Black October: Major Cyber Incidents Flood the Last 48 Hours

Observers are calling the past 48 hours Black October. New incidents keep surfacing every hour. Many of these would rank among the largest of a normal year.

Year-Level Incidents

• PHP2Shell: A hole in software used by about 70 percent of websites forced some governments to take sites offline.
• eMudhra: Master keys that prove websites are legitimate were cracked. One key ranked as number 4.
• California: Data on every public school student since 2023 was stolen. The records include disability status.
• Railway: Hackers stole secret keys from a hosting platform used by millions of developers.
• Zeabur: 321,810 accounts were breached. The company is shutting down.
• LiteLLM: An AI tool downloaded 3.4 million times a day was poisoned with a password stealer.
• GitLab: A severity 10 hole affects every version since 2014.
• Cairn: Criminals used an AI hacking tool to break into more than 100 companies.
• Ahold Delhaize: Hackers knocked the owner of Food Lion and Stop & Shop offline.
• Onamae: Malware was planted on up to 26,739 customer servers in Japan.

Month-Level Incidents

• Signal: A bug can leave your microphone and camera on after you hang up.
• NGINX: Three critical holes affect software that runs about one third of websites.
• HTTP/3: A single connection can crash seven of the ten web server types tested.
• Plex: Hackers are breaking into home media servers.
• SafePay ransomware: The FBI warns it has hit more than 600 critical infrastructure organizations.
• Palo Alto: Ransomware gangs are breaking in through company firewalls.
• Bullhorn: A platform used by more than 10,000 companies was knocked offline.
• Medi-Cal: Data on 970,000 patients was stolen.
• WordPress: Hackers stole a plugin maker’s keys and planted backdoors on websites.
• AOMEI: Backup software’s update server handed out a backdoor.
• Meta Muse: Meta’s AI agent exposed users’ personal and business secrets.
• Tor: 333 relays were hijacked to steal logins.
• TiDB Cloud: A database company’s cloud was breached.

Additional Serious Cases

• State Bank of India: India’s biggest bank confirmed a data breach.
• OVHcloud: Hackers slipped a password stealer into a cloud company’s official tool.
• Siemens: A software hole is being used to spread malware.
• North Korea: State hackers launched a new attack campaign on South Korea.

The volume and severity of these events mark one of the most intense periods in recent cybersecurity history. Organizations and individuals face heightened risk across web infrastructure, cloud services, and everyday software.