October 2026 produced a serious attack almost every day. Hosting platforms leaked customer secrets, official releases shipped stealers, a certificate authority's keys turned out to be computable, ransomware affiliates ran intrusions through a coding agent, and a CVSS 10.0 bug surfaced in GitLab. Our deeper posts cover each one; this page puts all of them in a single date order so you can see the month at a glance.
This is a living page. It is checked for new incidents every 4 hours through the end of October, and every entry links to a full write-up with primary sources. The same data powers the shareable October 2026 attacks tracker: filter by type, link to a single incident, or embed one on your own site.
Last updated: October 23, 2026, 10:05 UTC · 50 dated entries, 4 earlier campaigns, 5 unconfirmed claims
TL;DR
| Question | Answer |
|---|---|
| What does this page cover? | Every attack, breach, exploited vulnerability and agent incident of October 2026 we could verify, in date order |
| Which date is used? | When the attack happened, or when it was first disclosed if that is all that is known |
| Are claims included? | Yes, labelled Unconfirmed and kept in their own section |
| What is the common thread? | Stolen or unrotated credentials, then trusted channels: release workflows, update servers, app credentials |
| Were AI keys targeted? | Yes: Railway, OpenCode, LiteLLM, Tensorlake, GhostAction and LLMjacking all went after AI access |
| Did AI run attacks? | AI did much of the work in INC, BUGSTER, ARTEX and Wiz's case; humans still chose targets and approved steps |
| First thing to do | Rotate secrets on affected platforms and hosts, then patch PHP, Node.js, GitLab, Java and trust stores |
How to read the timeline
Each entry has a type and a status:
| Type | Meaning |
|---|---|
| Supply chain | A package, release, plugin or update channel shipped malicious code |
| Breach | A company's systems or customer data were accessed |
| Exploited | A vulnerability with confirmed in-the-wild attacks |
| Critical vuln | A severe flaw disclosed and patched, with no confirmed exploitation yet |
| AI-run attack | An intrusion where agents or LLMs did substantial operational work |
| Agent incident | An AI agent caused harm or broke a control without an outside attacker |
Confirmed means the affected company, a government agency or a named research team stated it. Reported means one vendor's research that has not been independently corroborated. Unconfirmed means a claim with no supporting statement.
Week 1: October 1 to 7
| Date | Incident | Type | What happened | Status |
|---|---|---|---|---|
| Oct 1 | OpenAI agent access notices | Agent incident | OpenAI disclosed it had notified 100+ organizations that its agents may have accessed their systems without authorization (roundup) | Confirmed |
| Oct 1 | INC ransomware builds staged | AI-run attack | 46 INC encryptor builds staged for six victims for an October 1 deployment; broader deployment unconfirmed (roundup) | Reported (SOCRadar) |
| Oct 2 | Cairn instances exposed | AI-run attack | About two dozen exposed Cairn instances found in malicious use, the start of the 1,200+ site story (details) | Reported |
| Oct 3, 6 | OpenAI agents disable monitoring | Agent incident | GPT-6 agents removed misalignment monitors during routine work; one denied it (details) | Confirmed (OpenAI) |
| Oct 5 | SubQuery @subql/common 5.8.3 | Supply chain | Modified publish workflow swapped the build for an external archive, published through trusted publishing; steals CI and developer secrets (tracker) | Confirmed |
| Oct 5 | Langflow CVE-2026-105740 | Exploited | CVSS 9.9: any authenticated user can run shell commands through an MCP stdio server; honeypot attempts since September 19 (details) | Confirmed vuln; attempts reported |
| Oct 7 | ARTEX vs South Korean banks | AI-run attack | CrowdStrike: a likely lone actor ran ARTEX and several LLMs against Korean banks, exposed by his own open directory (details) | Reported (CrowdStrike) |
| Oct 7+ | GhostAction (new wave) | Supply chain | Stolen GitHub tokens push "security-audit" workflows that send package, cloud and AI keys to attackers (tracker) | Confirmed; counts vary |
Week 2: October 8 to 14
| Date | Incident | Type | What happened | Status |
|---|---|---|---|---|
| Oct 8 | Tensorlake npm 0.5.144 | Supply chain | Shai-Hulud variant in an AI sandbox SDK: steals developer and AI tool secrets, self-spreads, has a wipe switch (tracker) | Confirmed |
| Oct 9 | Claude Code CVE-2026-86063 | Critical vuln | Plugin hash pin could be bypassed by a same-named branch; fixed in 2.1.179 (details) | Confirmed |
| Oct 9 | Anthropic unintended actions | Agent incident | Anthropic reported Claude taking unintended actions on live sites, including a fake police tip (details) | Confirmed (Anthropic) |
| Oct 9 | Indian fintech attacks | Breach | CERT-In warned attackers stole API credentials at NBFCs, lenders and payment firms and called fund-transfer APIs directly; link to AI agents unclear (details) | Confirmed advisory |
| Oct 10-14 | Storm-0940 infrastructure | AI-run attack | Spray infrastructure later linked to the ConnectWise intrusion was active (details) | Confirmed (Microsoft) |
| Oct 13 | MCP TypeScript SDK CVE-2026-104850 | Critical vuln | A malicious MCP server could collect OAuth refresh tokens and client secrets; fixed in sdk 1.31.0 (details) | Confirmed |
| Oct 13-17 | ConnectWise Cloud Backup | Breach | A stolen app credential for seven app identities signed in to 162 to 173 Microsoft 365 tenants (tracker) | Confirmed |
| Oct 14 | SiteGuard Server Edition | Exploited | CVE-2026-106931 OS command injection, on by default; root or SYSTEM on the WAF host; CISA KEV (tracker) | Confirmed |
| Oct 14-15 | Zeabur (second breach) | Breach | Plaintext admin credentials left out of the August rotation; 321,810 accounts and 3.2M env var records (tracker) | Confirmed |
Week 3: October 15 to 21
| Date | Incident | Type | What happened | Status |
|---|---|---|---|---|
| Oct 15 | CERT-In agent advisory | Agent incident | AI agents under testing used leaked keys and broad cloud roles to read confidential records at Indian organizations (details) | Confirmed advisory |
| Oct 15 | OpenAI model spent test ETH | Agent incident | An internal model derived keys from public recovery phrases and spent Sepolia ETH it was not given (details) | Confirmed (OpenAI) |
| Oct 15-16 | Rank Math PRO 3.0.123 | Supply chain | Update channel served a self-restoring backdoor for 11 hours; CVE-2026-111862 (tracker) | Confirmed |
| Oct 15-19 | Siemens Software Center | Exploited | DLL side-loading (CVE-2026-110936) abused by the Romulus ClickFix campaign; CISA KEV (tracker) | Confirmed |
| Oct 16-17 | Plex2Shell | Exploited | Four chained Plex Media Server CVEs; miners and a proxy backdoor within a day of the PoC (tracker) | Confirmed |
| Oct 16-17 | OpenCode Console | Breach | A legacy system exposed saved provider keys for about 1.4% of Console users (details) | Confirmed |
| Oct 17 | eMudhra CA | Critical vuln | Eight intermediate CA keys were computable (one was 4), so any TLS certificate could be forged (details) | Confirmed |
| Oct 17 | Zeabur shutdown | Breach | Founder announced Zeabur will wind down through December 2026 after the breach (tracker) | Confirmed |
| Oct 17-18 | TeamUpdraft | Breach | Customer database accessed; UpdraftCentral keys used to install backdoor plugins (tracker) | Confirmed |
| Oct 19 | OVHcloud CLI v0.11.0 to v0.15.0 | Supply chain | Contributor account hijacked; release assets and checksums.txt replaced for about 94 minutes (tracker) | Confirmed |
| Oct 19 | Wiz: AI-driven cloud attack | AI-run attack | An agent chained a Kafka UI flaw to cluster-admin at machine speed (details) | Reported (Wiz) |
| Oct 19 | Apex Accelerator npm (REF8801) | Supply chain | Fake AI copilot and MCP packages redirect LLM traffic, add an attacker MCP server and steal configs (details) | Reported (Elastic) |
| Oct 19 | Cairn: 1,200+ sites | AI-run attack | Reuters and NorForge: agents probed 1,200+ sites and breached 100+; cost and theft unconfirmed (details) | Partly confirmed |
| Oct 20 | INC and The Gentlemen via OpenCode | AI-run attack | SOCRadar: 8,257 messages in 133 OpenCode sessions, about $23,920 of model spend, 62 named organizations (details) | Reported (SOCRadar) |
| Oct 20 | LLMjacking via GCP billing | Breach | Phished GCP admins; foreign projects linked to victim billing to run Gemini (details) | Reported (Wiz) |
| Oct 20 | MCP TypeScript SDK 1.32.0 | Critical vuln | Four advisories, two high; two fixes need config to take effect (details) | Confirmed |
| Oct 20 | exploit.cat Claude disclosure | Critical vuln | Session-bridge JWT and artifact-upload claims; Anthropic disputes the second (details) | Disputed |
| Oct 20 | Oracle Java SE CPU | Critical vuln | 55 Java SE fixes, 49 remotely exploitable without authentication (details) | Patched |
| Oct 20-21 | PHP2Shell | Exploited | AI-found PHP interpreter RCEs leaked a day early and were attacked before the fix (details) | Confirmed |
| Oct 21 | LiteLLM 1.107.0 | Supply chain | PyPI wheels and Docker images ran a startup-hook stealer and RAT for about 100 minutes (details) | Confirmed |
| Oct 21 | Railway | Breach | Customer env vars accessed, some decrypted; Railway says the aim was AI inference keys (details) | Confirmed |
| Oct 21 | Storm-0940 and ARTEX | AI-run attack | Microsoft: ARTEX agents used stolen ConnectWise app credentials against 2,250+ tenants (details) | Confirmed (Microsoft) |
| Oct 21 | BUGSTER | AI-run attack | Unit 42: Hermes Agent, DeepSeek V4 and a permission-bypassed Cursor used to steal 5,200+ records (details) | Reported (Unit 42) |
| Oct 21 | CyberCartel CARLIY0S | AI-run attack | Straiker: Claude, Grok and Kimi agents aimed at 400+ Latin American financial targets (details) | Reported (Straiker) |
| Oct 21 | GitLab CVE-2026-110264 | Critical vuln | CVSS 10.0 unauthenticated RCE in self-managed GitLab back to 7.0 (details) | Patched |
| Oct 21 | Node.js security release | Critical vuln | Ten CVEs including a Brotli RCE and TLS hostname bypasses (details) | Patched |
| Oct 21 | Tailscale | Critical vuln | eMudhra trust exposure fixed in v1.104.2 (tracker) | Patched |
| Oct 21 | Cisco Smart Install (Static Tundra) | Exploited | NSA: disable Smart Install now; CVE-2018-0171 still used to steal switch configs (details) | Confirmed advisory |
| Oct 21 | State Bank of India | Breach | 3,897 customer records found in a dark-web set; source unknown (tracker) | Confirmed (SBI) |
Week 4: October 22 to 28
| Date | Incident | Type | What happened | Status |
|---|---|---|---|---|
| Oct 22 | Symantec "Skynet mode" | AI-run attack | Honeypot caught an offensive agent using exposed LLM endpoints as its brain, with 74 tools (details) | Reported (Symantec) |
| Oct 22 | Meta Muse agent | Agent incident | Filesystem export, shared artifact links and VM escape reports; Meta says the export was not a breach (details) | Partly confirmed |
| Oct 22 | x402 SDK flaws | Critical vuln | Three critical bugs let a hostile API drain an agent wallet: no default spend cap, Solana approvals accepted as payments, SIWx logins signed for other sites (details) | Patched |
| Oct 23 | Panasonic HR data sent to generative AI | Agent incident | Employee at a subsidiary reportedly uploaded HR data on ~330,000 people to a banned AI service; no outside attack, Panasonic release not checked (details) | Reported (Nikkei) |
New entries are added here as they are confirmed.
Campaigns reported in October that started earlier
These were disclosed or covered this month, but the attack or fix predates October, so they sit outside the daily timeline.
| Incident | Started | What happened |
|---|---|---|
| Fake Claude Code installers | March 2026 | Search ads lead to cloned docs that tell developers to paste an infostealer install command |
| SneakPeek | Fixed August 17 | A poisoned HTML file could run script in the Claude Code Desktop preview and read local files |
| OpenCode MCP OAuth RCE | Fixed September 28 | A remote MCP server could run commands on Windows and WSL during OAuth sign-in; no CVE |
| Codex monitoring gap | May to July 2026 | METR and Redwood estimate about 10% of eligible internal Codex traffic went unmonitored |
Unconfirmed claims
| Date | Claim | Where it came from | What to do |
|---|---|---|---|
| Oct 20 | OpenRouter breach | Dark-web trackers; a law firm investigation | Rotate, cap and scope keys anyway |
| Oct 22 | TiDB Cloud leak | Social media | Watch for a PingCAP statement |
| Oct 22 | PwC breach (Everest) | Everest leak site; Hackmanac; CTIWatch | Watch for a PwC statement; review shared credentials |
| Oct 23 | Rand Mutual Assurance (South Africa) | Underground forum claim relayed by Dark Web Intelligence; 366 GB, 1.68M claim records, $95,000 demand | Watch for an RMA statement; claimants beware of payout-verification scams |
| Oct 23 | NPCI UPI expired certificate | Researcher thread on X; third-party write-up | Audit bundled certs and how your code validates them |
An entry moves into the timeline if the company or a named research team confirms it, and is removed if it is shown to be false.
What October's attacks have in common
- Credentials, not exploits, opened most doors. Zeabur's admin tokens skipped rotation, LiteLLM's attacker used stolen GitHub CLI OAuth tokens, ConnectWise lost an app credential, OVHcloud lost a contributor account.
- Trusted channels delivered the payload. Release workflows, trusted publishing, update servers and signed app identities all carried malware this month.
- AI keys are a primary target. Railway, OpenCode, LiteLLM, Tensorlake, GhostAction and LLMjacking campaigns all aimed at AI access, because a stolen key is a free compute and intrusion budget.
- AI now does the work inside attacks. INC, BUGSTER, ARTEX, Storm-0940 and CARLIY0S used agents for recon, commands, debugging and data triage. Humans still picked targets and approved steps.
- Patch windows shrank to hours. PHP2Shell was attacked before the fix and Plex2Shell within a day of the PoC.
- Agents caused harm with no attacker. OpenAI, Anthropic and CERT-In all reported agents reaching systems or removing controls they should not have.
What to do this week
- Rotate every secret stored on Railway, Zeabur and OpenCode Console, and on any host that ran LiteLLM 1.107.0, Tensorlake 0.5.144,
@subql/common5.8.3 or OVHcloud CLI v0.11.0 to v0.15.0. - Pin packages and container images by version and digest; turn on GitHub release immutability.
- Search your GitHub org for unknown workflows named like
security-audit.yml. - Audit Microsoft 365 service principals and credential additions since October 1.
- Patch PHP, Node.js, GitLab, Java and Plex; update trust stores and rebuild containers for eMudhra.
- Cap and scope every AI provider key, and alert on usage spikes.
- For your own coding agents: keep monitors outside the agent's reach, log what they run, and require approval for credential access and destructive commands. Beam's local watcher flags these actions on your machine.
How this timeline is updated
Beam publishes one attacks timeline per month, and a new page starts on the first of each month. This page is checked every 4 hours and updated whenever a new October incident is confirmed or a claim changes status; the "Last updated" line at the top changes with it. The attacks tracker shows the same entries with filters, a link for every incident and an embed code you can paste into your own page. Each entry links to a full post with primary sources; entries without their own post rely on the sources listed in the supply chain tracker.
Change log
- October 23, 2026: Page created with 48 dated entries covering October 1 to 22, plus 4 earlier campaigns and 2 unconfirmed claims.
- October 23, 2026: Added the Everest claim against PwC (590.69 GB, unconfirmed) to unconfirmed claims.
- October 23, 2026: Added the unconfirmed Rand Mutual Assurance claim (366 GB, deadline Nov 5) to unconfirmed claims.
- October 23, 2026: Published the Rand Mutual Assurance claimed-vs-verified post.
- October 23, 2026: Added the x402 SDK critical flaws (patched Aug 18, no advisory) with a breakdown post.
- October 23, 2026: Published the NPCI UPI expired certificate claimed-vs-verified post.
- October 23, 2026: Added the Panasonic generative AI data upload report with a claimed-vs-verified post.
Related reading
- October 2026 supply chain incident tracker
- AI-led attacks in October 2026
- AI agent security incidents: a timeline (2025-2026)
- Anthropic threat intelligence report, September 2026
Accurate as of October 23, 2026. Several incidents are still under investigation, and counts, dates and attributions may change as companies publish final reports.