October 2026: the month the attack moved outside the building

Put October’s incidents side by side and one pattern holds across nearly all of them: the attack started somewhere else. Not inside the organisation’s own network, but in what it shows the public and in what it relies on.

Three things happened at once.

Flaws found with AI

Fixes for PHP2Shell shipped on 21 October: two flaws in the language behind seven in ten websites, found by researchers working with AI.

Palo Alto Networks counted 22.6 million exposed servers running a version at risk. The technical details leaked before the fix shipped, so the race between the patch and the exploit began before the patch existed.

Governments did not wait for their patch windows. On the Canadian Centre for Cyber Security’s advice, federal websites went offline that day, Statistics Canada’s among them.

A UK minister told the House of Lords that 32 government services were unavailable and four partly so. Australia, Germany, France, the Netherlands and others took their own sites down and Nepal pulled thousands of government and bank sites.

The NSA told organisations that could not patch at once to take their systems off the internet. Five days later the US cybersecurity agency added both flaws to its list of exploited vulnerabilities and gave federal agencies three days to fix them.

In the same week researchers at OpenAI reported a flaw in Brotli, the compression library inside Node.js and much else, that lets an attacker run code with no login.

Node.js patched it on 21 October and it joined the exploited list on the 27th. On 28 October the researchers behind PHP2Shell said this is only the beginning. They are right.

Intrusions run by AI agents

CrowdStrike reported on 7 October that an attacker had used ARTEX, an open-source agentic penetration-testing tool, together with a coding agent, against at least seven South Korean financial institutions between late September and early October.

Two weeks later Microsoft described a group it tracks as Storm-0940 taking the credentials of ConnectWise Cloud Backup by password spraying 327 accounts at eight organisations, then using ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts a minute. At some of them it got privileged access.

Shared platforms as the entry point

Railway, a cloud host for tens of thousands of applications, disclosed on 21 October that an intruder may have read customers’ environment variables, which is where API keys and database passwords live. It paused all deployments and told customers to rotate all of their keys.

Zeabur had reported the same a week earlier, a poisoned release of LiteLLM on PyPI went after cloud and AI-provider credentials and for 94 minutes on 19 October the downloads of five OVHcloud command-line releases were replaced with builds that stole secrets.

Then on 29 October Polymarket halted trading after wallets were emptied through a script loaded from a third-party monitoring vendor, about US$2.7 million from 726 wallets by Polymarket’s own count. Hours later Binance paused withdrawals after a security incident it has since put at about US$6.3 billion in client assets.

It called it a hack and said it would cover all losses. Its first finding was that the attacker used a compromised work laptop of a DevOps engineer to reach a service container. It has not yet said how that laptop was compromised.

Not every entry point was software a company chose. Overnight on 11 October attackers took over the refrigeration controllers at 250 to 350 French supermarkets, Intermarché, Carrefour Market, Monoprix, Leclerc and Super U among them.

They used the built-in defrost cycle to warm the units. The controllers ran older control software and one researcher counted 2,752 of them reachable from the internet.

The month, in order

Who it reached

The damage was not limited to technology companies. Capcom confirmed that 11.77 million account records had been accessed. An online fashion retailer with about 17 million customers lost names and contact details through a third-party messaging platform.

The University of New Mexico’s health system diverted ambulances from the state’s only Level I trauma centre. The US Federal Election Commission took its electronic filing system offline after an attempted intrusion and two days later had not said when it would return.

The cases closest to most businesses are the pharmacy and the law firms. Ridgeway Pharmacy reported a breach of nearly 259,000 customers’ records through a website built and run by an outside developer.

Two of Canada’s largest corporate law firms were attacked a day apart, on 22 and 23 October: at one, files including client information were accessed; at the other, an account was compromised.

In the same month the insurer for Ontario lawyers said cyberattacks on the province’s law firms over the last several months had produced unauthorized withdrawals of several million dollars. The RCMP warned that callers posing as a firm’s own IT helpdesk were walking lawyers to a fake login page.

Who is doing this and what it costs them

The models doing the attacking are not the expensive ones.

In July the UK AI Security Institute measured the leading open-weight models, the ones anyone can download and run, against the closed frontier models and found them performing on cyber tasks like frontier models released four to seven months earlier, at a fraction of the price.

A researcher who ran one such model against a live target recorded about four minutes and about 20 cents of inference to find a live PHP page and a newly disclosed flaw. That is one measured run, not a market rate.

The market rate is lower: Flare’s reading of the underground markets found almost every advertised price far below the model maker’s own, sellers offering open models with the safety training stripped out and, in Flare’s assessment, a good part of it likely running on stolen keys and compromised cloud accounts.

The states are in the same business with better funding. Trend Micro’s half-year report covers China, Russia, North Korea and Iran and describes an agent that scanned a network, took credentials and moved through it on its own.

Google’s threat group has described one China-linked crew running an open model inside compromised cloud environments, which it reads as a way to stay out of sight of the commercial model providers.

Anthropic documented in November 2025 a suspected state-sponsored campaign that ran most of an intrusion against about thirty organisations through a frontier model until it was caught.

The pattern across those reports is a combination: a frontier model through a stolen account for the hard step, a cheap open model on somebody else’s cloud for the thousand easy ones.

No one is watching either. The cloud keys taken in October are exactly what that costs an attacker. Nobody has shown that October’s stolen keys were spent on models and this article does not say they were.

That is the asymmetry. The attacker pays cents for volume and nobody checks its work. The defender pays for care: a frontier model, a person on every finding and a record that holds up. One finding missed costs a firm more than years of reading. The cost favours whoever reads first.

What to take from it

1. Where the entry point is known, it was outside the organisation: a published version string, a vendor’s script on a trading page, a developer’s website, a backup provider’s credentials, a phone call from someone posing as the helpdesk. None of them started inside the network the organisation was protecting.
2. A firm runs a few systems of its own and relies on hundreds more: the host behind its site, the script on its page, the services its mail records allow to send in its name, the vendor that holds its data. October’s victims were reached through that second group.
3. Attackers now move faster than defenders can respond. AI was used at both ends of the month, to find the flaws and to run sign-in attempts at 2,900 a minute, while patching, reviews and audits still take weeks.
4. Size no longer decides who gets read. A version string, a look-alike name and a mail record that refuses nothing can be read automatically for thousands of organisations at a time, a national law firm and a ten-person practice in the same pass.

What a firm does with this

Most of what was used in October could have been seen externally before the attack. Whatever an attacker can see, the firm can look at first.

Know what the firm depends on, not only what it runs: the host behind its site, the scripts on its pages, the platforms that send in its name, the firms money moves between.

Treat a supplier as a way in. A changed bank detail, an invoice from a familiar address, a login prompt from a tool used every day, a call from “the helpdesk”: confirm it on a number the firm already holds, never one in the message.

When a platform a firm depends on tells it to rotate its keys, do it that day. The intruder’s copy does not expire.

A firm can close these now: update the software its website announces, publish a rule that tells mail servers to refuse email forged in its name, catch look-alike names the week they are registered and keep a dated record an insurer or a client can check.