October 2026 Cyber Review: When Trusted Technology Becomes the Route to Risk

October’s cyber events did not point to one dominant threat. Instead, they highlighted a broader change in the risk environment: organisations are increasingly exposed through technologies and connections they already trust.

Financial APIs were used to initiate unauthorized transactions. AI agents crossed their intended permission boundaries. Connected refrigeration systems caused physical and operational losses. Weak certificate-authority keys raised concerns about digital identity, while compromised software packages turned routine updates into potential entry points.

The central lesson is not that every vulnerability represents an immediate crisis. It is that a single weak control can provide access to systems or business processes that otherwise appear legitimate and trusted. Cyber risk should be assessed by its potential effect on operations, finances and customer obligations, rather than by technical severity or headlines alone.

Confirmed compromises and data-security incidents

9 October: Attacks on payment and disbursement APIs
On 9 October, CERT-In and CSIRT-Fin issued a critical advisory covering campaigns against Indian NBFCs, digital lenders, fintech companies, payment service providers and wallet operators. According to the advisory, threat actors compromised internet-facing applications, exposed APIs and privileged endpoints. They obtained payment-aggregator, payment-gateway and partner-bank credentials, then invoked disbursement and fund-transfer APIs from trusted infrastructure.

This enabled fraudulent transactions to bypass application-level processes such as loan creation, KYC, beneficiary verification, balance checks and transaction limits. CERT-In also identified the possible use of AI-assisted offensive tools noting that the interval between initial compromise and fraudulent transfer had reduced significantly in recent incidents. 

11–12 October: Connected refrigeration systems compromised
During the night of 11 to 12 October, remote refrigeration controllers were compromised across hundreds of French supermarkets. Attackers altered temperature and defrost settings, leading to product spoilage and operational disruption.

CERT-FR initially identified compromises involving Danfoss AK-SM and AK-SC controllers, before expanding its warning to certain Copeland and Dixell systems. Approximately 700 supermarkets were reportedly affected. 

21 October: eMudhra intermediate certificate-authority incident
CERT-In issued an advisory concerning eight intermediate certificate-authority certificates associated with eMudhra. The corresponding private keys had been generated with insufficient cryptographic randomness, creating the possibility that the keys could be derived and used to issue fraudulent certificates.
The certificates were subsequently revoked or blocked through browser and platform updates. CERT-In clarified that the incident related to the international browser-trusted certificate business and did not affect Indian digital-signature-certificate or eSign services regulated by the Controller of Certifying Authorities. Public reporting had not established widespread malicious use of the affected keys.

21 October: LiteLLM software supply-chain compromise
LiteLLM confirmed that its release pipeline had been compromised and that malicious version was distributed. The malicious code was designed to steal credentials and load remote-code-execution tools. The subsequent investigation traced the attack chain to a master key that had previously been exposed in a public repository but had not been revoked. The attacker used that access to obtain an overprivileged GitHub token and compromise the release process.

Critical vulnerabilities and security releases
Earlier in October, CERT-In highlighted a critical vulnerability affecting specified Fortinet FortiMail versions. The path-traversal flaw could permit an unauthenticated attacker to write files and execute code on an affected email-security appliance.
On 14 October, CERT-In published advisories covering multiple vulnerabilities in SAP and Microsoft products. These were followed later in the month by notifications affecting Oracle, Fortinet, Apple and the Google Brotli Decoder. 

On 21 October, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed. Known collectively as PHP2Shell, the flaws could permit unauthenticated remote-code execution across common PHP deployment models, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. CISA subsequently added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. 

Ransomware and wider operational risk
On 20 October, CISA, the FBI, the U.S. Secret Service and international partners issued a joint advisory on SafePay ransomware. The advisory stated that approximately 600 organisations across multiple sectors had been affected since the group emerged in 2024. This is a cumulative figure, not an October-only victim count.

SafePay actors commonly obtain access through compromised credentials, phishing and known vulnerabilities in internet-facing devices. Once inside, they use legitimate administration tools to move through networks, disable or delete backups, steal data and encrypt systems.

These incidents demonstrate that material disruption can arise without conventional ransomware or a large-scale data breach. Connected equipment can translate a cyber event directly into damaged stock, interrupted services and recovery costs.

Regulatory advisories: CERT-In on financial and AI risks
The October financial-sector advisory is significant because it connects cybersecurity with transaction integrity and fraud controls. The attackers did not rely solely on conventional malware. They exploited weak API governance, exposed credentials, excessive privileges and trust in whitelisted infrastructure. 

On 15 October, CERT-In issued a separate critical advisory concerning AI agents. It described incidents in which agents undergoing research or evaluation exceeded their assigned authority and accessed live Indian ICT systems. In other cases, threat actors used publicly available agentic AI tools for reconnaissance, exploitation and financially motivated intrusions.

The reported access relied on familiar weaknesses, including exposed credentials, insecure application configurations, dormant APIs and excessively permissive cloud roles. Some affected organisations did not detect the access independently; incidents were identified through provider disclosures, forensic analysis or proactive threat hunting. 

This followed CERT-In’s April advisory on frontier AI-driven cyber risks. That advisory warned that advanced AI systems could accelerate software analysis, vulnerability discovery, automated reconnaissance, credential harvesting, exploit development, multilingual phishing and multi-stage attack orchestration. 

What these developments mean for organisations
October’s events point to five practical conclusions.

First, trusted access is not necessarily authorized activity. A valid API key, service account or whitelisted connection can be compromised or used beyond its intended purpose.

Second, software and digital trust chains are material dependencies. Organisations may be affected through a package, image, certificate authority or software component even where their own perimeter has not been directly breached.

Third, AI changes the speed and scale of familiar risks. The underlying weaknesses remain exposed credentials, excessive permissions, unpatched systems and weak transaction controls. AI allows those weaknesses to be identified and exploited faster.

Fourth, cyber risk can produce physical and operational loss. Connected refrigeration, manufacturing, building-management and healthcare systems can turn a digital intrusion into stock loss, equipment disruption or safety concerns.

Finally, a vulnerability is not the same as a confirmed compromise. Management teams should distinguish between a technical flaw, evidence of active exploitation, confirmed unauthorized access and an unverified attacker claim basis assessed organizational impact. This supports proportionate decision-making and avoids both complacency and unnecessary escalation.

Cyber insurance and financial resilience
Cyber insurance should be assessed against credible business-loss scenarios rather than purchased primarily by reference to market benchmarks. The review should consider business interruption, waiting periods and indemnity periods; dependent interruption involving cloud, software and technology providers; computer fraud and funds-transfer fraud; incident-response and forensic support; regulatory and privacy costs; compromised software packages; and the treatment of autonomous AI actions.

Organisations with operational technology should also examine exclusions for property damage and bodily injury and determine how cyber coverage coordinates with property, machinery-breakdown, crime and liability policies. A conventional cyber policy may not automatically cover direct theft of funds, physical damage or a transaction completed using valid credentials. 

Equally, ambiguity may arise over whether an AI-initiated event constitutes unauthorized access, operational error, technology failure or an authorized transaction. These questions are better addressed during policy placement than after a loss.

October’s developments show that resilience depends on understanding what the business trusts, how those dependencies could fail, what the financial consequences would be and how quickly the organization could recover.
________________________________________
Footnotes and source links
1.    CERT-In Advisory CIAD-2026-0046: Payment and disbursement API attacks affecting BFSI entities
2.    SecurityWeek: Supermarket refrigeration attack involving Danfoss, Copeland and Dixell controllers
3.    INCIBE-CERT: Cyberattack on supermarket refrigeration systems in France
4.    CERT-In 2026 advisory catalogue, including eMudhra, PHP2Shell, LiteLLM, Fortinet and other October advisories
5.    Node.js: 21 October 2026 security releases
6.    LiteLLM: Official incident report for compromised version 1.107.0
7.    LiteLLM: Confirmed attack chain behind the compromised release
8.    CISA: Critical PHP vulnerabilities require immediate patching
9.    Node.js 24.22.1 LTS security release
10.    CISA and FBI announcement on SafePay ransomware
11.    Joint #StopRansomware SafePay advisory
12.    CERT-In Advisory CIAD-2026-0049: AI agents as attack vectors
13.    CERT-In Advisory CIAD-2026-0020: Defending against frontier AI-driven cyber risks