A wake-up call for businesses relying on connected technology
October 2026 delivered a stark reminder of how quickly the cybersecurity landscape can change.
During a concentrated period of cybersecurity reporting, a series of significant incidents involving software providers, cloud platforms, financial services, retailers and critical infrastructure attracted international attention.
Reports highlighted 27 separate security events, with 17 receiving particular attention. They ranged from software vulnerabilities and compromised development tools to ransomware campaigns, stolen credentials and disruptions affecting business operations.
Although these events did not all occur within the same 48-hour period, their appearance in a relatively short reporting window exposed a common problem: organisations are increasingly dependent on technology and suppliers they do not directly control.
For everyone using software, the incidents offer several important lessons.
The incidents: What happened?
The following is a summary of the incidents identified in the October reporting. Dates refer to reported activity or disclosure periods, not necessarily the initial date of compromise.
1. Software vulnerabilities and infrastructure exposure
PHP2Shell
Security researchers highlighted critical PHP vulnerabilities that could potentially allow attackers to execute commands remotely on vulnerable systems. Given PHP’s widespread use in websites and applications, weaknesses of this nature can create significant exposure.
eMudhra
A certificate-authority security issue raised concerns about the integrity of digital certificates. Weaknesses involving certificate-signing keys can undermine trust in encrypted communications and website authentication.
GitLab
A critical vulnerability affecting self-managed GitLab installations highlighted the importance of maintaining development infrastructure and applying security updates promptly.
NGINX
Memory-corruption vulnerabilities affecting NGINX demonstrated how weaknesses in widely deployed web-server technology can have consequences across multiple organisations.
HTTP/3
Researchers identified security weaknesses involving HTTP/3 implementations, including potential denial-of-service conditions. The findings reinforced the importance of keeping internet-facing infrastructure current.
Plex Media Server
A reported vulnerability chain affecting Plex installations illustrated how exposed services can become targets for exploitation and potentially unauthorised software installation.
Palo Alto Networks / GlobalProtect
Reporting about exploitation of a firewall-related vulnerability highlighted the continuing risk posed by systems that remain unpatched after security updates become available.
2. Cloud platforms, credentials and software supply chains
Railway
A reported security incident involving Railway raised concerns about customer environment variables and potentially exposed application secrets. Such information can provide attackers with access to other connected services.
Zeabur
A reported compromise involving user accounts and environment-variable records highlighted the risks associated with cloud development environments and stored credentials.
LiteLLM
A compromised software package raised concerns about malicious code entering the software supply chain. Developers downloading apparently legitimate components could potentially introduce malware into their environments.
Cairn
An AI-related security campaign reportedly affected more than 100 organisations. The incident highlighted the emerging risks associated with exposed AI-agent infrastructure and insufficient access controls.
Onamae.com / GMO
Malware affecting customer virtual servers demonstrated how security problems involving hosting infrastructure can extend beyond an individual organisation.
OVHcloud
A compromised developer account was reportedly used to distribute information-stealing malware through a software tool. This illustrates why software distribution systems require strong authentication and integrity checks.
TiDB Cloud / PingCAP
Reported unauthorised access involving credentials raised concerns about internal systems and source-code exposure.
AOMEI Backupper
A compromised software update mechanism reportedly resulted in malicious software being distributed through legitimate update channels. This is a particularly important example of the risks associated with trusted software suppliers.
3. Data breaches and privacy concerns
California student records / ETS
A reported incident involving student information highlighted the sensitivity of educational records and the importance of protecting third-party data-processing environments.
Medi-Cal / Paradigm Healthcare
A healthcare-related data exposure potentially affected a substantial number of individuals. Healthcare information is particularly sensitive because it can contain personal, financial and medical details.
State Bank of India
Reports concerning thousands of customer records raised questions about the protection of financial information. The reported exposure required careful verification rather than assuming every allegation represented a confirmed breach.
Meta Muse
Concerns involving shared AI conversations highlighted the privacy implications of publicly accessible conversation links and the need for users to understand how their information is shared.
Signal
A reported security vulnerability involving calling functionality raised questions about device permissions and the protection of private communications. A vulnerability disclosure should not automatically be interpreted as evidence of successful exploitation.
4. Ransomware and business disruption
SafePay ransomware
An FBI and CISA advisory highlighted the scale of SafePay ransomware activity and its impact on organisations across multiple sectors. The campaign demonstrated the continuing threat posed by financially motivated cybercriminal groups.
Ahold Delhaize
A cyber incident disrupted digital services associated with major supermarket operations. The event demonstrated how cyberattacks can affect customer-facing services even when physical operations continue.
Bullhorn
A security incident resulted in disruption to a major recruitment technology platform. Businesses relying on external software providers can experience operational problems even when their own internal systems remain secure.
5. Further security incidents
Additional reporting included:
- UpdraftPlus / TeamUpdraft: Concerns about compromised connection credentials and unauthorised access involving connected WordPress environments.
- Tor network: Reports of compromised exit relays, raising concerns about network privacy and the security of communications.
- Siemens Software Center: A vulnerability involving software-loading behaviour was associated with malicious activity.
- Operation FlashHole: A reported cyberespionage campaign attributed to North Korean-linked actors highlighted the continuing threat of sophisticated state-linked operations.
These incidents varied considerably in their level of confirmation, severity and operational impact. They should therefore be assessed individually rather than treated as equivalent successful attacks.
What do these cyberattacks mean for everyday employees?
It is easy to read about cyberattacks involving major companies and assume they are problems for IT departments to deal with. The reality is quite different. Many successful cyberattacks begin with something ordinary: an email, a password, an unexpected attachment, a software update or someone being tricked into sharing information. You don’t need to be a computer expert to become part of a cyberattack. Equally, you don’t need technical knowledge to help prevent one.
Here are five things every employee should understand.
1. Be careful what you click
One of the simplest ways criminals gain access to business information is by tricking people into clicking links or opening attachments. These messages can look incredibly convincing. They may appear to come from your manager, a colleague, a supplier, a bank or even a company you regularly deal with.
You might receive an email asking you to:
- Review an urgent invoice.
- Update your password.
- Confirm your bank details.
- Open an unexpected document.
- Download an important software update.
- Review a shared file.
The problem is that the message may not be genuine.
What should you do?
- Stop and think before clicking.
- Check the sender’s actual email address.
- Be suspicious of unexpected requests for information.
- Don’t open attachments you weren’t expecting.
- If something seems unusual, contact the sender using a phone number or contact method you already trust.
Remember: just because an email looks professional doesn’t mean it is legitimate.
2. Your password is more valuable than you think
Most people have dozens of online accounts. Work email, banking, shopping, social media, cloud storage and business applications all require passwords. The danger is that criminals often try passwords stolen from one website on other websites. For example, if you use the same password for your personal email and your work account, a breach of one service could put the other at risk.
What should you do?
- Never reuse your work password on personal websites.
- Use a different password for important accounts.
- Use an approved password manager if your organisation provides one.
- Turn on multifactor authentication wherever possible.
- Never share your password with colleagues or anyone claiming to be IT support.
- Never give your Exess password to the Exess team (we don’t want it).
If you receive an unexpected login approval request on your phone, don’t approve it just to make it disappear. It could be someone trying to access your account.
3. Be cautious when using AI tools
For many organisations AI tools are becoming part of everyday working life. Employees are using AI to write emails, summarise documents, prepare reports, analyse information and improve productivity. However, there is an important risk that many people overlook. When you enter information into an AI tool, you may be sharing information with an external service. That information could include client details, employee records, financial information, confidential plans or internal documents.
What should you do?
- Only use AI tools approved by your organisation.
- Never enter passwords or confidential information into AI tools.
- Don’t share client records or identifiable information with AI tools.
- Fact check AI-generated information before sharing it with others.
- Follow your organisation’s AI and information-handling policies.
- Remember when you share confidential data with AI agents you are breaching consent and data sovereignty laws.
4. Think twice before downloading or installing something
The October incidents highlighted how criminals can sometimes exploit software that people trust. This means that even legitimate-looking software, apps and updates can present risks. You might receive a message saying that you need to install an update, download a document viewer or add a browser extension. It might look genuine, but it could introduce malicious software onto your computer.
What should you do?
- Only download software from approved sources.
- Don’t install apps without permission from your IT team.
- Never ignore security warnings just to get something working.
- Don’t connect unknown USB devices to your work computer.
- Report unexpected software installation requests.
If your computer suddenly behaves differently, becomes unusually slow or displays unexpected messages, let IT support know.
5. Remember that protecting information is everyone’s responsibility
Cybersecurity isn’t just about protecting computers. It’s also about protecting people, clients, staff, suppliers and the reputation of the organisation. A criminal who gains access to one employee’s account may be able to send convincing messages to other employees, access org documents or obtain client information. Even a seemingly small mistake can have enormous consequences.
What should you do?
- Lock your computer when you walk away from your desk.
- Don’t leave confidential documents where others can see them.
- Be careful when sending emails containing sensitive information.
- Double-check payment or bank-detail changes with the appropriate person.
- Don’t share work information through unauthorised apps.
- Report anything suspicious as soon as possible.
And perhaps most importantly, don’t be embarrassed if you make a mistake.
If you accidentally click a suspicious link or share information with the wrong person, tell your IT team immediately. Reporting something early can make a significant difference.
What should every employee do over the next 30 days?
You don’t need to become a cybersecurity expert. A few simple habits can make a significant difference.
Week 1 – Check your accounts
- Change any weak or reused work passwords.
- Enable multifactor authentication.
- Check that your recovery details are correct.
Week 2 – Be more aware of emails
- Look carefully at unexpected messages.
- Stop before opening unfamiliar attachments.
- Verify unusual requests for money or information.
Week 3 – Protect information
- Check where you store organisation documents.
- Avoid sharing confidential information through unapproved tools.
- Be mindful of what you enter into AI apps.
Week 4 – Know what to do
- Know how to contact your IT support team.
- Understand how to report a suspicious email.
- Know what to do if you accidentally click something suspicious.
- Familiarise yourself with your organisations security policies.
Cybersecurity starts with people
The cybersecurity incidents reported during October 2026 demonstrate just how interconnected our working lives have become.
A problem with a software supplier can affect thousands of businesses. A stolen password can provide access to confidential information. A convincing email can trick an otherwise careful employee into opening the door to a criminal.
Technology companies have a responsibility to build secure products. Organisations have a responsibility to protect their systems and information.
But employees also play an important role.
You don’t need to understand how hackers write malicious software or exploit computer systems.
You simply need to recognise when something doesn’t look right, take a moment before acting and know who to contact when something seems suspicious.
Cybersecurity isn’t just an IT problem. It’s everyone’s responsibility.
One small decision by an employee could prevent a much bigger problem for the entire organisation.