{"id":11933,"date":"2026-10-25T10:56:51","date_gmt":"2026-10-25T10:56:51","guid":{"rendered":"https:\/\/pishondesigns.org\/Dbase\/?p=11933"},"modified":"2026-10-26T11:13:42","modified_gmt":"2026-10-26T11:13:42","slug":"the-increasing-rate-of-high-profile-recent-cyber-attacks","status":"publish","type":"post","link":"https:\/\/pishondesigns.org\/Dbase\/the-increasing-rate-of-high-profile-recent-cyber-attacks\/","title":{"rendered":"The increasing rate of high profile recent cyber attacks – Should we be worried?"},"content":{"rendered":"

It was a week in cybersecurity<\/a><\/span> because of the Recent Cyber Attacks. October 2026 saw a major wave of cybersecurity incidents, dominated by zero-day disclosures, supply chain compromises, and cloud platform breaches.<\/span><\/p>\n

Here\u2019s what happened.<\/p>\n

<\/p>\n

Notable Worldwide Platform Breaches<\/h2>\n

1. PHP\u2019s \u201cPHP2Shell\u201d:<\/strong><\/p>\n

\"\"<\/strong><\/span><\/p>\n

The highlight of this post is the PHP2shell flaw. PHP is software that runs websites, including many built with WordPress. <\/span><\/p>\n

PHP\u2019s \u201cPHP2Shell\u201d flaws were the biggest web-server emergency<\/a>. Two critical vulnerabilities could let someone execute code remotely without logging in, potentially compromising sites before their application code even runs. Emergency fixes arrived October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Source<\/a><\/p>\n

2. Plex<\/strong>:<\/h3>\n

\"Plex<\/p>\n

Plex<\/a> lets people organise and stream their own films<\/a>, music and television collections from a computer or storage device. <\/span><\/p>\n

Plex confirmed widespread exploitation on October 19 of four previously patched flaws, collectively called \u201cPlex2Shell.\u201d Chaining them lets attackers run code without authentication; compromised servers were being turned into cryptocurrency miners and traffic proxies. The fixes were released in September. Source<\/a><\/p>\n

3. EG Secure Solutions SiteGuard<\/strong>:<\/h3>\n

SiteGuard Server Edition is security software installed on web servers to filter malicious traffic and protect websites. <\/span><\/p>\n

EG Secure Solutions confirmed that attackers were exploiting a command-injection flaw in its statistics feature, enabled by default. The flaw, CVE-2026-106931, could allow commands to run with root or SYSTEM privileges\u2014the server\u2019s highest level of access\u2014potentially enabling data theft, malware installation or website modification. The significance is that a product intended to protect websites could itself become a route to compromising their servers. The vendor released fixes and warned administrators to preserve diagnostic records before updating because patching could erase evidence of an attack.<\/p>\n

4. LiteLLM: <\/strong><\/h3>\n
\"\"

On our list of recent cyber attacks is LiteLLM, a Popular AI gateway software developers use to connect applications to different AI providers through one interface.<\/span><\/p><\/div>\n

They suffered a software supply-chain attack: attackers compromised its release process and published version 1.107.0 containing credential-stealing malware and tools for remote access. The affected packages and container images were removed, but anyone who ran them must treat accessible credentials as potentially stolen.<\/p>\n

The investigation into initial access remains ongoing. Source<\/a><\/p>\n

5. ConnectWise Cloud Backup: <\/strong><\/h3>\n

\"\"<\/span><\/p>\n

ConnectWise\u2019s Cloud Backup service, formerly SkyKick, connects to businesses\u2019 Microsoft 365 accounts to back up their data. <\/span><\/p>\n

Attackers compromised credentials belonging to that service and used its existing permissions to authenticate into customers\u2019 Microsoft 365 environments, without needing each user\u2019s password. ConnectWise disabled seven affected application identities on October 17 and interrupted services during containment.<\/p>\n

It attempted access<\/a> to more than 2,250 customer environments; Microsoft observed successful access and follow-on activity in multiple environments, including changes intended to maintain access. That figure does not mean 2,250 businesses had data stolen\u2014Microsoft explicitly distinguished attempted access, successful authentication and confirmed data theft.<\/p>\n

6. Zeabur: <\/strong><\/h3>\n

Zeabur is a hosting platform for websites and applications. On October 14\u201315 2026, attackers used leaked internal credentials to access its infrastructure across nine regions, gain root access to 101 customer servers and read its platform database.<\/span><\/p>\n

Zeabur confirmed exposure of roughly 3.2 million application-setting records and account information covering 321,810 accounts. Those settings included credentials that could unlock customers\u2019 connected services. The company acknowledged that long-lived administrator credentials had been stored in plaintext and could be used from the public internet; how attackers initially obtained them remained unconfirmed.<\/p>\n

Following this second security incident, Zeabur announced it would wind down<\/a>, with all dedicated servers and shared hosting clusters scheduled to stop by December 31. Customers therefore faced both credential exposure and the need to move their applications elsewhere.<\/p>\n

Source: Zeabur Blog<\/a><\/p>\n

7. eMudhra:<\/strong><\/h3>\n

\"eMudhra<\/span><\/p>\n

eMudhra is a certificate authority<\/a>: it issues digital certificates that help browsers verify a website\u2019s identity. <\/span><\/p>\n

Researchers found<\/a> that the cryptographic keys behind eight of its intermediate certificates were dangerously weak and could be recovered, potentially allowing attackers to issue fraudulent certificates for websites they did not own. That could enable website impersonation and interception of traffic where software still trusted those certificates. Chrome and Firefox blocked the affected certificates on October 17.<\/p>\n

Google also said its certificate-transparency requirements prevented fraudulent certificates from those issuers being trusted by default before the block.<\/p>\n

The incident exposed a serious weakness in HTTPS trust infrastructure, but did not establish that everyone\u2019s encrypted browsing had been compromised.<\/p><\/blockquote>\n

The incident has made them pull out of the business<\/a>.<\/p>\n

8. ETS:<\/strong><\/h3>\n

\"\"<\/span><\/p>\n

California\u2019s Department of Education disclosed that attackers stole student information from Educational Testing Service (ETS)<\/a>, the contractor handling statewide assessments.<\/span><\/p>\n

Using a compromised login, attackers repeatedly accessed and copied files between May 22 and September 18; ETS discovered the intrusion September 25. Exposed records included names, birth dates, home addresses, student identifiers, test results and, for some students, disability information.<\/p>\n

The official notice covers students enrolled during at least the previous three school years but gives no exact headcount, so \u201cseven million\u201d remains unconfirmed.<\/p>\n

This directly affects families: sensitive information about children was copied from a service handling compulsory school testing, creating risks of targeted scams and long-term privacy loss. ETS is offering affected students two years of identity protection.<\/p>\n

9. PingCAP:<\/strong><\/h3>\n

\"\"<\/p>\n

PingCAP develops TiDB, database software used behind major online services to store and process information.<\/span> Its documented users include Pinterest, Square, Plaid, Trip.com, Shopee, Rakuten, Flipkart, Capcom, LINE, Dailymotion and Bolt\u2014covering payments, shopping, travel, gaming and social platforms<\/p>\n

PingCAP suffered a confirmed breach<\/a> in which attackers stole source code<\/a>, customer-account records, business and billing information, SQL-editor text and encrypted API-key values. <\/span><\/p>\n

PingCAP has not identified which customers were affected or reported evidence that information inside customers\u2019 TiDB databases was compromised.<\/p>\n

10. WordPress plugin attacks:<\/h3>\n

\"\"<\/span><\/p>\n

Two confirmed attacks affected major WordPress plugin providers. Rank Math<\/a>, whose SEO plugin is used on over four million websites, distributed malware in some downloads of its paid PRO version between October 15 and 16. Activating the affected plugin could compromise the website; the free version was unaffected.<\/span><\/p>\n

Separately, attackers breached TeamUpdraft<\/a>, maker of the widely used UpdraftPlus backup plugin, and stole connection keys used to manage customer websites. They used those connections to create administrator accounts and install malicious plugins.<\/p>\n

TeamUpdraft suspected attackers used AI to accelerate the attack, based on its speed and initially faulty backdoor plugins. They have since both released fixes to these breaches.<\/p>\n

More here.<\/a><\/p>\n

11. Railway<\/strong><\/h3>\n

Railway<\/a>, a cloud hosting platform used by over two million developers and tens of thousands of companies, including Fortune 500 businesses, suffered a confirmed breach in October.<\/span><\/p>\n

Attackers accessed internal systems<\/a> between October 20 and 22, exposing stored application secrets belonging to a subset of customers. These credentials can provide access to databases, payment services and AI accounts connected to hosted applications. Railway suspended build infrastructure during containment, disrupting deployments and access to parts of its platform. It advised customers who signed up before October 21 to rotate stored credentials; the number directly affected remained undisclosed.<\/p>\n

Railway suspected AI-assisted attackers, saying its initial evidence pointed to unrestricted AI models and substantial computing resources. That was its preliminary assessment\u2014not confirmed proof that AI caused the breach.<\/span><\/p>\n

The wider concern?<\/h2>\n

The wider concern is that AI is changing the speed and scale of cyberattacks.<\/p>\n

Attackers can use AI agents to search for weaknesses, test different routes into systems and pursue multiple targets with less manual effort. Microsoft\u2019s documented campaign included cases where attackers reached privileged cloud access in under three hours. www.microsoft.com<\/p><\/blockquote>\n

For businesses and individuals, this threatens to shorten the time between a vulnerability becoming known and being exploited, while exposing people through services they trust.<\/p>\n

These incidents do not establish that AI caused every breach or can hack any system at will. They demonstrate a serious shift: attackers are gaining tools that can accelerate their operations, putting greater pressure on defenders to detect and contain intrusions quickly.<\/p>\n

So HOW do you prevent yourself from getting hacked?<\/h2>\n

Well it is impossible.<\/p>\n

But as someone building or running technology,<\/span><\/p>\n