Black October 2026: 28 cyber incidents, checked and explained
By ScruteXPublished
Black October is what ScruteX Threat Intelligence calls the 28 cyber incidents it tracked through October 2026. Ten of them surfaced in just 48 hours, on 20 and 21 October. ScruteX traced every one back to the people who first reported it: vendors, victims, regulators and researchers.
All 28 are confirmed, but early coverage got important details wrong on 12 of them, and they did not all happen at once: the oldest dates back to May. This post explains each incident in plain language, shows which ones to fix first, and lists what Indian organisations in particular should do this week.
Key takeaways
- ScruteX verified all 28 incidents against primary sources. Early coverage of 12 of them carried errors, and every fact in this post is checked at the source.
- They did not all happen at once. Ten incidents surfaced on 20 and 21 October. The oldest goes back to 13 May.
- Five need action today if you run the product: PAN-OS GlobalProtect, WordPress Rank Math or UpdraftCentral, PHP, Railway and LiteLLM.
- Trusted channels did the most damage: release pipelines, update servers, a plugin store, a signed Siemens tool and a certificate authority.
- India is directly in scope: SBI customer data, eMudhra certificates, AOMEI backdoor victims and PHP-heavy government portals.
What is Black October?
Black October is ScruteX's name for 28 security incidents disclosed or updated in October 2026. They are very different things: a ransomware warning from the FBI, flaws in PHP and GitLab, poisoned software updates, cloud platforms that leaked customer passwords and AI keys, and a data dump involving State Bank of India.
News feeds give all of these the same headline weight, so a crash bug in an HTTP/3 library sits next to a ransomware entry point used against banks. ScruteX built Black October to separate the two.
Every incident gets a BO number. BO-01 is the most critical and BO-28 the least.
Did Black October happen all at once?
No. ScruteX recorded the earliest public report for each incident. Ten surfaced on 20 or 21 October and fourteen within 72 hours, which is why the month felt like one wave. The rest stretch back weeks and months: the PAN-OS flaw was disclosed on 13 May and the Medi-Cal vendor breach on 14 September.
What happened is simpler. Several large stories broke on the same two days, and weekly news roundups bundled them with older items. The reporting arrived together. The attacks did not.
One dot per incident on the day it was first made public. The dark squares are 20 and 21 October.
Ten incidents on 20 and 21 October, two from before October, the rest spread across the month.
Why does this matter? A team that believes 28 attacks hit in two days will panic and patch in random order. A team that knows the real timeline can ask a better question: which of these touch our systems, and which are being used by attackers right now?
What did early coverage get wrong?
Early news summaries and social posts got a detail or a framing wrong on 12 of the 28 incidents. None of the errors made an incident disappear, but several changed what you should do about it.
| Incident | What early coverage said | What is actually true |
|---|---|---|
| BO-02 WordPress | Compromise of a plugin developer's signing or distribution credentials, leading to backdoored plugins. | Two separate incidents. Distribution compromise is confirmed for Rank Math; 'signing' is unsupported because WordPress plugins are not code-signed. |
| BO-03 SafePay | An FBI warning involving more than 600 critical infrastructure organisations. | 600+ is right and a floor. The advisory counts victims across critical infrastructure sectors, not 600 critical infrastructure organisations. |
| BO-04 PHP2Shell | PHP remote code execution vulnerabilities, CVSS 9.2, and government website outages in the Netherlands, Finland and Belgium. | Flaws, score and outages are real. The outages were precautionary shutdowns, not the result of attacks. |
| BO-05 Railway | Compromise of hosting platform secrets and tokens through an npm-related attack. | The secrets breach is confirmed. No source supports an npm vector. |
| BO-08 Siemens | Active exploitation of a software vulnerability to spread malware in industrial environments. | Exploitation is real and KEV-listed. Siemens Software Center is an IT download tool, and no industrial victims are reported. |
| BO-10 State Bank of India | A confirmed data breach at India's largest bank. | SBI confirmed exposure of 3,897 customer records inside a 3.75 lakh record dump. Source system and actor claims are unconfirmed. |
| BO-12 Cairn | An AI-assisted hacking operation targeting more than 100 companies. | Cairn is a tool, not an actor. 100+ is Reuters' count of breaches; targets exceeded 1,100. |
| BO-14 GitLab | A CVSS 10.0 vulnerability affecting every version since 2014 that enables full account takeover. | CVSS 10.0 and 'since 2014' are right. The impact is server code execution, not account takeover. |
| BO-17 Plex | Compromise of home media servers and theft of private media libraries. | Exploitation is real and KEV-listed. No source reports theft of media libraries. |
| BO-26 HTTP/3 | A single-connection denial-of-service attack affecting seven out of ten web server types. | 7 of 10 counts tested libraries (one is Wireshark), not server types. Single connection holds for Bun and h3 only. |
| BO-27 Medi-Cal | Theft of health information relating to 970,000 patients. | 970,403 is right. The breach was at a vendor, data 'may have been accessed' (theft unconfirmed), and it was disclosed in September. |
| BO-28 Meta Muse | Exposure of personal or business secrets through an AI coding agent. | Meta Muse is a personal AI agent, not a coding agent, and the exposure came from users' own share links. |
How serious are the Black October incidents?
We scored every incident on three simple questions, each from 0 to 3. Is anyone exploiting it? How bad is the impact? How exposed are Indian organisations? The total out of 9 gives the severity: 8 or 9 is critical, 6 or 7 high, 4 or 5 medium, and 3 or below low.
Priority then says how fast to act if you run the affected product. P0 means today, P1 within 72 hours, P2 within a week and P3 as part of routine work. Nothing became P0 because of a CVSS score alone.
Eight critical, eleven high, six medium, three low. Five incidents are P0.
20 of 28 show confirmed use in real attacks. That row drives patch order, not CVSS.
Where did Black October hit, and which sectors?
The incidents name 22 countries as affected, targeted or responding. The United States appears most often, then Australia, the United Kingdom and India. Several of the most serious items have no single country because they are flaws in software used everywhere: PHP, GitLab, NGINX, PAN-OS and LiteLLM.
By sector, software and IT teams carry the most direct exposure, because so many incidents involve secrets platforms, packages and source control. Banking and finance comes next, driven by the VPN flaw, PHP, GitLab, eMudhra and SBI.
Which Black October incidents should you fix first?
If you run any of these five products, treat them as P0 and act today. Each has confirmed attacks, very wide reach, or secrets already in attackers' hands.
- PHP (BO-04). Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart every PHP worker. A patch without a restart does nothing. Take old sites you cannot patch offline.
- PAN-OS GlobalProtect (BO-01). Upgrade PAN-OS, give the authentication cookie its own certificate, end all active VPN sessions, and hunt GlobalProtect logs for sessions without a matching login.
- LiteLLM (BO-06). Search every host, container and image for litellm 1.107.0. Rebuild any machine that ran it and rotate every key it could read. Pin version 1.106.2.
- Railway (BO-05). Rotate each secret at the provider that issued it (AWS, Stripe, OpenAI and so on), then update Railway and redeploy. Changing the value only inside Railway leaves the old key working.
- WordPress (BO-02). Find sites on Rank Math PRO 3.0.123 or connected to UpdraftCentral. Clean them with the vendor's indicators and rotate WordPress salts and stored secrets.
What do the 28 incidents have in common?
Read the list end to end and five lessons stand out. None of them needs a new product to act on.
Trusted channels carried the attack. Rank Math's update server, LiteLLM's release pipeline, AOMEI's update files, OVHcloud's GitHub releases, a signed Siemens tool and eMudhra's certificates. Users did the right thing, installing official updates, and still got hit. Pin hashes, delay brand-new releases, and lock published releases.
Secrets left the building. Railway, Zeabur, TiDB Cloud and OpenCode Console all exposed customer keys, and LiteLLM and the OVHcloud CLI stole them from developer machines. OpenCode users report fraudulent charges on stolen AI keys. Rotate at the issuing provider, not just where the key was stored.
Edge devices are the front door. GlobalProtect, Cisco ASA and SonicWall are how SafePay, Qilin and INC get in. Phishing-resistant MFA and fast patching on the perimeter matter more than anything inside.
Attackers now use AI agents. Cairn agents broke into over 100 companies at about USD 50 a success, and OpenCode says attackers used AI agents against its systems for at least 48 hours. Cheap, automated attacks make small targets worth the effort.
Headlines run ahead of facts. The GitLab, Plex and Meta Muse stories were overstated. Check the vendor advisory before you reprioritise a patch cycle.
All 28 Black October incidents, in plain language
Each entry gives the verified fact, a plain explanation, who should care and what to do. The list runs from most to least critical.
BO-01 Palo Alto Networks: Qilin and INC use PAN-OS GlobalProtect CVE-2026-0257 to open MFA-free VPN sessions as a ransomware entry point.
Severity: Critical (9/9) · Priority: P0 · First public: 13 May 2026 · Type: Vulnerability
Palo Alto Networks firewalls include a VPN called GlobalProtect. A flaw lets attackers fake the login cookie and open a VPN session with no password and no MFA code. The Qilin and INC ransomware groups use it to get inside, then move on to vCenter, ESXi and Veeam backup servers.
- Who should care: GlobalProtect is the remote-access front door for many Indian enterprises; a forged session bypasses MFA.
- What to do: Upgrade PAN-OS; use a dedicated cookie certificate or disable cookies; end active sessions; hunt GP logs.
BO-02 WordPress: Tampered Rank Math PRO 3.0.123 releases and stolen UpdraftCentral keys pushed backdoors to WordPress sites.
Severity: Critical (9/9) · Priority: P0 · First public: 16 October 2026 · Type: Supply chain
Two separate problems hit popular WordPress plugins. For about 11 hours on 15 and 16 October, Rank Math's own update system shipped some PRO 3.0.123 packages with a hidden backdoor that adds admin users and web shells. Separately, attackers broke into teamupdraft.com, stole UpdraftCentral connection keys and used them to push backdoored plugins to connected sites.
- Who should care: Rank Math and UpdraftPlus are near-standard on Indian agency, SMB and corporate WordPress sites.
- What to do: Find PRO 3.0.123 and UpdraftCentral-connected sites; clean with vendor IOCs; rotate WordPress salts and secrets.
BO-03 SafePay: FBI, CISA and partners report SafePay has hit 600+ victims across critical infrastructure sectors since August 2024.
Severity: Critical (9/9) · Priority: P1 · First public: 20 October 2026 · Type: Ransomware
SafePay is a ransomware gang. On 20 October the FBI, CISA, the US Secret Service, Germany's LKA and the UK NCA published a joint warning: at least 600 victims since August 2024. SafePay gets in by guessing passwords, phishing staff, and using old flaws in Cisco ASA, Veeam and SonicWall. It steals data, encrypts files and wipes backups, including NAS devices.
- Who should care: Cisco ASA, SonicWall and Veeam are common in Indian BFSI and manufacturing; backup destruction removes the recovery path.
- What to do: Patch the five KEVs; phishing-resistant MFA on VPN; immutable offline backups; hunt with the advisory TTPs.
BO-04 PHP2Shell: Two unauthenticated RCE flaws in PHP core (CVSS 4.0 9.2) prompted precautionary shutdowns of Dutch, Finnish and Belgian government sites.
Severity: Critical (8/9) · Priority: P0 · First public: 20 October 2026 · Type: Vulnerability
PHP runs a large share of the world's websites. Two flaws in PHP itself let an attacker run code on a server without logging in. Details leaked on 20 October, a day before the fix. Dutch, Finnish and Belgian government sites went offline as a precaution, not because attackers got in.
- Who should care: Unauthenticated code execution on any internet-facing PHP application; government, PSU and BFSI portals are heavily PHP-based.
- What to do: Upgrade PHP and restart every worker; WAF multipart rules; take unpatchable EOL sites offline.
BO-05 Railway: Railway confirmed that attackers accessed, and partly decrypted, customer environment variables on 21 October.
Severity: Critical (8/9) · Priority: P0 · First public: 21 October 2026 · Type: Data breach
Railway is a hosting platform where developers keep app settings and secrets (passwords and API keys) as environment variables. Attackers reached the system that stores them and decrypted some values. Railway paused deploys and cancelled every login session and API token on 22 October. If you kept a key there, assume someone else has it.
- Who should care: Any key stored in Railway (cloud, database, payment, AI provider) must be treated as exposed. Railway is popular with Indian startups.
- What to do: Rotate every secret at the issuing provider first, then redeploy; recreate Railway tokens; review cloud audit logs.
BO-06 LiteLLM: litellm 1.107.0 on PyPI and Docker carried a credential stealer; the package averages about 3.3 million downloads a day.
Severity: Critical (8/9) · Priority: P0 · First public: 21 October 2026 · Type: Supply chain
LiteLLM is a popular Python tool that sits between apps and AI models. Attackers used stolen GitHub tokens from three of its engineers to publish a poisoned version, 1.107.0, to PyPI and Docker on 21 October. Every time Python starts on an infected machine, it collects cloud, database and AI keys and sends them out.
- Who should care: LiteLLM fronts most enterprise GenAI gateways; one install exposes every model, cloud and database key on the host.
- What to do: Find 1.107.0 and the bad image digests; rebuild hosts; rotate every credential present; pin 1.106.2.
BO-07 AOMEI: UNC7017 tampered with AOMEI's update servers to deliver the SHINYROAD backdoor, including to victims in India.
Severity: Critical (8/9) · Priority: P1 · First public: 15 October 2026 · Type: Supply chain
AOMEI makes backup software. A group tracked as UNC7017 changed files on AOMEI's update servers for a few minutes at a time between April and July 2026, then put them back. Computers that checked for updates in those minutes received a backdoor called SHINYROAD. Victims include organisations in India.
- Who should care: AOMEI is common in Indian SMB and IT services estates; the backdoor runs on machines that hold backups.
- What to do: Hunt April to July 2026; block IOCs; block outbound SMB and WebDAV; run GTIG YARA and AOMEI detection tool.
BO-08 Siemens: ClickFix operators exploit Siemens Software Center CVE-2026-110936, now known exploited, through DLL side-loading.
Severity: Critical (8/9) · Priority: P1 · First public: 15 October 2026 · Type: Vulnerability
Siemens Software Center is a download tool for Siemens engineering software. Criminals bundled a genuine signed copy with a malicious DLL file. The program loads DLLs from its own folder, so the malware runs under a trusted name. Victims get it through ClickFix lures: fake prompts that trick users into running a command. Siemens' own systems were not breached.
- Who should care: Engineering workstations in Indian manufacturing often carry Siemens tools; ClickFix lures reach any user.
- What to do: Update to V4.0.9.8; block IOCs; alert on SiemensSoftwareCenter.exe running from AppData.
BO-09 Zeabur: Zeabur's second breach in two months exposed 321,810 accounts and 3.2 million environment variables; the platform closes on 31 December.
Severity: High (7/9) · Priority: P1 · First public: 19 October 2026 · Type: Data breach
Zeabur is a cloud hosting platform. For the second time in two months an attacker got in, this time with an admin token and AWS keys that nobody changed after the first breach. They read 3.2 million stored secrets and logged in as root on 101 customer servers. No alert fired; users noticed. Zeabur will shut down on 31 December.
- Who should care: Any Indian team that deployed on Zeabur should assume every stored secret is known to the attacker.
- What to do: Rotate all secrets used on Zeabur; check authorized_keys on linked servers; migrate before 1 Dec.
BO-10 State Bank of India: SBI confirmed 3,897 customer records in a 3.75 lakh record dark-web dump.
Severity: High (7/9) · Priority: P1 · First public: 16 October 2026 · Type: Data breach
Data from India's largest bank appeared on a dark-web forum. In a stock-exchange filing on 21 October, SBI said the dump holds about 3.75 lakh records and that 3,897 of them are customer records with personal details. Expect scam calls and fake loan offers that use these details to sound real.
Threat actor claim seen by ScruteX dark-web monitoring
| Field | Detail |
|---|---|
| Threat actor | Siriusim |
| Target | State Bank of India |
| Country | India |
| Posted | 16 Oct 2026 |
| Industry | Finance |
| Network | Open web forum (link withheld) |
| Actor's claim | Customer data with personal information, loan applications and account-opening applications |
| Sample fields shown | Names, dates of birth, mobile numbers, addresses, occupation and income details, branch information |
These are the actor's own claims. SBI has confirmed only the 3,897 customer records in its filing. ScruteX does not link to or redistribute leaked data.
- Who should care: Expect SBI-themed vishing and loan-offer fraud. Indian BFSI should review lead-management vendors that hold CIF and lead data.
- What to do: BFSI: fraud-monitoring rules for SBI-themed lures; third-party lead vendor review; customer awareness.
BO-11 OVHcloud: Hijacked GitHub access swapped OVHcloud CLI release binaries for a secret stealer for 94 minutes.
Severity: High (7/9) · Priority: P1 · First public: 19 October 2026 · Type: Supply chain
Someone hijacked a GitHub account with access to OVHcloud's command-line tool and swapped already-published download files for a version that steals secrets from disk. The bad files were live for 94 minutes on 19 October. A user caught it because the file's checksum did not match.
- Who should care: Indian DevOps teams on OVHcloud; any host that ran an affected binary leaked its stored secrets.
- What to do: Check for +dirty binaries; upgrade to v0.16.0; rebuild hosts and rotate secrets.
BO-12 Cairn: Operators running the open-source Cairn AI agent platform breached more than 100 companies out of 1,100+ targets.
Severity: High (7/9) · Priority: P2 · First public: 19 October 2026 · Type: AI-driven attacks
Cairn is an open-source platform for running AI agents. Criminal groups used it to point agents at more than 1,100 online shops and companies, and broke into over 100. The agents look for a known web flaw, then plant a web shell. Each success cost the attackers about USD 50.
- Who should care: Cheap automated exploitation (about USD 50 per successful hack) lowers the bar for attacks on Indian e-commerce and D2C sites.
- What to do: Patch e-commerce stacks; hunt for uploader web shells; monitor checkout pages for skimmers.
BO-13 eMudhra CA: Eight eMudhra intermediate CA keys were generated with trivially small values, one literally 4; Mozilla distrusted the root and eMudhra is leaving TLS.
Severity: High (6/9) · Priority: P1 · First public: 20 October 2026 · Type: Supply chain
eMudhra is an Indian certificate authority: it issues the certificates behind the padlock in your browser. Eight of its intermediate keys were created from tiny numbers, one of them literally 4, so anyone could work out the private key from the public certificate. Browsers are withdrawing trust, and eMudhra is leaving the TLS certificate business. About 30,000 certificates need replacing.
- Who should care: Indian organisations holding emSign certificates face forced migration (about 30,000 certificates) and possible outages; anyone with a derived key could have impersonated sites or signed code.
- What to do: Inventory emSign-chained certificates; replace them; update trust stores and pin revocation checking.
BO-14 GitLab: A CVSS 10.0 flaw gives unauthenticated remote code execution across 12 years of GitLab releases, from 7.0 (2014) onward; a separate CVE enables account takeover through LDAP auto-linking.
Severity: High (6/9) · Priority: P1 · First public: 21 October 2026 · Type: Vulnerability
A flaw rated 10.0, the maximum score, lets an attacker run code on a self-managed GitLab server without logging in. Every version since 7.0 (2014) is affected. Early reports called it account takeover: that is a different, less severe bug fixed in the same release. No exploitation was reported as of 22 October.
- Who should care: Self-managed GitLab holds source, CI secrets and deploy keys across Indian BFSI and IT services.
- What to do: Patch self-managed GitLab now; restrict internet exposure; enable GitLab's crash-pattern Sigma rules.
BO-15 TiDB Cloud: Attackers used stolen service-account credentials to export TiDB Cloud account data from PingCAP.
Severity: High (6/9) · Priority: P1 · First public: 19 October 2026 · Type: Data breach
PingCAP runs TiDB Cloud, a managed database service. Attackers used a stolen service-account password to stay inside its internal systems from 9 September to 7 October. They took account data including emails, saved SQL queries and encrypted API keys. PingCAP says data inside customer databases was not affected. An extortion group listed PingCAP on 19 October.
- Who should care: Indian fintech and SaaS teams on TiDB Cloud should expect key rotation work and targeted phishing.
- What to do: Rotate TiDB Cloud API keys; review roles and audit logs 9 Sep to 14 Oct; scrub secrets from SQL editor history.
BO-16 OpenCode: An intruder exposed OpenAI, Anthropic and Google API keys linked to 1.4% of OpenCode Console accounts, and affected users report fraudulent charges.
Severity: High (6/9) · Priority: P1 · First public: 17 October 2026 · Type: Data breach
OpenCode is an AI coding agent. Its optional hosted service, OpenCode Console, lets a team save one OpenAI, Anthropic or Google key so members can use the models without seeing the key. On the night of 16 October an intruder reached a legacy Console system. OpenCode says 1.4% of Console users were affected, all with provider keys linked, and some report charges of a few hundred to about USD 1,700 on their stolen keys. Keys kept locally by the OpenCode CLI and desktop apps were not affected.
- Who should care: Any AI provider key linked to OpenCode Console must be treated as stolen, and the bill lands on the key owner. Indian developer teams use OpenCode alongside other AI coding tools.
- What to do: Revoke and reissue linked provider keys; review AI provider usage since 16 Oct; set spend limits and one key per tool.
BO-17 Plex: Attackers exploit the Plex2Shell chain on Plex Media Server to plant miners and proxy backdoors; CISA lists it as known exploited.
Severity: High (6/9) · Priority: P2 · First public: 17 October 2026 · Type: Vulnerability
Plex is home media-server software. Attackers chain four flaws to take over the server and install a crypto miner or a proxy backdoor. Some reports said private media libraries were stolen; no source reports that. For companies, the risk is staff running Plex on home networks that connect to the corporate VPN.
- Who should care: Low on corporate networks; relevant where staff run Plex on home-office or lab networks bridged to corporate VPN.
- What to do: Find Plex servers on owned networks; update; check Codecs for unknown .so files.
BO-18 Bullhorn: A cyber incident took Bullhorn's staffing platform, used by 10,000+ customers, offline for two days.
Severity: High (6/9) · Priority: P2 · First public: 17 October 2026 · Type: Disruption
Bullhorn is software that staffing and recruitment firms use to manage candidates and clients. A cyber incident took it offline from 17 October for about two days. Users without single sign-on had to reset passwords, and API passwords had to be changed. Bullhorn has not published the cause.
- Who should care: Indian staffing, RPO and offshore delivery teams using Bullhorn hold candidate personal data and API credentials.
- What to do: Rotate Bullhorn API credentials; review integration logs; warn staff about Bullhorn-themed phishing.
BO-19 Tor: Attackers turned 333 Tor exit relays into SSH interceptors to steal server passwords.
Severity: High (6/9) · Priority: P2 · First public: 5 October 2026 · Type: Threat campaign
Tor routes traffic through volunteer servers called relays. Attackers hacked machines that run 333 of these relays and made them intercept SSH, the protocol admins use to log in to servers. If an admin clicked past the 'host key changed' warning and typed a password, the attacker captured it and tried to install a backdoor called Ebury.
- Who should care: Admins who reach servers over Tor with SSH passwords. Key-only SSH defeats the technique.
- What to do: Enforce key-only SSH; check servers for Ebury artefacts; rotate passwords used over Tor 1 to 5 Oct.
BO-20 Signal: Signal CVE-2026-113380 lets a malicious caller keep the microphone, and possibly the camera, live after hang-up.
Severity: Medium (5/9) · Priority: P2 · First public: 20 October 2026 · Type: Vulnerability
A bug in Signal's calling code lets a malicious caller keep your microphone, and possibly your camera, running after you hang up. Signal fixed it in early September; the CVE was published on 20 October. An up-to-date Signal app is safe.
- Who should care: Covert listening risk for executives and officials who take Signal calls from unknown contacts.
- What to do: Push Signal updates on managed devices; avoid calls from unknown contacts until updated.
BO-21 NGINX: F5 fixed three CVSS 4.0 9.2 NGINX memory-corruption flaws that need specific configurations.
Severity: Medium (5/9) · Priority: P2 · First public: 14 October 2026 · Type: Vulnerability
NGINX is the web server in front of a large share of websites. F5 fixed three serious memory bugs on 14 October. Each one only matters if your configuration uses specific features together, so check your config files first. Exploitation crashes a worker; running code needs extra tricks.
- Who should care: NGINX fronts most Indian bank, government and SaaS estates; only matching configurations are exposed.
- What to do: Grep configs for the three patterns; upgrade; use interim config changes where upgrades lag.
BO-22 California schools: A breach of contractor ETS's SFTP site exposed California student records from 2023 onward, including disability and homelessness status.
Severity: Medium (5/9) · Priority: P3 · First public: 2 October 2026 · Type: Data breach
ETS, a testing company that works for the California Department of Education, had its file-transfer server accessed with a stolen login from 22 May to 18 September 2026. The files held sensitive student details, including disability and homelessness status.
- Who should care: No direct Indian exposure. A clean example of third-party file-transfer risk for education and testing vendors.
- What to do: Review contractor SFTP accounts for MFA, IP allow-listing and bulk-download alerting.
BO-23 Ahold Delhaize: An October attack took Food Lion, Stop & Shop, Giant Food and other Ahold Delhaize websites and apps offline; stores stayed open.
Severity: Medium (5/9) · Priority: P3 · First public: 12 October 2026 · Type: Disruption
Ahold Delhaize owns grocery chains including Food Lion, Stop & Shop, Giant Food and Albert Heijn. An attack on 11 October took their websites and apps offline. Stores stayed open. The company has found no sign that sensitive data was stolen.
- Who should care: No Indian exposure. Useful case study for Indian retail and quick-commerce on separating online channels from store operations.
- What to do: Test that stores, pharmacy and payments run when e-commerce is isolated.
BO-24 Onamae Japan: Malware on GMO's Desktop Cloud forced the shutdown of 26,739 FX trading servers in Japan.
Severity: Medium (5/9) · Priority: P3 · First public: 20 October 2026 · Type: Disruption
GMO's Desktop Cloud rents Windows servers in Japan for automated currency trading. Malware landed on some customer servers, and GMO shut down all 26,739 of them on 21 October. Trading logins stored on those servers may be stolen, and some customers report trades they did not make.
- Who should care: Limited to Indian traders using Japanese VPS services or the named brokers.
- What to do: Users: change broker passwords from a clean device and enable broker 2FA.
BO-25 North Korea: Lazarus Operation FlashHole breached South Korean software, construction and telecom-equipment firms.
Severity: Medium (5/9) · Priority: P3 · First public: 21 October 2026 · Type: Threat campaign
North Korea's Lazarus group sent fake job applications, with links to fake résumé sites on GitHub Pages, to staff at South Korean software, construction and telecom-equipment firms. The attack then abused a Korean banking-security browser plugin to run its code. The activity ran from July 2025 to January 2026.
- Who should care: Indirect for India: firms with Korean subsidiaries and HR teams receiving résumé-themed lures.
- What to do: Brief HR and recruitment on résumé lures; block FlashHole IOCs; Korean subsidiaries hunt INISAFE abuse.
BO-26 HTTP/3: QPACK 'Header Accordions' attacks crash 7 of 10 tested HTTP/3 implementations.
Severity: Low (3/9) · Priority: P3 · First public: 20 October 2026 · Type: Vulnerability
HTTP/3 is the newest version of the web protocol. Researchers showed that a trick with compressed headers can crash 7 of 10 tested HTTP/3 software libraries. This is a crash risk, not a break-in risk, and most libraries shipped fixes months ago.
- Who should care: Availability risk for custom Go or Rust services and Caddy (quic-go) exposing HTTP/3.
- What to do: Upgrade HTTP/3 libraries; disable HTTP/3 on Bun and mitmproxy.
BO-27 Medi-Cal: A breach at a Medi-Cal billing vendor may have exposed data on 970,403 members.
Severity: Low (3/9) · Priority: P3 · First public: 14 September 2026 · Type: Data breach
Paradigm Healthcare Services handles billing for school Medi-Cal programmes in California. Attackers got into its network in October 2025. Files with names, birth dates and member IDs for 970,403 people may have been accessed. Notification letters went out on 14 September 2026.
- Who should care: Third-party lesson for Indian healthcare RCM and billing BPOs processing US Medicaid data as HIPAA business associates.
- What to do: Confirm breach-detection and notification timelines in BPO contracts.
BO-28 Meta Muse: Shared Meta Muse AI conversations, some with business and financial details, were discoverable through passive DNS.
Severity: Low (3/9) · Priority: P3 · First public: 18 October 2026 · Type: Data breach
Meta Muse is a personal AI assistant. When a user shared a conversation, the web address included the conversation title. Researchers found more than 6,800 of these addresses in public DNS records, so strangers could find them without being sent the link. Some held business and banking details. Meta paused sharing on 20 October.
- Who should care: Low direct exposure in India; the lesson applies to staff pasting BFSI data into any AI share feature.
- What to do: Treat AI share links as outbound data transfer in DLP and acceptable-use policy.
What does Black October mean for Indian organisations?
Four incidents touch India directly: SBI customer data, eMudhra certificates, AOMEI backdoor victims, and the large number of government and bank portals that run on PHP. Others reach India through tools Indian teams use every day, such as Rank Math, UpdraftPlus, GitLab, NGINX and Railway.
Reporting rules that may apply
| Rule | Applies to | What it asks |
|---|---|---|
| CERT-In Directions, section 70B(6) IT Act (28 Apr 2022) | Service providers, intermediaries, data centres, body corporates, government | Report specified incidents within 6 hours of noticing them. Keep ICT logs for 180 days in India. |
| RBI Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions (31 Jul 2026) | Commercial banks | Report cyber incidents to RBI within 6 hours of detection. Audit rights in vendor contracts. |
| SEBI CSCRF circular (20 Aug 2024) | SEBI-regulated entities, including AMCs and brokers | Report incidents to SEBI and CERT-In within 6 hours. |
| DPDP Rules 2025 (Notified 13 Nov 2025) | Data fiduciaries | Breach notice duties start on 13 May 2027: notify the Data Protection Board and affected people, with a detailed report within 72 hours. |
These duties depend on your entity type and on whether an incident affects your own systems. A public report about a third party does not by itself trigger reporting. Confirm the current text with your compliance team.
Guidance by sector
BFSI and payment infrastructure
- Treat GlobalProtect, Cisco ASA, SonicWall and Veeam findings as P0/P1: these are the SafePay, Qilin and INC entry points.
- Run SBI-themed fraud scenarios through contact-centre and transaction monitoring; review lead-management vendors holding CIF data.
- Replace any emSign G3-chained certificates on payment and net-banking endpoints first.
Government and public services
- PHP2Shell is the priority: NIC-hosted and state portals run large PHP estates, often on EOL branches. Follow the Dutch and Finnish precedent and take unpatchable sites offline.
- Update trust stores across citizen-facing services; confirm no portal serves an emSign G3 chain.
Healthcare and education
- The ETS and Paradigm incidents both came through vendors: review SFTP and billing-vendor access, MFA and bulk-download alerting.
- Indian RCM and billing BPOs handling US data must meet HIPAA business-associate timelines as well as CERT-In reporting.
SaaS, cloud hosting and software development
- Assume compromise for secrets held in Railway, Zeabur, TiDB Cloud, OpenCode Console and on hosts that ran LiteLLM 1.107.0 or OVHcloud CLI +dirty builds; rotate at the issuer.
- Patch self-managed GitLab; enforce hash-pinned dependencies and a quarantine delay on new package releases.
- Enable release immutability and signed tags for your own published tools; the OVHcloud swap worked because it was off.
Manufacturing and critical infrastructure
- Update Siemens Software Center on engineering workstations; it is an IT tool, so patch through IT change, not OT outage windows.
- Hunt AOMEI artefacts on backup and engineering hosts; block outbound SMB and WebDAV from plant networks.
- Do not take emergency action on OT assets based on this advisory alone; no OT exploitation is reported in these 28 incidents.
Your Black October checklist for this week
Five decisions a CISO can approve today:
- ☐ Approve emergency patching this week: PHP, PAN-OS, GitLab, WordPress.
- ☐ Rotate every key held in Railway, Zeabur, TiDB Cloud, OpenCode Console or on LiteLLM hosts.
- ☐ Inventory emSign certificates and migrate within 30 days.
- ☐ Have the SOC run the hunts in the full advisory (section E) and report within 72 hours.
- ☐ BFSI: issue an SBI-themed fraud advisory and review lead vendors.
Am I exposed to Black October?
You can check these five things yourself, today, without any tool:
- ☐ Do you run PHP, PAN-OS GlobalProtect or self-managed GitLab on any internet-facing host, and do you know the exact version of each?
- ☐ Did any of your apps keep secrets in Railway, Zeabur, TiDB Cloud or OpenCode Console, and has each key been rotated at the provider that issued it?
- ☐ Did any laptop, server or container install litellm 1.107.0 or run an ovhcloud-cli build marked +dirty?
- ☐ Does any website you own use Rank Math PRO or connect to UpdraftCentral?
- ☐ Do you hold any certificate that chains to eMudhra's emSign roots, and would you know this week if a lookalike of your domain went live?
If you answered "not sure" to any of these, that is where to start.
What ScruteX finds here
ScruteX looks at your organisation from the outside, the way an attacker does. Setup is agentless: a domain and a set of keywords. For the Black October incidents, these are the checks that matter:
Attack surface monitoring. Finds every internet-facing host from your domain and flags PHP, GlobalProtect, GitLab and NGINX versions in the affected ranges, with CISA KEV status attached. It also flags certificates that chain to distrusted issuers such as emSign G3. See attack surface monitoring
Data exposure. Matches your domains against dark-web forums, paste sites, stealer logs and breach dumps, and checks whether an exposed key still works. ScruteX dark-web monitoring recorded four separate forum posts offering SBI data between 12 and 17 October 2026, before the bank's filing on 21 October. See data exposure
Brand protection. Watches new domain registrations for lookalikes of your brand and checks whether they carry mail records or a live phishing page, the next step after any big breach headline. See brand protection
Third-party risk. Watches your vendors from the outside, including leak-site postings, so a supplier breach like Railway, Bullhorn or PingCAP reaches you before the news does. See third-party risk
Threat intelligence. Attaches exploitation context to every CVE on your surface: KEV status, known ransomware use, EPSS and linked actors. For CVE-2026-0257 that reads KEV-listed, used by ransomware, EPSS 0.97. See threat intelligence
AI security and automated red teaming. Finds exposed AI infrastructure such as LiteLLM proxies, Ollama, Jupyter and MCP servers, and flags leaked AI provider keys. Automated red teaming tests authorised assets the way an AI agent attacker would. See AI security and automated red teaming
What a finding looks like
Each finding names the asset, the evidence and the fix. These examples use the same structure as real ScruteX findings, with identifiers redacted.
Do any of the 28 Black October incidents reach your domain? Domain only. No signup, no agent. Findings start returning immediately.
What ScruteX will not see. ScruteX sees only what is externally observable. If a system never faces the internet, or data trades only in private, invite-only channels, ScruteX will not see it, and neither will anyone else claiming otherwise. Takedowns are coordinated, not guaranteed.
Words used in this post
- CVE: A public ID for a specific software flaw, such as CVE-2026-0257.
- CVSS: A 0 to 10 score for how bad a flaw could be in theory. It does not tell you whether anyone is using it.
- CISA KEV: The US government's list of flaws known to be exploited in real attacks. A KEV listing means patch now.
- RCE: Remote code execution: an attacker can run their own commands on your server over the network.
- Supply-chain attack: An attack that reaches you through something you trust, such as a software update or a vendor.
- Secret: A password, API key or token that lets software log in to another service.
- Web shell: A small script an attacker leaves on a web server so they can come back and run commands.
- Certificate authority: A company browsers trust to vouch for websites. If its keys are weak, anyone can impersonate a site.
- IOC: Indicator of compromise: a file hash, IP address or domain linked to an attack, used to search your logs.
- Ransomware: Malware that steals and locks your data, then demands payment.
- P0 to P3: How fast to act if you run the affected product: today, 72 hours, 7 days, or routine.
How we checked
For each of the 28 incidents we found the primary source: the vendor advisory, the victim's own statement or regulatory filing, the government advisory, or the original research. We compared early coverage with that source, corrected what was wrong, and recorded the earliest public disclosure date. We matched every indicator of compromise in our data files back to its published source before including it. We did not access, download or redistribute any leaked data.
Frequently asked questions
What was Black October 2026?
Black October is ScruteX's name for 28 cyber incidents it tracked and verified in October 2026. They include the PHP2Shell flaws in PHP, a GlobalProtect VPN flaw used by ransomware groups, a poisoned LiteLLM release, cloud secrets breaches at Railway and Zeabur, the OpenCode Console API key breach, and a State Bank of India data exposure.
Did all the Black October incidents happen in 48 hours?
No. Ten of the 28 incidents were first made public on 20 and 21 October 2026. Fourteen fall within 72 hours, and the oldest was disclosed on 13 May 2026. The reporting clustered, not the attacks.
Which Black October incidents should I patch first?
Start with the five P0 items if you run the product: PHP (upgrade and restart workers), PAN-OS GlobalProtect, LiteLLM 1.107.0, secrets stored in Railway, and WordPress sites on Rank Math PRO 3.0.123 or UpdraftCentral.
Was State Bank of India hacked in October 2026?
SBI told the stock exchanges on 21 October 2026 that a dark-web dump of about 3.75 lakh records includes 3,897 customer records with personal details. The source system has not been confirmed, and the actor's wider claims are unverified.
Were OpenAI, Anthropic and Google API keys exposed in the OpenCode breach?
Yes, for some users. OpenCode said on 17 October 2026 that a breach affected 1.4% of OpenCode Console users, all with external provider keys linked. Keys kept locally by the OpenCode CLI and desktop apps were not affected. Revoke any key that was linked to Console and review provider usage since 16 October.
Do Indian companies need to report these incidents to CERT-In?
Only if an incident affects your own systems. CERT-In directions require specified incidents to be reported within six hours of noticing them, and RBI and SEBI set similar six-hour timelines for the entities they regulate. A public report about another company does not by itself trigger reporting.
Where can I get the Black October IOCs and detection rules?
The download pack includes 183 sourced indicators as CSV, 78 confirmed indicators as a STIX 2.1 bundle, and Sigma, KQL and SPL detection rules.
Where to go next
- Attack surface monitoring: Start here if PHP2Shell, GlobalProtect or GitLab is your worry.
- Data exposure: Start here if you stored secrets in Railway, Zeabur or TiDB Cloud.
- Brand protection: Start here if your customers will get SBI-style scam calls and lookalike sites.
- Third-party risk: Start here if this is a vendor problem for you rather than an internal one.
- Threat intelligence: Start here if your SOC needs actor and CVE context it can act on.
- AI security and automated red teaming: Start here if your teams run LiteLLM or other AI gateways.
ScruteX, formerly Brandsek, tracks leaked credentials, dark-web sales, ransomware leak sites, exposed services, lookalike domains and vendor risk across your external attack surface. scrutex.ai