It was a week in cybersecurity because of the Recent Cyber Attacks. October 2026 saw a major wave of cybersecurity incidents, dominated by zero-day disclosures, supply chain compromises, and cloud platform breaches.
Here’s what happened.
Notable Worldwide Platform Breaches
1. PHP’s “PHP2Shell”:
The highlight of this post is the PHP2shell flaw. PHP is software that runs websites, including many built with WordPress.
PHP’s “PHP2Shell” flaws were the biggest web-server emergency. Two critical vulnerabilities could let someone execute code remotely without logging in, potentially compromising sites before their application code even runs. Emergency fixes arrived October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Source
2. Plex:
Plex lets people organise and stream their own films, music and television collections from a computer or storage device.
Plex confirmed widespread exploitation on October 19 of four previously patched flaws, collectively called “Plex2Shell.” Chaining them lets attackers run code without authentication; compromised servers were being turned into cryptocurrency miners and traffic proxies. The fixes were released in September. Source
3. EG Secure Solutions SiteGuard:
SiteGuard Server Edition is security software installed on web servers to filter malicious traffic and protect websites.
EG Secure Solutions confirmed that attackers were exploiting a command-injection flaw in its statistics feature, enabled by default. The flaw, CVE-2026-106931, could allow commands to run with root or SYSTEM privileges—the server’s highest level of access—potentially enabling data theft, malware installation or website modification. The significance is that a product intended to protect websites could itself become a route to compromising their servers. The vendor released fixes and warned administrators to preserve diagnostic records before updating because patching could erase evidence of an attack.
4. LiteLLM:
On our list of recent cyber attacks is LiteLLM, a Popular AI gateway software developers use to connect applications to different AI providers through one interface.
They suffered a software supply-chain attack: attackers compromised its release process and published version 1.107.0 containing credential-stealing malware and tools for remote access. The affected packages and container images were removed, but anyone who ran them must treat accessible credentials as potentially stolen.
The investigation into initial access remains ongoing. Source
5. ConnectWise Cloud Backup:
ConnectWise’s Cloud Backup service, formerly SkyKick, connects to businesses’ Microsoft 365 accounts to back up their data.
Attackers compromised credentials belonging to that service and used its existing permissions to authenticate into customers’ Microsoft 365 environments, without needing each user’s password. ConnectWise disabled seven affected application identities on October 17 and interrupted services during containment.
It attempted access to more than 2,250 customer environments; Microsoft observed successful access and follow-on activity in multiple environments, including changes intended to maintain access. That figure does not mean 2,250 businesses had data stolen—Microsoft explicitly distinguished attempted access, successful authentication and confirmed data theft.
6. Zeabur:
Zeabur is a hosting platform for websites and applications. On October 14–15 2026, attackers used leaked internal credentials to access its infrastructure across nine regions, gain root access to 101 customer servers and read its platform database.
Zeabur confirmed exposure of roughly 3.2 million application-setting records and account information covering 321,810 accounts. Those settings included credentials that could unlock customers’ connected services. The company acknowledged that long-lived administrator credentials had been stored in plaintext and could be used from the public internet; how attackers initially obtained them remained unconfirmed.
Following this second security incident, Zeabur announced it would wind down, with all dedicated servers and shared hosting clusters scheduled to stop by December 31. Customers therefore faced both credential exposure and the need to move their applications elsewhere.
Source: Zeabur Blog
7. eMudhra:
eMudhra is a certificate authority: it issues digital certificates that help browsers verify a website’s identity.
Researchers found that the cryptographic keys behind eight of its intermediate certificates were dangerously weak and could be recovered, potentially allowing attackers to issue fraudulent certificates for websites they did not own. That could enable website impersonation and interception of traffic where software still trusted those certificates. Chrome and Firefox blocked the affected certificates on October 17.
Google also said its certificate-transparency requirements prevented fraudulent certificates from those issuers being trusted by default before the block.
The incident exposed a serious weakness in HTTPS trust infrastructure, but did not establish that everyone’s encrypted browsing had been compromised.
The incident has made them pull out of the business.
8. ETS:
California’s Department of Education disclosed that attackers stole student information from Educational Testing Service (ETS), the contractor handling statewide assessments.
Using a compromised login, attackers repeatedly accessed and copied files between May 22 and September 18; ETS discovered the intrusion September 25. Exposed records included names, birth dates, home addresses, student identifiers, test results and, for some students, disability information.
The official notice covers students enrolled during at least the previous three school years but gives no exact headcount, so “seven million” remains unconfirmed.
This directly affects families: sensitive information about children was copied from a service handling compulsory school testing, creating risks of targeted scams and long-term privacy loss. ETS is offering affected students two years of identity protection.
9. PingCAP:
PingCAP develops TiDB, database software used behind major online services to store and process information. Its documented users include Pinterest, Square, Plaid, Trip.com, Shopee, Rakuten, Flipkart, Capcom, LINE, Dailymotion and Bolt—covering payments, shopping, travel, gaming and social platforms
PingCAP suffered a confirmed breach in which attackers stole source code, customer-account records, business and billing information, SQL-editor text and encrypted API-key values.
PingCAP has not identified which customers were affected or reported evidence that information inside customers’ TiDB databases was compromised.
10. WordPress plugin attacks:
Two confirmed attacks affected major WordPress plugin providers. Rank Math, whose SEO plugin is used on over four million websites, distributed malware in some downloads of its paid PRO version between October 15 and 16. Activating the affected plugin could compromise the website; the free version was unaffected.
Separately, attackers breached TeamUpdraft, maker of the widely used UpdraftPlus backup plugin, and stole connection keys used to manage customer websites. They used those connections to create administrator accounts and install malicious plugins.
TeamUpdraft suspected attackers used AI to accelerate the attack, based on its speed and initially faulty backdoor plugins. They have since both released fixes to these breaches.
11. Railway
Railway, a cloud hosting platform used by over two million developers and tens of thousands of companies, including Fortune 500 businesses, suffered a confirmed breach in October.
Attackers accessed internal systems between October 20 and 22, exposing stored application secrets belonging to a subset of customers. These credentials can provide access to databases, payment services and AI accounts connected to hosted applications. Railway suspended build infrastructure during containment, disrupting deployments and access to parts of its platform. It advised customers who signed up before October 21 to rotate stored credentials; the number directly affected remained undisclosed.
Railway suspected AI-assisted attackers, saying its initial evidence pointed to unrestricted AI models and substantial computing resources. That was its preliminary assessment—not confirmed proof that AI caused the breach.
The wider concern?
The wider concern is that AI is changing the speed and scale of cyberattacks.
Attackers can use AI agents to search for weaknesses, test different routes into systems and pursue multiple targets with less manual effort. Microsoft’s documented campaign included cases where attackers reached privileged cloud access in under three hours. www.microsoft.com
For businesses and individuals, this threatens to shorten the time between a vulnerability becoming known and being exploited, while exposing people through services they trust.
These incidents do not establish that AI caused every breach or can hack any system at will. They demonstrate a serious shift: attackers are gaining tools that can accelerate their operations, putting greater pressure on defenders to detect and contain intrusions quickly.
So HOW do you prevent yourself from getting hacked?
Well it is impossible.
But as someone building or running technology,
- Keep an inventory of your servers, frameworks, plugins and dependencies so you can identify exposure quickly.
- Prioritise patches for actively exploited flaws; restrict administration panels; separate development from production; and give applications, integrations and AI agents only the permissions they need.
- Keep production credentials away from experimental tools, use short-lived credentials where possible, and review dependency changes before deployment.
- Monitor unusual logins, file changes and spending, and maintain separately protected backups you have tested restoring.
- If compromised software ran, investigate the system and revoke exposed credentials—updating alone may leave stolen access usable.
As an everyday user,
- Enable automatic security updates,
- Use unique passwords through a password manager, and choose passkeys or security-key authentication where available—especially for your email, which controls many account recoveries.
- Remove unnecessary apps, browser extensions and connected-account permissions. Verify security notices through the provider’s app or website, and never paste commands from a supposed verification page.
- When a provider confirms exposure, follow its specific instructions, revoke affected sessions or connections, and replace compromised credentials.
These measures reduce your risk, but cannot prevent a provider from losing information it already holds about you.
If you need help in website cybersecurity or advice, Pishon Design Studio is always ready to get the job done. Just send us a message here.
