October 2026 has been nicknamed “Black October” for the sheer volume and scale of the cyberattacks performed and reported this month. The name was initially coined on October 22nd in response to the wave of incidents that had occurred in the past 48 hours, but the hits kept coming.
Inside Black October
Black October saw dozens of high-profile attacks, including the largest digital asset hack on record. The most significant exploits of the month were the theft of an estimated $6.3 billion from Binance, an estimated $2.7 million drain of user wallets at Polymarket through a compromised third-party vendor, a supply chain attack on ConnectWise Cloud Backup that targeted more than 2,250 Microsoft 365 (M365) tenants, AI-assisted breaches of seven South Korean financial institutions, and the breach of 321,810 Zeabur accounts.
The following sections highlight the main types of incidents and the most significant threats, but they are not a comprehensive account of every incident this month.
Critical Software Flaws
October 2026 was defined by several critical vulnerabilities being discovered in major software and services. Often, this included well-established open-source code that had undergone extensive fuzzing and security review in the past. However, the introduction of AI-powered vulnerability detection and exploit development uncovered many flaws that were previously missed.
Critical vulnerabilities disclosed that led to the “Black October” name include:
- PHP2Shell
- GitLab
- Flaw in Brotli decoder for Node.js enabling RCE
- NGINX/HTTP/3 denial-of-service (DoS) issues
Of these issues, the most famous by far was PHP2Shell, which included a pair of unauthenticated remote code execution (RCE) vulnerabilities in the PHP codebase. These two bugs were rated a 9.2/10 on the CVSS 4.0 scale and have existed since 2012. While exploits are complex to develop, the vulnerability was seen actively exploited in the wild, leading to discord over the traditional patch embargo process. Additionally, several government sites in France, Germany, Belgium, the Netherlands, and Finland were proactively shut down in response until patches could be applied.
Supply Chain and Developer Tools
This month also saw significant supply chain attacks and breaches with a special focus in the AI space. Impacted projects included:
- LiteLLM 1.107.0 release shipped with a credential stealer and remote access tool targeting config files for major LLMs
- Railway suffered a potential breach of customer keys, prompting recommendations to rotate secrets
- Trojanized builds of the Claude Code extension (versions 2.1.312 and 2.1.313) were published to Cursor’s marketplace on October 29 with a persistent SSH backdoor. Cursor said the malicious build was available for about 11 hours and affected at most 5,000 users.
- Malicious versions of OVHcloud CLI were distributed to steal developer secrets
- Zeabur disclosed a second breach in two months that exposed 321,810 accounts and about 3.2 million environment-variable records.
- 333 Tor exit relays were hijacked, leaking SSH passwords
AI-Driven Attacks and Agent Incidents
AI tools play an increasingly central role in cybersecurity. On the one hand, AI can help to identify and patch vulnerabilities and develop defenses against various attacks.
On the other, AI also has been involved in many high-profile cybersecurity incidents in recent months, either at the behest of cybercriminals or through breakouts of AI models being tested by frontier labs. Some of the most significant AI-driven security incidents of October 2026 include:
- Breach of seven South Korean financial institutions linked to an open-source AI attack tool
- Credential stuffing attack targeting over 2,250 M365 tenants in ConnectWise hack by Storm-0940/ARTEX
- An AI agent chained a Kafka UI flaw to cluster-admin access, according to Wiz
Beyond these attacks performed using AI, AI agents also played a critical role in discovering many of the critical vulnerabilities disclosed during Black October. For example, PHP2Shell was allegedly discoverable by prompting an LLM to “find bad vulnerabilities in PHP.” Similarly, Claude was allegedly capable of identifying and cracking the weak eMudhra keys with a single prompt.
eMudhra’s Private Keys
eMudhra was discovered to be using trivially insecure private keys for some of its TLS digital certificates. Eight intermediate CA certificates had private keys with values less than 256 or a single byte (including one that used the number 4).
These keys would be trivially crackable by an attacker and were allegedly created during a mistake in a key generation ceremony. This incident caused Chrome, Mozilla, Apple, and other organizations to distrust the root CA as a precaution, breaking the chain of trust for an estimated 30,000 digital certificates. As a result of the backlash, eMudhra elected to exit its TLS certificates business.
Binance and Other Digital Assets Hacks
The digital assets space also suffered a few major hacks in October 2026. Of these, Binance stands out from the crowd, suffering an estimated $6.3 billion in losses and setting the record for the biggest digital asset hack in history.
The root cause of this incident was allegedly a compromised DevOps engineer’s laptop. The attacker used this system to interact with its withdrawal service, allowing them to steal funds without compromised private keys. Of this $6.3 billion, an estimated $3 billion was frozen on-chain, and the exchange promises to cover all losses from its SAFU and company funds. The FBI formally attributed the theft to North Korea on Saturday, Oct 31, and Binance began phased withdrawals on Nov 1 after replenishing 95% of the stolen amount.
While no other digital asset hack compares to Binance, several others broke the $1 million mark in October 2026. Polymarket was one of these, with an estimated $2.7 million drained from 700 user wallets due to a compromised third-party vendor only hours before Binance overshadowed it.
Key Lessons Learned from Black October
October 2026 is one of the worst months on record in terms of major cybersecurity incidents and disclosed critical vulnerabilities. There are also concerns that it might just be the beginning of a significant shift in cybersecurity as these types of hacks and disclosures become more common.
One common thread across many of the Black October incidents was the core role that AI is playing in cybersecurity. Numerous sandbox breakouts and misalignment issues with frontier AI labs have been reported, such as OpenAI agents disabling monitors, and multiple red team VM escapes.
Also, attackers and defenders are increasingly making use of AI. As a result, vulnerabilities that have been buried for years or decades are coming to the surface, and automated attacks are growing more sophisticated and scalable.
To combat these threats, organizations need to take an increasingly proactive approach to cybersecurity risk management. This includes implementing defense in depth to prevent and detect potential attacks and the use of AI to identify and close potential vulnerabilities and security gaps before they can be exploited by an attacker.
Black October showed that one compromised laptop, vendor script, or developer tool can undo years of careful engineering. Halborn offers Custody and Key Management Assessment, Red Team Exercise, and AI Red Teaming services to test these failure paths before attackers do. To discuss your security posture, get in touch with Halborn.
Sources: Fortune, SecurityWeek, PHP Foundation, Wiz, Calif, Chainguard, GitLab, Node.js, CrowdStrike reports; Microsoft, Computerworld; CSO Online; eMudhra statements, Socket, LiteLLM, Railway, Zeabur and OVHcloud notices; Cursor; StepSecurity; and OpenSourceMalware, Binance, TRM Labs, Elliptic, Chainalysis. Asset-class shares derived from Elliptic data. North Korea attribution is from a blockchain intelligence firm and FBI. Preliminary as of 02 Nov 2026.