News Archive 2026: https://www.php.net/archive/2026.php
• [46]Brotli v1.2.1: https://github.com/google/brotli/releases/tag/v1.2.1 ; Node.js: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• [47]Microsoft MSRC CVE-2026-96951: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951
• [48]SAP Security Patch Day October 2026: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html
• [49]Oracle CPU October 2026: https://www.oracle.com/security-alerts/cpuoct2026.html
• [50]Apple HT 149226: https://support.apple.com/en-us/149226 ; HT 149225: https://support.apple.com/en-us/149225
• [51]Android Security Bulletin October 2026: https://source.android.com/docs/security/bulletin/2026/2026-10-01
• [52]Chrome Releases: https://chromereleases.googleblog.com/2026/10/
• [53]Mozilla MFSA2026-106: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/ ; MFSA2026-111: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/ ; MFSA2026-118: https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
• [54]Ubuntu, Fragnesia: https://ubuntu.com/blog/fragnesia-linux-vulnerability-fixes-available
• [55]SESAME: https://www.sesame.org.jo/announcement/sesame-responds-major-cybersecurity-incident
• [56]Ahold Delhaize newsroom: https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident
• [57]Fisher & Paykel Healthcare (NZX 482175): https://www.nzx.com/announcements/482175
• [58]SEC EDGAR, Quest 8-K: https://www.sec.gov/Archives/edgar/data/0001022079/000094787126000941/ss6979200_8k.htm ; Revolve 8-K: https://www.sec.gov/Archives/edgar/data/0001746618/000119312526439022/rvlv-20261029.htm
• [59]University of Copenhagen: https://www.ku.dk/orientering-om-bruddet-paa-persondatasikkerheden ; https://www.ku.dk/driftsforstyrrelser-paa-ku
• [60]GMO onamae.com: https://www.onamae.com/news/article/11584 ; https://www.onamae.com/news/article/11609
• [61]NTT Docomo: https://www.docomo.ne.jp/info/notice/page/261027_05_m.html
• [62]Pizza Hut Japan: https://corp.pizzahut.jp/info/5540
• [63]LiteLLM: https://docs.litellm.ai/blog/security-incident-oct-21-2026
• [64]TeamUpdraft: https://teamupdraft.com/blog/security-incident-october-2026/
• [65]Railway: https://blog.railway.com/p/security-disclosure-wednesday-october-21st
• [66]Zeabur: https://zeabur.com/blogs/october-2026-security-incident
• [67]Rank Math KB: https://www.rankmath.com/kb/pro-3-0-123-security-incident/
• [68]Chainalysis security incident: https://www.chainalysis.com/blog/security-incident-october-30/
• [69]Meta newsroom: https://about.fb.com/news/2026/10/meta-tech-companies-law-enforcement-crackdown-global-scam-networks/

Threat intelligence and analytics firms (assessments)

• [70]TRM Labs, Binance: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
• [71]Elliptic, Binance: https://www.elliptic.co/insights/binance-largest-hack-in-history/ ; blocklist: https://www.elliptic.co/insights/free-binance-exploit-blocklist-available-from-elliptic-for-the-crypto-community-to-screen-against-the-attributed-addresses-now/
• [72]Chainalysis, Binance: https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/ ; OFAC DPRK summary: https://www.chainalysis.com/blog/ofac-sanctions-dprk-it-worker-fraud/
• [73]Microsoft, Storm-0940/ARTEX: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ ; DPRK AI: https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
• [74]Wiz, ARTEX: https://wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors
• [75]Google GTIG, ARTEX: https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
• [76]CrowdStrike, VAPOR PANDA: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
• [77]Volexity, Ivanti chain: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
• [78]ESET APT Activity Report: https://welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026
• [79]Huntress, AhsayCBS: https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• [80]Sansec, PolyShell: https://sansec.io/research/polyshell-mass-attack-wave
• [81]Aikido, Tensorlake: https://www.aikido.dev/blog/tensorlake-npm-package-compromised
• [82]StepSecurity: https://www.stepsecurity.io/blog/subql-ecosystem-compromised ; https://www.stepsecurity.io/blog/ghostaction-returns ; https://www.stepsecurity.io/blog/ovhcloud-cli-github-release-swap-glassworm
• [83]Corgea, GhostAction: https://corgea.com/research/ghostaction-october-2026-fake-font-stage-oidc-aws-role-theft
• [84]Tenable, Patch Tuesday: https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951 ; Fragnesia: https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc
• [85]Sophos, NetScaler: https://www.sophos.com/en-us/blog/citrix-netscaler-vulnerability-cve-2026-88779-in-active-exploitation
• [86]HackerFeeds October 2026 ransomware report: https://hackerfeeds.com/ransomware/reports/2026-10
• [87]Patchstack, Rank Math: https://patchstack.com/database/vulnerability/seo-by-rank-math-pro/wordpress-rank-math-seo-pro-plugin-3-0-123-unauthenticated-embedded-malicious-code-vulnerability

Press (secondary)

• [88]Reuters, FBI/Accenture: https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/ ; Belgium: https://www.reuters.com/legal/litigation/belgium-tax-agency-hit-by-cyberattack-shuts-online-portal-2026-10-28/
• [89]Bloomberg, Binance/FBI: https://www.bloomberg.com/news/articles/2026-10-30/binance-s-6-billion-heist-rattles-crypto-and-draws-fbi-scrutiny
• [90]Decrypt, Binance freezes: https://decrypt.co/382268/secret-service-fbi-binance-hack-probe
• [91]CNBC, Binance 31 Oct: https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html
• [92]Forbes, Binance: https://www.forbes.com/sites/antoniopequenoiv/2026/10/30/binance-says-it-plans-to-resume-withdrawals-this-weekend-after-63-billion-hack/
• [93]CBS News, Binance: https://www.cbsnews.com/news/binance-hack-north-korea/
• [94]BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/ ; https://www.bleepingcomputer.com/news/security/police-dismantle-killsec-ransomware-gang-allegedly-led-by-16-year-old/ ; https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/ ; https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august ; https://bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks ; https://bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets ; https://bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack ; https://bleepingcomputer.com/news/security/metamask-discloses-security-incident-affecting-its-infrastructure
• [95]SecurityWeek: https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/ ; https://www.securityweek.com/oracle-patches-over-1200-vulnerabilities-with-october-2026-cpu/ ; https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/ ; https://www.securityweek.com/china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks/ ; https://www.securityweek.com/us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward/ ; https://www.securityweek.com/topics/ics-patch-tuesday/
• [96]The Hacker News: https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html ; https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html ; https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html
• [97]Help Net Security, ConnectWise: https://helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident
• [98]Dark Reading, ConnectWise: https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps
• [99]CSO Online, ConnectWise: https://www.csoonline.com/article/4237087/connectwise-backup-credentials-exposed-multiple-microsoft-365-tenants.html
• [100]Politico, DOT/Senture: https://www.politico.com/news/2026/10/14/department-of-transportation-motus-senture-cyberattack-01119368 ; ITNerd: https://itnerd.blog/2026/10/15/cyberattack-on-federal-contractor-disrupts-dot-services/
• [101]Euronews, Belgium: https://www.euronews.com/2026/10/28/belgiums-finance-and-tax-agency-hit-by-cyberattack ; supermarkets: https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems
• [102]Sud Radio/AFP, supermarkets: https://www.sudradio.fr/societe/des-supermarches-victimes-dune-cyberattaque-visant-leurs-installations-frigorifiques-confirment-cooperative-u-et-intermarche
• [103]Grocery Dive, Ahold: https://www.grocerydive.com/news/ahold-delhaize-adusa-cybersecurity-update/833414/
• [104]Cybersecurity Dive, PwC: https://www.cybersecuritydive.com/news/pwc-learning-records-breached-attack-vendor/856902/ ; HR Dive: https://www.hrdive.com/news/pwc-learning-records-breached-attack-vendor/873019/
• [105]WEAR-TV, Florida DOE: https://weartv.com/news/local/florida-education-department-reports-data-breach-after-unauthorized-access-to-systems ; CBS Miami: https://www.cbsnews.com/miami/news/florida-department-of-education-financial-aid-website-data-breach-october-2026/
• [106]@IT (ITmedia), IDCF: https://atmarkit.itmedia.co.jp/ait/articles/2610/09/news036.html ; Daiwa: https://atmarkit.itmedia.co.jp/ait/articles/2610/07/news030.html ; Skyticket: https://atmarkit.itmedia.co.jp/ait/articles/2610/13/news037.html
• [107]MLex, IDCF findings: https://www.mlex.com/mlex/articles/2543258
• [108]GameBusiness.jp, Capcom: https://gamebusiness.jp/article/2026/10/23/28420.html ; Automaton: https://automaton-media.com/en/news/capcom-reports-large-scale-data-breach-affecting-approximately-11-77-million-capcom-id-accounts-no-credit-card-information-compromised/
• [109]Impress Watch, Sony: https://watch.impress.co.jp/docs/news/2151604.html ; Internet Watch, Daiichi Kosho: https://internet.watch.impress.co.jp/docs/news/2147032.html
• [110]Aviation Wire, JAL: https://www.aviationwire.jp/?p=353202 ; Nissyoku, Yakiniku King: https://news.nissyoku.co.jp/flash/1324429
• [111]TV2 Kosmopol, KU: https://www.tv2kosmopol.dk/koebenhavn/kobenhavns-universitet-udsat-for-et-cyberangreb-d8abc ; DTU: https://www.tv2kosmopol.dk/lyngby-taarbaek/dtu-hacket-det-her-er-et-alvorligt-angreb-5eee8
• [112]TechCentral, Ampath: https://techcentral.co.za/ampath-breach-no-evidence-test-results-taken/287314/
• [113]Moneylife, SBI: https://www.moneylife.in/article/sbi-data-leak-3897-customer-records-found-in-preliminary-analysis-iff-says-customers-not-informed/81988.html ; YourStory: https://yourstory.com/2026/10/sbi-3897-customer-records-personal-data-dark-web-hacker-leak-claim
• [114]Dealsite, Bithumb: https://dealsite.co.kr/articles/171517
• [115]Retail Gazette, H&M: https://www.retailgazette.co.uk/blog/2026/10/hm-cyber-attack/ ; Beinsure: https://beinsure.com/news/hm-investigates-shinyhunters-cyberattack-claims/
• [116]Medical Daily, Parkview: https://www.medicaldaily.com/parkview-mychart-restored-billing-video-visits-down-480230
• [117]ISEC, Oneonta: https://www.isec.news/2026/10/25/oneonta-school-district-ransomware-attack/
• [118]TechCrunch, DHS leak: https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/
• [119]DataBreaches.net, Nueva EPS: https://databreaches.net/2026/10/05/nueva-eps-colombias-largest-regional-healthcare-promoting-entity-has-allegedly-been-hacked/
• [120]Time News, Ghana dispute: https://time.news/fbi-nca-and-partners-arrest-suspected-cybercriminals-in-west-africa-raids/
• [121]VinciWorks, UK Bill: https://vinciworks.com/blog/cyber-security-and-resilience-bill-government-defeated-twice-as-lords-demand-stronger-protections/
• [122]Federal News Network, CISA 2015: https://federalnewsnetwork.com/cybersecurity/2026/09/cr-extends-cyber-info-sharing-law-through-december/ ; Paubox, CIRCIA: https://www.paubox.com/blog/circia-final-rule-white-house-deadlines-set-scope-open
• [123]Digital Policy Alert: https://digitalpolicyalert.org/event/44885-council-of-the-european-union-agreed-position-on-digital-omnibus-regulation-eu-20250360-including-cybersecurity-regulation ; Lovguiden: https://www.lovguiden.dk/en/det-offentlige/raadet-for-den-europaeiske-union/2026-10-21-raadet-vil-beholde-gdprs-definition-af-personoplysninger-i-digital-omnibus ; nisd2.eu: https://nisd2.eu/fr/wiki/timelines-and-status/nis2-timeline
• [124]MAP Express, Morocco: https://www.mapexpress.ma/actualite/societe-et-regions/cybersecurite-composante-essentielle-souverainete-numerique-dg-dgssi/ ; Le Brief: https://www.lebrief.ma/morocco-cybersecurity-week-100169292/ ; Hespress: https://fr.hespress.com/493526-cybersecurite-la-dgssi-emet-une-alerte-critique-sur-deux-failles-majeures-affectant-php-au-maroc-et-a-linternational.html ; Demócrata: https://www.democrata.es/en/politics/morocco-rejects-that-its-security-services-suffered-an-intrusion-by-hackers/