Cybersecurity Threats October 2026: Quest Breach & More

Data current as of October 24, 2026.

A lab company’s patient records, a backup tool trusted with Microsoft 365, and the software behind most websites all made security news this month. Here’s what happened, in plain English, what it means for businesses here on the Treasure Coast, and what to do about it.

Illustrative scenario, not a real client: It is Saturday morning. You are in your home office, sipping coffee, when your phone buzzes. Your office manager is frantic. The company's Microsoft 365 email account has been taken over. The attacker changed the password, locked you out, and is emailing your top customers new "payment instructions" from your own address. By the time you get back in, a customer’s payment has gone to the criminal’s bank account instead of yours. Your WordPress website is also down because the attacker disabled it to hide their tracks. Now you’re facing angry customers, a possible data-leak notice, questions from your insurance carrier about what protections you had in place, and days of lost business.

Why This Month Is Different for Your Business

You probably don't track software flaws. You just want your systems to work. But this month, the ground has shifted under your feet.

Start with Quest Diagnostics, the lab company that says it serves one in three American adults every year. On October 21, Quest discovered that an outsider had gotten into the online system doctors’ offices use to order lab tests and see results, and that patient records, including health information, were accessed. Quest hasn’t yet said how many people are affected. If you, your family or your employees get lab work, this may touch you. If you run a medical practice, it touches your patients.

Then there's ConnectWise SkyKick, a backup tool many IT providers use to protect their clients' Microsoft 365 email and files. Attackers, which Microsoft ties to a foreign government-backed group using AI agents, stole SkyKick's own keys and used them to sign in to 173 companies' Microsoft 365 accounts. Microsoft 365 itself wasn't hacked. Strong passwords and login codes didn't stop the attackers, because they came in as the trusted backup tool those companies had already let in. In some companies they went further, quietly making themselves administrators and planting ways to get back in later.

If your website runs on WordPress, the behind-the-scenes software it’s built on (it powers nearly 70% of all websites) got an emergency fix on October 21, and Amazon’s security team says attackers started trying to exploit it four days before the fix came out. A website that hasn’t been updated is a website someone else can take over. And the office firewall, the box that guards your network’s front door, is a target too: Fortinet, one of the most common brands, released critical and high-severity fixes on October 22.

The pressure is real. In the last 30 days, 16,790 new software flaws were made public. That’s more than four times as many as in the same 30 days last year (4,047). Every one of them is a possible way in, and every break-in can mean stolen money, lost customer data, days of downtime or a lawsuit.

The Short Version: Three Questions for Your IT Person This Week

You don’t need to follow every bug in this post. If you run a business here on the Treasure Coast, ask whoever handles your IT these three questions:

1. “Is our website up to date?” The software under most websites (PHP, which runs WordPress) got an emergency fix on October 21, and attackers started trying to break in before the fix was even out.
2. “Which outside apps can get into our Microsoft 365, and do we still need them?” In the ConnectWise SkyKick attack, nobody’s password was stolen. The attackers came in as a trusted backup app.
3. “Is our firewall patched, and would we know if someone logged in as us at 2 a.m.?” Fortinet, one of the most common firewall brands, shipped critical fixes on October 22, and attackers now move within hours of a flaw going public.

If the answer to any of them is “I’m not sure,” that’s worth a call: (772) 794-1194.

You don’t have to become a security expert. That’s our job. MainSail Data is the Vero Beach IT company that has looked after Treasure Coast businesses since 2005, keeping them patched and protected, with security watched around the clock.

Protect your business with MainSail Data cybersecurity →

The rest of this post goes deeper, with every incident, patch and source, for you or your IT person.

The Last 30 Days: The Breaches You Should Know About

Several of the biggest incidents this month came through tools and platforms that businesses trust: a lab-ordering portal, a backup app and developer clouds.

Quest Diagnostics: Patient Records Accessed

On October 21, 2026, Quest Diagnostics learned that an unauthorized party had accessed its Quanum Lab Services Manager (LSM), the online system doctors’ offices use to order tests and view results, and disclosed it in a filing with the Securities and Exchange Commission (SEC). TechCrunch reports Quanum is used by about half a million clinicians. In its October 23 update, Quest said the incident is remediated and LSM has been securely restored, though LSM users may need to reset credentials (Quest’s line for LSM users is 1-800-697-9302). What Quest has confirmed: personal information and patient records, including health information, were accessed. What remains unknown: how many patients are affected and how the attackers got in. As of October 22, no hacking group had claimed the breach (The Record), and Quest says the incident is not related to the recent PHP vulnerabilities. For medical practices, Quest briefly paused LSM and, as a precaution, its Essential Insights and LabHQ tools; it says no data was accessed in those two and that they have since been restored. Quest says it has notified federal law enforcement, will notify affected patients and will offer them credit monitoring. For patients and employers, expect notifications once the investigation identifies who was affected. For context, TechCrunch notes Quest also had 11.9 million patient records exposed in 2019 through a cyberattack on a third-party billing company. This time, Quest hasn’t disclosed how the attackers got in.

Why it matters for healthcare and consumers: lab orders and results are among the most sensitive data that exists. Expect convincing scam emails, texts and calls about "lab results" and "billing problems" to follow this kind of news.

ConnectWise SkyKick: A Trusted Backup App's Keys Were Stolen

ConnectWise SkyKick (sold as ConnectWise Cloud Backup), a service many IT providers use to back up their clients' Microsoft 365 data, was the target of a supply-chain attack. Attackers obtained the backup app's own credentials and, on October 15, used them in a scripted sweep against customer Microsoft 365 tenants (a tenant is one company's Microsoft 365 account). Security researchers confirmed unauthorized sign-ins in 173 tenants. Microsoft attributes the activity to Storm-0940, which it describes as a China-state aligned actor using an AI-agent toolkit it calls ARTEX, and says this was not a compromise of, or a vulnerability in, Microsoft's own systems. Because the attackers signed in as the trusted app, user passwords and multi-factor authentication (MFA) never came into play. In some environments, Microsoft saw follow-on activity: reconnaissance, credential changes for persistence and changes to privileged roles; Researchers found two tenants where the attacker made itself Global Administrator and added new secrets to other trusted apps. Microsoft cautions that a sign-in does not necessarily mean data was accessed or stolen, researchers reported no signs of mailbox or file tampering, and Sophos said it is unclear what the attackers did with the access. ConnectWise disabled the app identities on October 17, says it has reset the affected credentials, and on October 24 said its backup archives were encrypted, isolated and preserved with no indication of compromise; it is targeting a phased restart for partners starting October 26. Customers are advised to keep the apps disabled until told otherwise, review sign-in and audit logs, and check for any new credentials added since October 13.

Developer Clouds Spilled Their Keys: Railway and Zeabur

Two developer platforms suffered breaches that exposed the secrets developers use to connect their apps to services. Railway, an app-hosting platform, was attacked from October 20 to 22, 2026: attackers queried customers' encrypted environment variables (where apps keep passwords and API keys) and decrypted a subset. Railway says at most 1.85% of workspaces had variables potentially exposed, and it urged customers to rotate any secrets stored before October 21; some vendors, including GitHub, revoked exposed keys. Zeabur, a deployment platform, had an attacker use leaked internal admin credentials stored in plaintext on October 14–15, affecting roughly 3.2 million stored app settings and secrets (environment variables) and 321,810 accounts, according to independent reporting.

A Poisoned AI Toolkit: LiteLLM

LiteLLM, an open-source gateway that connects apps to AI models, had a compromised release (1.107.0) published to PyPI (Python's package store) and container images on October 21, 2026. Microsoft says simply starting Python in an affected environment could run a credential stealer targeting developer and cloud credentials, browser data and SSH keys. Separately, CISA added LiteLLM CVE-2026-59822 (an authentication bypass) to its Known Exploited Vulnerabilities (KEV) list of bugs confirmed under attack on September 2. If your developers or vendors use LiteLLM, treat any system that ran 1.107.0 as compromised and rotate every key on it.

Ransomware Took Down a Whole Cloud Region

On October 7, 2026, a ransomware attack took down IDC Frontier's IDCF Cloud East Japan Region 1, affecting 495 companies and local governments that rent servers there. In a message shown to customers, the attackers claim to have encrypted 225 databases (3.6 petabytes) and 16,000 virtual-machine disks; those are the attackers' claims and have not been independently verified.

Utility Customers Exposed: CenterPoint Energy and Georgia Power

Houston utility CenterPoint Energy’s data breach, first disclosed to the SEC on September 14, affects 1,062,060 Texans according to the Texas Attorney General's breach database (reported October 14), exposing names, addresses, Social Security numbers, and driver's license numbers; CenterPoint says its operations were not affected. On October 5, Georgia Power (Southern Company) said an unauthorized party accessed its online customer portal and "certain, limited information" tied to about 400,000 customer accounts. In both cases it was customer data, not the power grid, that was hit.

Key numbers: 16,790 new CVEs in the last 30 days (+314.9% vs. 2025) · 42,599 in 90 days (+259.9%) · 103 confirmed-exploited bugs added to CISA's list in 90 days (+68.9%) · Quest Diagnostics patient information accessed (found Oct 21) · stolen ConnectWise SkyKick app credentials used to sign in to 173 Microsoft 365 tenants (per security researchers) · PHP2Shell patched Oct 21 · Fortinet fixes out Oct 22, advisories due Nov 10.

The Big Picture: A Flood of New Vulnerabilities

The numbers below come straight from the U.S. government’s National Vulnerability Database, pulled the morning this post was published.

The data from the National Vulnerability Database (NVD) tells a stark story. In the last 30 days (Sep 24–Oct 24, 2026), 16,790 new CVEs were published, a 314.9% increase over the same period in 2025 (4,047). Critical and high-severity flaws jumped 320.4%, reaching 8,084. Over the broader 90-day window (Jul 26–Oct 24), the total hit 42,599 CVEs, up 259.9% from 11,835 in 2025. Critical and high flaws in that window reached 22,465, up 289.9%. The single busiest day was October 13, 2026, the same day as Microsoft’s monthly Patch Tuesday, when 2,303 new CVEs hit the database. The busiest day in the same window last year saw 413. Fortinet, for one, says it has added frontier AI models to its own security testing, and that this month’s batch of fixes came out of that program.

A CVE is simply a unique identifier for a specific software bug. The CISA KEV (Known Exploited Vulnerabilities) list is different: it is a curated list of bugs that the US government confirms attackers are actually using in the wild. It’s the difference between a known weakness and an active threat. Here, the data is nuanced. Over the last 30 days, 35 new KEVs were added, essentially flat compared to 34 in 2025. But over the 90-day window, 103 KEVs were added, a 68.9% increase over 61 in 2025. Honest read: the flood is mostly in disclosures (new bugs found). The exploited list ran at about last year’s pace over the past month, but over the full quarter it is up 69%. This means while the number of active exploits hasn’t spiked in the last 30 days, the sheer volume of new bugs means more potential entry points.

That is the defining feature of the cybersecurity threats October 2026 has delivered: the volume of new vulnerabilities has roughly quadrupled, and the confirmed-exploited list is up 69% over the quarter. For any business, this means your perimeter is under constant, high-volume scrutiny. The question isn’t if you’ll be scanned, but when the next critical flaw in your stack will be weaponized.

Critical Infrastructure Under Pressure: Power, Water, Healthcare and Industrial Systems

The last 90 days have brought a steady drumbeat of attacks on the systems that keep the lights on, water flowing, and data moving. Security firm watchTowr said in September that the gap between a flaw going public and attackers using it has fallen from about two weeks to about four hours, so infrastructure owners have almost no time to patch.

Water

In September, Colorado Gov. Jared Polis’s office said foreign hackers had broken into two small private water utilities in late August, each serving fewer than 200 people. The attackers changed settings, disabled remote access and alarms, and altered pumping cycles; officials said water quality and treatment were not affected, and the attackers have not been publicly identified. The FBI and EPA issued an alert about actors targeting internet-exposed Rockwell/Allen-Bradley MicroLogix PLCs (programmable logic controllers, the small industrial computers that run pumps and valves) in the water and wastewater sector, with reported effects including loss of pressure and flooding.

Healthcare

Healthcare had a brutal quarter. In Q3 2026, Comparitech counted 306 ransomware attacks on the sector, with 192 hitting hospitals, clinics and other direct care providers.

Quest Diagnostics discovered on Oct 21, 2026 that patient records in its Quanum Lab Services Manager had been accessed (see the full story above). Quest says the incident is remediated; the number of patients is still under investigation.

McKesson, a large drug and medical-supply distributor, disclosed on Aug 28 (SEC 8-K) an incident it discovered on Aug 25; in a notice to customers it confirmed unauthorized access to third-party applications and exfiltration of data. The extortion group ShinyHunters claims it phoned employees posing as IT support (voice phishing), took over their single sign-on logins, and stole about 284 million patient-related data records (raw lines, not unique people) from Salesforce and Snowflake; however, these numbers and methods remain unconfirmed by McKesson.

Baylor Genetics found suspicious activity around June 15, 2026; the HHS breach portal lists 2,810,878 people affected, including patients and employees. Depending on the person, exposed data may include medical testing information, lab test results and, for a limited subset, Social Security numbers.

Power

On October 5, Georgia Power said an unauthorized party accessed its online customer portal and limited information tied to about 400,000 customer accounts. It is important to be precise: this was a leak of customer data, not a cyberattack on the grid’s control systems. We found no confirmed reports of a cyberattack causing a grid outage in this window.

Industrial Control Systems

CISA published industrial advisories on October 22, including multiple path-traversal flaws in Siemens Industrial Edge that an authenticated remote attacker could abuse (ICSA-26-295-17, CVSS v3 up to 9.1). NVD also lists a Rockwell 1732E ArmorBlock I/O flaw (CVE-2026-12655, published Oct 13) that lets an unauthenticated attacker change the device’s web-server password and take over its admin account. Additionally, a Siemens Software Center vulnerability (CVE-2026-110936) was added to the Known Exploited Vulnerabilities list on October 20.

Critical and high-severity disclosures are up 290% over the same 90 days last year. If your business relies on any of these systems, plan to patch in days, not months.

The Plumbing: Back-End Tech Everything Else Depends On

Your network is a house. The front door is your website or email. But the plumbing—the pipes, pumps, and valves that move data behind the scenes—is where the real danger lives. If the plumbing breaks, the whole house floods. Here is what is broken, what is fixed, and what is still leaking.

PHP (PHP2Shell + CVE-2026-115560)

• What it is: PHP is the coding language that powers nearly 70% of the world’s websites, including most WordPress sites. It is the engine under the hood of your web presence.
• CVEs / CVSS: "PHP2Shell" refers to CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1). A new, separate flaw, CVE-2026-115560, was disclosed on Oct 23.
• Exploited?: Amazon Threat Intelligence says attack attempts began four days before the patch. AWS’s chief information security officer, CJ Moses, says PHP2Shell “is now seeing broad exploitation attempts in the wild,” though it is unclear whether any attempts succeeded. CISA said it had not seen successful exploitation as of Oct 21. The new CVE-2026-115560 is unpatched but affects only unusual configurations.
• Status (Oct 24, 2026): The main PHP2Shell bugs are PATCHED in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new CVE-2026-115560 is UNPATCHED; the fix comes in the next regular release. Mitigation: set session.upload_progress.enabled=0.
• What depends on it: Your website, customer portals, and any web app running on PHP. If this breaks, your online presence goes dark.

OpenSSL

• What it is: The encryption library sitting inside nearly every server, VPN, and network appliance. It is the lock on your data in transit.
• CVEs / CVSS: A September 29 release fixed 14 CVEs, including CVE-2026-84782 (CVSS 8.2).
• Exploited?: No active exploitation has been reported for these specific OpenSSL bugs.
• Status (Oct 24, 2026): PATCHED in the Sep 29 release.
• What depends on it: Secure connections (HTTPS), VPNs, and internal server communications. Flaws here can expose or disrupt encrypted connections.

Linux Kernel

• What it is: The core operating system for most servers, cloud instances, and network appliances. It is the foundation layer for your backend.
• CVEs / CVSS: Three kernel flaws: CVE-2026-53266 (an out-of-bounds write with a published privilege-escalation proof-of-concept), CVE-2025-39964 (a race condition researchers turned into privilege escalation and container escape) and CVE-2025-39682 (a TLS handling flaw, NVD 9.8, with public exploits).
• Exploited?: Yes. All three were added to the CISA Known Exploited Vulnerabilities (KEV) list on Sep 18.
• Status (Oct 24, 2026): PATCHED; install your Linux distribution’s current kernel update and reboot.
• What depends on it: Your servers, cloud infrastructure, and network devices running Linux. If this breaks, your infrastructure stops responding.

Fortinet (FortiOS / FortiMail)

• What it is: Fortinet makes firewalls and VPNs—the security box at the edge of your network. It is the bouncer at the door.
• CVEs / CVSS: Critical/high fixes for FortiOS (8.0.2, 7.6.8, 7.4.13, 7.2.14), FortiManager and FortiAnalyzer released Oct 22, following earlier FortiMail and FortiAuthenticator releases. Also, FortiMail CVE-2026-104286 (CVSS 9.8) was exploited as a zero-day.
• Exploited?: The Oct 22 batch: no exploitation reported as of Oct 24. FortiMail CVE-2026-104286 was exploited as a zero-day (KEV Oct 1). FortiOS CVE-2025-61624 (CVSS 6.0) was added to KEV on Oct 16; Palo Alto Networks’ Unit 42 says it was exploited to deploy a stealthy FortiGate implant it calls "PEERSTITCH".
• Status (Oct 24, 2026): PATCHES AVAILABLE for the Oct 22 fixes; Fortinet says public advisories come on Nov 10. FortiMail fixed in 8.0.2/7.6.7/7.4.9 (7.2 users must move to 7.4 or later). For CVE-2025-61624, FortiOS 7.6 and 7.4 are fixed in 7.6.5 and 7.4.10; Fortinet tells 7.2, 7.0 and 6.4 users to MIGRATE to a fixed release.
• What depends on it: Your perimeter security, remote access, and email gateway. A compromised firewall or VPN can give attackers a way into your network.

Ivanti Connect Secure

• What it is: A remote-access VPN tool that lets employees log in from home or on the road. It is the bridge between your office and the outside world.
• CVEs / CVSS: CVE-2026-104935 (CVSS 8.6).
• Exploited?: Yes. A zero-day exploited since at least Oct 3, according to Volexity, by a group it tracks as UTA0576. Added to KEV on Oct 13.
• Status (Oct 24, 2026): PARTIALLY PATCHED. The zero-day was fixed Oct 13 (affected: 22.8R2.4 and earlier, 25.1.2.2 and earlier, 25.1.1.1 and earlier). However, Ivanti is still working on a fix for a privilege-escalation flaw the attackers chained with it, so that part remains UNPATCHED.
• What depends on it: Your remote workforce’s ability to connect. If this breaks, your team is locked out.

Citrix NetScaler

• What it is: A remote access and load balancing tool. It directs traffic and manages who gets in.
• CVEs / CVSS: CVE-2026-88771 (CVSS 9.8) and CVE-2026-88772 (CVSS 8.1) are exploited. CVE-2026-88779 (CVSS 7.5) was added to KEV on Oct 4. A newer flaw, CVE-2026-107406 (CVSS v4 9.5), has a separate fix.
• Exploited?: Yes. CVE-2026-88771/88772 were added to KEV on Sep 27.
• Status (Oct 24, 2026): PATCHED in 14.1-73.37 and 13.1-64.23 (CVE-2026-88779 needs 14.1-73.41 or later). CVE-2026-107406 (which affects NetScaler set up for SAML sign-in) has its own Citrix fix; check Citrix’s bulletin for the build you need.
• What depends on it: Your remote desktop and application access. If this breaks, your users can’t reach their work tools.

Palo Alto PAN-OS

• What it is: The operating system for Palo Alto firewalls. It is the brain of your network security.
• CVEs / CVSS: CVE-2026-0322 (NVD CVSS 7.2; vendor 8.6).
• Exploited?: Yes. Palo Alto reports "very limited exploitation"; added to KEV on Oct 14.
• Status (Oct 24, 2026): PATCHED with fixes available; Palo Alto says there are no known workarounds, so restrict the management interface.
• What depends on it: Your firewall rules and traffic filtering. A compromised firewall can expose the network behind it.

Cisco Secure Email Gateway & SD-WAN

• What it is: The email security filter and the software that manages your network topology.
• CVEs / CVSS: Secure Email Gateway CVE-2026-76519 (CVSS 9.8) and Catalyst SD-WAN Manager CVE-2026-76504 (CVSS 9.8).
• Exploited?: Both are exploited. Email Gateway added to KEV Oct 14; SD-WAN Manager added Sep 30.
• Status (Oct 24, 2026): PATCHED for both (for the email gateway, BleepingComputer reports a fix in Content Scanner 25.3.0.5525; see Cisco’s advisory for your release).
• What depends on it: Your email security and network routing. If this breaks, malicious email gets through and your network traffic gets misdirected.

MikroTik RouterOS

• What it is: Routers common in small offices and ISPs. It is the traffic cop for your local network.
• CVEs / CVSS: "MikroTrick" chain: CVE-2026-86060 (CVSS 9.8), CVE-2026-67277 (CVSS 8.2), CVE-2026-67279 (CVSS 6.5).
• Exploited?: Yes. CERT Polska found attackers using them to add a rogue user named "ops", with attack logs dating from Sep 2, before patches were out. Added to KEV on Sep 10 and Sep 25.
• Status (Oct 24, 2026): PATCHED in the MikroTik September 2026 advisory.
• What depends on it: Your internet connection and local network routing. If this breaks, you lose internet and internal connectivity.

Remote-Management Tools

• What it is: Software MSPs and IT teams use to manage devices remotely: BeyondTrust Remote Support, ConnectWise ScreenConnect, and N-able N-central.
• CVEs / CVSS: BeyondTrust CVE-2026-102764 (CVSS 9.8); ScreenConnect CVE-2026-84869 (CVSS 9.9); N-central CVE-2026-86218 (CVSS 9.8).
• Exploited?: Yes. BeyondTrust zero-day used by ARMORY CASTLE, which Google’s threat team calls a PRC-nexus espionage actor, since late August (KEV Oct 16). ScreenConnect added to KEV Sep 11. N-central CVE-2026-86218 added to KEV Sep 8.
• Status (Oct 24, 2026): PATCHED. BeyondTrust patch BT26-05 (SaaS tenants patched Oct 9; self-hosted versions older than 24.3.1 must upgrade first); ScreenConnect fixed in 26.6.5; N-central fixed in 2026.3.1.14.
• What depends on it: Your IT team’s ability to fix issues remotely. If this breaks, you are stuck calling in for every fix.

npm Supply Chain

• What it is: The JavaScript package registry used to build web applications. It is the ingredient list for your web apps.
• CVEs / CVSS: No specific CVEs listed, but two malicious packages: [email protected] (a Shai-Hulud credential-stealing worm, published Oct 8) and @subql/common 5.8.3 (credential stealer).
• Exploited?: Yes. These were shipped with malicious code.
• Status (Oct 24, 2026): MALICIOUS VERSIONS IDENTIFIED. Audit your package.json and lockfiles, remove these versions, and rotate any secrets on machines that installed them.
• What depends on it: Your web applications. A poisoned package can steal credentials from the machines that install it, and worms like Shai-Hulud try to spread to other packages.

AI Tools and the Developer Supply Chain

• What it is: AI coding tools and the package registries that feed them. PyPI is Python’s central store for downloading code libraries; a compromised release or a malicious package can infect every project that installs it. MCP (Model Context Protocol) is the plug-in standard that lets AI assistants connect to outside tools; a bad plug-in can hijack the assistant.

• CVEs / CVSS:

  • LiteLLM: Compromised release 1.107.0 (Oct 21, 2026) could run a credential stealer just by starting Python (per Microsoft). Separately, CVE-2026-59822 (an authentication flaw in its MCP Streamable HTTP endpoint) is in CISA’s KEV (Known Exploited Vulnerabilities) since Sep 2.
  • Langflow: CVE-2026-9198 (unauthenticated code injection) is in KEV (Aug 4). CVE-2026-105740 (NVD 9.9, remote code execution, or RCE, for a logged-in user) fixed in 1.9.0; researchers have recorded 1,706 exploit attempts against decoy servers.
  • AI Coding Agents: JetBrains Junie CLI CVE-2026-111091 (7.8) fixed in 26.8.3. Z.ai ZCode CVE-2026-88755 (7.8) has no known fix. OpenCode, an AI coding agent, had a Windows/WSL code-execution flaw triggered by a malicious MCP server during sign-in; researchers at Pillar rate it critical (proposed 9.8). It was fixed in 1.18.33 (Sep 28) with no CVE or advisory, so scanners won’t flag affected builds 1.0.137 through 1.18.32.
  • PyPI: Malware package "leakdeep" (advisory Oct 18) steals Chrome, Edge and Brave passwords and cookies on Windows.

• Exploited?: Yes for LiteLLM (poisoned release; CVE-2026-59822 in KEV), Langflow (CVE-2026-9198 in KEV; 1,706 attack attempts on CVE-2026-105740 against decoy servers) and leakdeep (live malware). No in-the-wild attacks reported for the Junie, ZCode or OpenCode bugs. The Junie and ZCode flaws can run attacker code when a booby-trapped project is opened (a public proof-of-concept exists for ZCode); the OpenCode flaw is triggered by a malicious MCP server.

• Status (Oct 24, 2026): MIXED: ZCODE UNPATCHED.

  • LiteLLM: Compromised 1.107.0 published Oct 21; CVE-2026-59822 in KEV.
  • Langflow: CVE-2026-9198 in KEV; CVE-2026-105740 fixed in 1.9.0.
  • Junie: Fixed in 26.8.3.
  • ZCode: No fix known.
  • OpenCode: Fixed in 1.18.33 (no CVE, so scanners miss it).
  • PyPI: leakdeep reported Oct 18 (GitHub advisory GHSA-4pw5-gqh4-v2pj); anyone who installed it should change saved browser passwords.

• What depends on it: Developers building AI assistants, coding agents, and Python projects. If your team uses AI coding tools or installs Python packages, a single bad package or plug-in can steal cloud keys, saved browser passwords and SSH keys.

What You'd Recognize: Everyday Tools Sitting on That Plumbing

You don't think about the plumbing. You think about the website, the email, the phone, the router. But every one of those sits on layers of code that got urgent fixes this season.

WordPress websites

If you run WordPress, you're running PHP. The "PHP2Shell" bugs (CVE-2026-109618, 9.8) let attackers execute code on your site without logging in. PHP is patched (8.5.12, 8.4.27, 8.3.36, 8.2.35), but a new bug (CVE-2026-115560) is still unpatched and only affects unusual configurations. WordPress itself had its own exploited core flaw, CVE-2026-87902 (NVD 8.1), patched Sep 22 in 7.1.2; scanning started less than five hours after the patch, and attackers are now trying to deliver payloads.

Windows & Microsoft 365 / SharePoint

Windows 11 version 24H2 Home and Pro reached end of support on October 13, 2026. Microsoft's October Patch Tuesday (Oct 13) fixed 1,411 flaws, including three zero-days; one, in the Windows Shell (CVE-2026-96951, 8.8), is on CISA’s exploited list. If you run on-premises SharePoint, a separate exploited bug (CVE-2026-65660, 8.8) was fixed in August updates.

Chrome & Apple iPhones

Your browsers and phones are the front door. Chrome's V8 engine had two exploited flaws (CVE-2026-85046 and CVE-2026-87491, both 8.8), fixed in Chrome 152.0.7977.82 and 153.0.8010.36 respectively; Proofpoint says state-aligned groups used 85046 in a "BlueMoon" exploit chain. On Apple devices, an exploited CoreGraphics bug (CVE-2026-86950, 8.8) was fixed in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1; a public proof-of-concept uses a malicious PDF with a crafted font.

Your office VPN/firewall

The box at the edge of your network is the first thing attackers hit. Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on Oct 22 (public advisories due Nov 10), on top of an exploited FortiMail zero-day (CVE-2026-104286) fixed earlier in October. Ivanti Connect Secure had a zero-day (CVE-2026-104935, 8.6) exploited since at least Oct 3, patched Oct 13, though one chained flaw is still unpatched. Citrix NetScaler had two exploited bugs (9.8 and 8.1) fixed in 14.1-73.37. MikroTik routers (common in small offices) had a chain of bugs ("MikroTrick") that attackers used to add a rogue user; these are fixed in the September 2026 advisory.

Plex and home-office servers

If you run Plex Media Server, the "Plex2Shell" chain of four bugs (CVE-2026-96652, -96654, -96655 and -96656) was added to CISA's exploited list on Oct 20. It's fixed in version 1.43.3.10861.

Status Board: Where Every Major Flaw Stands on October 24, 2026

CVSS scores are NVD v3.1 base scores unless noted. "KEV" = CISA Known Exploited Vulnerabilities catalog (version 2026.10.23).

What Small Businesses Should Do This Week

Small business cyber risk this fall is about speed: attackers move within hours of a flaw going public. Here are seven concrete steps for this week. If you have an IT person or provider, forward them this list.

1. Update and hide your network edge. Ask your IT provider to install the critical patches for Fortinet (FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14) and Ivanti Connect Secure (patched Oct 13). If you use Citrix NetScaler, update to at least 14.1-73.37 or 13.1-64.23, plus the build Citrix lists for CVE-2026-107406 if you use SAML sign-in. Crucially, ensure the admin pages of these firewalls and VPNs are not exposed directly to the internet; if they are, restrict access to known office IPs.
2. Patch your website and set a PHP safety switch. If your site runs on PHP or WordPress, update to the latest versions (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; WordPress 7.1.2). For the new unpatched PHP bug (CVE-2026-115560), ask your developer to set session.upload_progress.enabled=0 in your PHP configuration until the next PHP release fixes it.
3. Install the October Microsoft updates. Apply the October 13 Patch Tuesday updates, which fixed 1,411 flaws, including an exploited Windows Shell flaw. If any PCs still run Windows 11 version 24H2 Home or Pro, upgrade them to a supported Windows 11 version; 24H2 Home/Pro reached end of support on Oct 13.
4. Audit your Microsoft 365 app access. The ConnectWise SkyKick incident showed that stolen credentials for a trusted third-party app can sign in without any user’s password or multi-factor authentication (MFA). Log into your Microsoft 365 admin portal and review which third-party apps have access to mailboxes, OneDrive, and SharePoint. Disable or remove any app you do not actively use. If you use ConnectWise SkyKick (Cloud Backup), keep its apps disabled until ConnectWise restores them, and have your provider review those apps’ sign-in activity and any new app credentials added since October 13. If your developers use Railway, Zeabur or LiteLLM, rotate every key stored there.
5. Update your browsers and phones. Update Google Chrome to the current version (fixes for the two exploited V8 flaws shipped in 152.0.7977.82 and 153.0.8010.36) and relaunch it. Update iPhones and iPads to 26.7.1 or later to patch the exploited CoreGraphics bug.
6. Enforce two-step login and check for rogue admins. Turn on multi-factor authentication for every user account. Then look for unknown admin or user accounts, like the "ops" user attackers added to MikroTik routers in the "MikroTrick" attacks.
7. Watch for healthcare breach fallout. If you use Quest Diagnostics or other providers hit this season, watch for notification letters. Be suspicious of emails claiming to have "lab results" or billing issues. Anyone whose Social Security number may have been exposed, for example in the CenterPoint Energy breach, should consider a free credit freeze with all three credit bureaus.

Let MainSail Data Carry This for You

MainSail Data, based in Vero Beach, Florida, handles the heavy lifting so you don't have to. Our MainSail Cyber service watches every laptop, desktop and server around the clock; a machine that starts behaving like ransomware is cut off from the network in seconds and cleaned up remotely. MainSail ITDR watches every Microsoft 365 sign-in, account and connected app around the clock. In the ConnectWise SkyKick incident, MainSail Cyber disabled the compromised app’s access in affected tenants automatically. We use SkyKick for Microsoft 365 backups ourselves, and after checking every client tenant, none of our clients were affected. And MainSail SOC adds a 24/7 security operations center (SOC), people watching for attacks around the clock, so that when the next zero-day (a flaw attacked before a fix exists) hits, someone is already watching.

Get a free security assessment →

Questions first? Call (772) 794-1194 or send us a message. We’re local, in Vero Beach.

Sources & Related Tasks

Every claim above traces to one of these sources. Each one comes with the task it points to.

Breaches of the last 30 days - Quest Diagnostics: Quanum notice, Quest SEC Form 8-K, TechCrunch, AP and The Record. Task: medical practices using Quanum should reset LSM credentials; everyone should watch for breach letters and lab/billing-themed phishing. - Microsoft Security: Storm-0940 and the ConnectWise supply-chain compromise, The Hacker News: compromised ConnectWise SkyKick app, The Hacker News: ConnectWise resets credentials (researchers’ findings), Sophos and ConnectWise advisories. Task: review every third-party app with access to your Microsoft 365. - Railway preliminary incident report and TechCrunch. Task: rotate every secret stored on Railway. - Gira: October 2026 breach roundup (Zeabur). Task: rotate every secret stored on Zeabur. - BleepingComputer: IDCF Cloud ransomware. Task: keep a backup copy outside your main cloud provider. - SecurityWeek: CenterPoint Energy breach and KPRC Click2Houston. Task: freeze credit if you get a notice. - BleepingComputer: McKesson breach and HIPAA Journal: Baylor Genetics. Task: train staff to hang up on "IT help desk" calls and call back on a known number.

AI tools & developer supply chain - Microsoft Security: LiteLLM 1.107.0 compromise. Task: find and remove LiteLLM 1.107.0, then rotate credentials. - The Hacker News: Langflow RCE exploitation. Task: upgrade Langflow to 1.9.0+. - The Hacker News: OpenCode MCP flaw and ThreatFrontier: Junie CLI and ZCode. Task: update AI coding agents and don't open untrusted repos in ZCode. - GitHub advisory: leakdeep (PyPI). Task: check developer machines for the package.

Data - NIST NVD CVE API 2.0 (pulled Oct 24, 2026). Task: use it to check any CVE on your equipment list. - CISA Known Exploited Vulnerabilities catalog (v2026.10.23). Task: check it against your firewall, VPN and server inventory every week.

Web stack (PHP / WordPress) - CISA: Critical vulnerabilities in PHP require immediate patching. Task: upgrade PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. - BleepingComputer: PHP shares mitigation for new, unpatched RCE. Task: set session.upload_progress.enabled=0. - CERT-EU Advisory 2026-018. Task: confirm your hosting provider has patched PHP. - BleepingComputer: Hackers exploit critical WordPress flaw. Task: confirm WordPress is on 7.1.2 or a patched backport. - CSA Singapore AL-2026-128. Task: review the WordPress hardening guidance.

Firewalls, VPNs & edge devices - Fortinet: Security hardening release. Task: upgrade FortiOS to 8.0.2 / 7.6.8 / 7.4.13 / 7.2.14. - Cybernews: Fortinet says patch now, CVEs come later. Task: take Fortinet management interfaces off the internet. - FortiGuard FG-IR-26-122 (CVE-2025-61624). Task: migrate any FortiOS 7.2 / 7.0 / 6.4 unit to a fixed release. - FortiGuard FG-IR-26-175 (FortiMail) and BleepingComputer coverage. Task: update FortiMail to 8.0.2 / 7.6.7 / 7.4.9. - Unit 42: PEERSTITCH malware. Task: check Fortinet devices for signs of compromise, not just missing patches. - CISA: Ivanti Connect Secure exploited, BleepingComputer and Rapid7. Task: patch Ivanti, then run its integrity checker. - Canadian Cyber Centre AL26-024 (Citrix), Citrix CTX697096 (CVE-2026-88771/88772) and CISA Citrix alert, updated for CVE-2026-107406. Task: install the fixed NetScaler builds, including the CVE-2026-107406 fix if you use SAML. - Palo Alto CVE-2026-0322 and BleepingComputer. Task: upgrade PAN-OS and limit management access to trusted IPs. - Cisco Secure Email Gateway advisory and BleepingComputer. Task: update AsyncOS or Content Scanner. - MikroTik September 2026 advisory and CERT Polska "MikroTrick" analysis. Task: update RouterOS and delete any unknown "ops" user.

Core libraries & operating systems - OpenSSL security announcement (Sep 29). Task: apply OS and appliance updates that include the new OpenSSL builds. - CISA: Linux kernel KEV additions and BleepingComputer. Task: update kernels and reboot your Linux servers. - MSRC CVE-2026-96951, BleepingComputer: October 2026 Patch Tuesday and NHS Cyber Alert CC-4867. Task: confirm every PC installed the October updates. - MSRC CVE-2026-65660 (SharePoint) and SecurityWeek. Task: patch on-prem SharePoint or move to Microsoft 365. - NVD CVE-2026-85046, NVD CVE-2026-87491, BleepingComputer: Chrome zero-day and Proofpoint: BlueMoon. Task: relaunch Chrome on every machine. - Apple security update and The Hacker News. Task: update company iPhones and iPads to 26.7.1 or later.

Remote-management tools & supply chain - CISA: BeyondTrust Remote Support and Google Threat Intelligence: ARMORY CASTLE. Task: apply BT26-05 to self-hosted instances (older than 24.3.1 must upgrade first). - ConnectWise ScreenConnect bulletin. Task: update to 26.6.5 or later and remove any unknown remote-access tools. - BleepingComputer: Plex2Shell and Censys advisory. Task: update Plex to 1.43.3.10861 or later. - tensorlake GitHub advisory, StepSecurity and Flatt Security: @subql/common. Task: audit lockfiles and rotate developer secrets.

Critical infrastructure - Reuters: Foreign hackers targeted two Colorado water systems. Task: if you run OT or building systems, take them off the internet. - FBI: Actors targeting water-sector PLCs. Task: change default PLC passwords and add VPN-only access. - Comparitech: Healthcare ransomware Q3 2026. Task: test offline backups at medical and dental practices. - WSB-TV: Georgia Power customer data breach. Task: watch for utility-themed phishing. - CISA ICSA-26-295-17 (Siemens Industrial Edge) and ICSA-26-295-13 (Siemens WinCC) and NVD CVE-2026-12655 (Rockwell ArmorBlock). Task: have your OT vendor confirm the patch status.