Cybersecurity researchers are calling it one of the roughest stretches for internet infrastructure in recent memory. Between the start of October and October 22, 2026, a certificate authority’s keys were found to include the number 4, a 321,810-account breach took down an entire hosting platform, California’s school system was hit by a mass data theft, and two of the most widely used pieces of web infrastructure software — GitLab and NGINX — shipped emergency fixes for maximum-severity flaws.
1. PHP needed an emergency patch urgent enough to draw in a prime minister and the FBI
On October 21, the PHP Foundation rushed out PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical, CVSS-9.2 remote-code-execution bugs (CVE-2026-109618 and CVE-2026-109619) sitting in PHP’s core memory-management and error-handling code — paths that nearly every PHP request passes through, with working exploits demonstrated against both Apache/mod_php and PHP-FPM setups. The Foundation moved its release up by nearly a day after the CVE numbers leaked online, and one of the firms that had responsibly reported the bugs accidentally published a proof-of-concept demo video before taking it down. PHP still runs an estimated 70% of the web’s backends. The severity pulled in unusually high-level reactions: Japanese Prime Minister Sanae Takaichi posted a direct appeal on X urging businesses to patch immediately or temporarily take sites offline, a post that drew more than 23 million views within hours, and the FBI’s Cyber Division account posted similar guidance, naming both CVEs directly. More on how the bug was found and why it took until 2026 to fix — it traces back to a 2024 security audit where the warning signs were first spotted but no one could yet prove it was exploitable.
2. eMudhra’s certificate authority keys were astonishingly weak — one was the number 4
On October 17, a researcher found that eight intermediate certificates issued by Indian certificate authority eMudhra had private keys so weak they could be recovered almost instantly. One key, security researcher Scott Helme discovered, was simply the number 4; others were 56, 66, 115, 155, 156, 230, and 237 — tiny integers standing in for what should have been random 384-bit numbers. Anyone holding one could have forged a trusted certificate for any website. eMudhra traced the flaw to a botched April 2025 key-generation ceremony, and Mozilla, Google, and Apple all moved to block the affected certificates.
3. Railway, a hosting platform used by millions of developers, had customer secrets stolen
On October 21, cloud deployment platform Railway disclosed that an attacker had accessed the systems storing customers’ environment variables and, for some, decrypted the contents — API keys, database credentials, private registry logins. Railway paused all deployments platform-wide and said the intrusion appeared to be “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” Stolen Anthropic and Stripe keys were reportedly used within hours; one developer’s crypto wallet was drained of roughly $371,000.
4. Zeabur was breached a second time — then announced it’s shutting down
On October 14-15, hosting platform Zeabur suffered its second major breach in three months, after attackers used leaked internal AWS and admin credentials to reach its secrets management service and platform database. The company confirmed 321,810 user accounts and over 3.2 million stored environment variables were exposed. On October 18, founder Yuanlin Lin announced Zeabur is winding down entirely, citing the second incident alongside growth and architecture problems.
5. California public school student data — including disability status — was stolen
On October 16, the California Department of Education disclosed that a hacker had accessed data on every student enrolled in the state’s public schools over the past three school years, plus students who left since 2006, via a breach at testing contractor Educational Testing Service (ETS). The stolen records include names, birth dates, addresses, demographic details, and disability and Section 504 accommodation status for a population California put at 5.7 million-plus students. Social Security numbers were not taken.
6. GitLab patched a maximum-severity, unauthenticated remote code execution flaw
On October 12, GitLab shipped emergency fixes for CVE-2026-97229, an integer overflow in its CI/CD regex compiler that scored a perfect 10.0 on the CVSS scale — letting an attacker with no account execute code on a GitLab server just by submitting a crafted CI/CD configuration. It was the third CVSS-10 GitLab vulnerability disclosed in a matter of weeks. Railway’s own security breach, disclosed days later, is a reminder of how often developer infrastructure is now the target rather than the end website.
7. A hacker used AI agents, not a hacking crew, to break into 100+ companies
Reuters reported on October 19 that a cybersecurity researcher at NorForge watched a Chinese-speaking hacker breach more than 100 corporate websites — including Deere, SharkNinja, and Cummins — almost entirely through autonomous AI agents running on an open-source platform called Cairn. The operator’s instructions were reportedly fewer than 100 characters long; the researcher estimated each successful break-in cost around $50 in AI compute. It follows a similar AI-agent campaign reported in September that stole over 600,000 credit card records from 25 companies.
8. Ahold Delhaize’s Food Lion and Stop & Shop websites were taken offline
Supermarket giant Ahold Delhaize — parent of Food Lion, Stop & Shop, Hannaford, and Giant Food in the US, and Albert Heijn and Delhaize in Europe — took systems offline on October 12 after confirming “malicious actions” on its network. Online ordering and loyalty programs across both continents went dark for days. It’s the company’s second major cyber incident in under a year; a November 2024 attack affected more than 2 million US customers.
9. NGINX, which powers roughly a third of the web, had three critical flaws patched
On October 14, F5 disclosed three critical NGINX vulnerabilities (CVSS 9.2 on the 4.0 scale) involving heap buffer overflows and a use-after-free bug in the core HTTP module — all exploitable remotely, without authentication, to crash server processes. NGINX released patched versions the same day. No public exploit has surfaced, but given how much of the web runs on NGINX, the patch window mattered.
10. Stolen WordPress plugin-dashboard keys were used to backdoor sites
Starting October 18, an attacker holding valid dashboard keys for the popular UpdraftCentral WordPress management tool began installing backdoor plugins on connected sites, researchers at Patchstack found. Because the attacker authenticated with legitimate stolen keys rather than exploiting a bug in the software, there was no patch to apply — site owners had to delete and regenerate their UpdraftCentral keys instead. Patchstack logged 99 distinct backdoor plugin names during an 18-hour window.
11. Ransomware gangs kept breaking into networks through Palo Alto firewalls
Threat intelligence firm ReliaQuest warned on October 9 — and researchers reconfirmed as recently as October 18 — that ransomware groups Qilin and Settra are still actively exploiting CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass first patched in May, to slip into corporate networks disguised as normal VPN traffic. Palo Alto’s own Unit 42 and multiple independent researchers have all flagged ongoing exploitation months after the fix shipped — a reminder that patching a flaw doesn’t mean it stops being used.
12. Staffing software platform Bullhorn was knocked offline by a cyberattack
Bullhorn, whose recruitment and staffing software is used by thousands of agencies, took its platform offline on October 17-18 after confirming a “cyber incident” caused a system-wide outage. The company said a forensic investigation was underway and that it had not yet determined whether customer data was exfiltrated; core services weren’t fully restored until October 19.
13. OVHcloud’s own command-line tool was briefly compromised
European cloud provider OVHcloud confirmed on October 19 that a GitHub repository for its official command-line interface (CLI) — the tool customers use to manage their cloud services — was compromised after an employee’s GitHub account was taken over, and a malicious version was published. OVHcloud said the tampered release was caught and pulled within 94 minutes, limiting the blast radius to a handful of users.
14. A hacker claims to have breached India’s largest bank
A threat actor calling itself “Siriusim” posted on the forum BreachForums, claiming to hold roughly 375,000 customer records and 2,722 documents from the State Bank of India, India’s biggest bank by assets. Independent verification by The Free Press Journal found that phone numbers in a handful of sample records were active and matched real KYC photos — but as of this writing, SBI has not confirmed a breach, and the claim’s full scope and authenticity remain unverified.