Black October 2026: The Biggest Hacks of the Month and What They Mean for Your Business

lack October 2026 turned Cybersecurity Awareness Month into a wake-up call. Every October the security industry focuses on awareness, yet this year attackers set the agenda. Within a few weeks a wave of AI-discovered software flaws, vendor breaches, and record-setting thefts led experts to rename the month “Black October.” Rob Joyce, former head of the NSA’s cyber division, captured the shift when he warned that the “transition from vulpocalypse to breachpocalypse is here.”

Most headlines featured large names such as Binance, ConnectWise, and Capcom. Almost every incident still carries direct lessons for small and midsize businesses. The same tools, vendors, and shortcuts that failed at the top of the market sit inside SMB networks today. Here’s what happened during Black October, what the patterns reveal, and what organizations should do about it.

The Biggest Hacks of Black October 2026

This is not every incident from the month. These are the events with the widest reach, each confirmed by the company involved, a government agency, or published security research.

• FortiBleed (Oct 6): The FBI and U.S. Secret Service warned that FortiBleed, a credential-theft campaign against Fortinet FortiGate firewalls and VPN gateways, remained active. Their advisory cites SOCRadar’s count of more than 86,644 compromised devices across 194 countries. Attackers relied on reused and leaked passwords, and the agencies noted the campaign has served as an entry point for ransomware affiliates.
• SonicWall SMA1000 (Oct 6–9): SonicWall disclosed a maximum-severity (CVSS 10) flaw in its SMA1000 remote-access appliances, and attackers were going after it within days. It was the third critical SMA1000 problem in three months.
• IDCF Cloud ransomware (Oct 7): A ransomware attack took down part of IDC Frontier’s IDCF Cloud in Japan, affecting 495 companies and local governments. The attacker claimed it wiped 554,153 snapshots—the copies many customers would have relied on for recovery.
• AI-driven attacks on South Korean banks (early October): A Chinese-speaking attacker used ARTEX, an AI penetration-testing framework, together with Claude agents to target South Korean banks including Shinhan, KB Kookmin, and Hana. The campaign exposed customer data and caused outages. CrowdStrike confirmed the use of ARTEX.
• A record Patch Tuesday (Oct 13): Microsoft fixed a record 1,411 vulnerabilities, including a Windows Shell zero-day already being exploited, and Windows 11 version 24H2 Home and Pro reached end of support.
• ConnectWise Cloud Backup and Storm-0940 (Oct 15–21): Attackers used the identities of ConnectWise’s Microsoft 365 backup apps to enter customer tenants. Huntress confirmed at least 162 compromised tenants in the first days. Microsoft later attributed the campaign to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to attempt sign-ins against more than 2,250 tenants. In some cases the group gained privileged access less than three hours after first targeting a victim.
• TeamUpdraft / UpdraftPlus (Oct 17–18): Attackers breached the company behind UpdraftPlus, a WordPress backup plugin with more than four million active installations. They stole connection keys for its remote-management service and used them to plant malicious plugins on connected websites.
• Cairn AI agents (reported Oct 19–20): Researchers at NorForge observed a Chinese-speaking hacker using Cairn, an open-source AI platform, to compromise the websites of more than 100 companies. Reuters identified victims including John Deere, SharkNinja, and a website operated by a Cummins vendor.
• Capcom (Oct 19–22): The game publisher confirmed attackers breached its CAPCOM ID membership service and exposed more than 11.7 million customer email addresses.
• PHP2Shell (Oct 21–26): PHP released emergency patches for two critical flaws that allowed attackers to take over web servers without authentication. Amazon observed exploitation attempts four days before the patches existed. On October 26 CISA added both flaws to its Known Exploited Vulnerabilities catalog. PHP powers an estimated 70% of websites.
• LiteLLM (Oct 21): Attackers hijacked the release pipeline of LiteLLM, a popular open-source AI gateway with 92 million monthly downloads, and published a version that stole cloud keys, AI credentials, SSH keys, and saved browser passwords.
• Binance (Oct 29): Attackers moved approximately $6.36 billion out of Binance wallets, most of it in roughly 20 minutes. Blockchain analysts called it the largest crypto theft on record, and the FBI attributed the incident to North Korea.

What the Trend Shows

Black October was not a single coordinated campaign. It was a cluster of separate incidents that repeatedly failed in the same places.

Trusted vendors became the primary entry point. ConnectWise’s backup apps, TeamUpdraft’s management keys, LiteLLM’s release pipeline, and a Cummins vendor’s website were all trusted connections. In the ConnectWise case, researchers at Todyl found the attacker signed in as the backup application itself, so multi-factor authentication never triggered. As one expert told CSO Online, “an application you stopped using a year ago may still have permissions in your environment today.” We covered this pattern in our posts on the ConnectWise Microsoft 365 breach and the TeamUpdraft breach.

The firewall became the front door. FortiBleed and SonicWall both targeted the devices businesses rely on to keep attackers out. FortiBleed in particular showed that a password reused on a VPN or firewall can be as dangerous as an unpatched vulnerability.

The patch window has collapsed. PHP2Shell was being probed before its patch existed, and SonicWall exploitation began within days of disclosure. Microsoft’s record Patch Tuesday demonstrated that the volume of fixes continues to rise. Waiting for next month’s maintenance window is no longer a viable plan.

Backups turned into targets rather than safety nets. Two of the month’s biggest stories involved backup tools, and the IDCF attacker claimed to have wiped hundreds of thousands of snapshots. A backup stored inside the same platform that gets breached may not be available when recovery is needed.

Smaller targets are now worth the effort. Japanese security firm Macnica logged 119 data-exposure incidents in Japan by early October, compared with 84 in all of 2025. Its researcher told BleepingComputer that probing individual websites once took too much time to justify attacking small targets; inexpensive AI tools appear to be changing that calculation.

How Hackers Are Using AI Now

For the past year, AI-driven attacks remained mostly a forecast. During Black October 2026 they became documented case studies.

AI agents are now running entire intrusions. Storm-0940 used the ARTEX framework to automate attacks against hundreds of organizations. Microsoft reported that most of the targeting failed, yet the group still reached privileged cloud access at many organizations in a short time. The Cairn operator issued AI agents short instructions—fewer than 100 Chinese characters—and allowed them to probe e-commerce sites for hours independently. NorForge estimated the campaign consumed about $5,000 worth of AI tokens, or roughly $50 per successful compromise. CrowdStrike separately documented four threat groups employing autonomous AI agents in real intrusions. Detectify CEO Rickard Carlsson told Dark Reading that “AI is changing the economics of cyberattacks more than the techniques themselves.”

AI is also finding the bugs. Axios reported that OpenAI’s agents discovered the critical flaws in PHP and in the Brotli compression library. That development ultimately helps defenders, yet in the short term it means more critical patches arrive faster than many organizations can install them.

AI is sharpening social engineering. The Binance theft did not begin with a technical exploit. According to Binance, the months-long campaign included a fake job interview: an engineer was approached on a legitimate job platform, interviewed by video, and instructed to download a “coding assignment” that was actually malware. Binance stated the attackers later used an internal AI tool to reach wallet engineers’ computers. KnowBe4 told Dark Reading it has tracked a 228% increase in AI brand impersonation since April. 1Password’s Dave Lewis noted that attackers are constructing voice deepfakes from executives’ public recordings and deploying them in high-pressure help-desk calls.

There is some good news. Axios reports that millions of attempts to exploit PHP2Shell produced relatively few successful attacks, partly because the flaws were hard to weaponize and partly because defenders moved fast. AI makes attackers faster and cheaper, but it still depends on the same weaknesses: exposed systems, reused passwords, over-permissioned apps, and slow patching. Our November Digital Defense Digest, “When the Attacker Is an AI,” goes deeper on agentic threats and how to brief your board.

What Small Businesses Should Do Now

• Inventory every third-party application connected to Microsoft 365 or Google Workspace. Remove the ones no longer in use and reduce permissions on the rest. Treat each application like a privileged account.
• Ask your IT provider and website host direct questions: Which PHP version is our site running? Were we connected to ConnectWise Cloud Backup or UpdraftCentral? Have the October patches been applied?
• Lock down firewalls and VPNs. Reset administrator and VPN passwords, require phishing-resistant MFA, and remove internet-facing management access wherever possible.
• Patch internet-facing systems on a days-long cycle rather than a monthly one, starting with anything listed in CISA’s Known Exploited Vulnerabilities catalog.
• Keep at least one backup copy outside your primary cloud provider and your backup vendor, make it immutable or offline, and test a real restore.
• Protect API keys and passwords with the same care given to cash. Rotate any key that may have been exposed and never leave secrets in code, shared files, or abandoned projects.
• Train your team on AI-powered social engineering: fake recruiters, deepfake voices, urgent “payment update” emails, and help-desk calls asking for MFA resets. Verify by calling back a number you already have.
• Decide in advance who has authority to isolate a system or revoke an account at 2 a.m. Attacks that unfold in hours require a response plan that can match that speed.

How Black Belt Jutsu Helps You Stay Out of the Headlines

The central lesson of Black October is that tools alone do not keep organizations safe. In several of these incidents, the security tools were already in place: FortiBleed went after firewalls, IDCF and ConnectWise involved backups, and MFA never came into play for the ConnectWise app sign-ins. The gaps were in the process around them: who reviews vendor access, how fast patches land, whether backups can survive an attack, and who has the authority to act. That’s exactly what Jutsu, Black Belt Secure’s virtual CISO (vCISO) program, is built to fix.

• White Belt: Foundational Security builds the base that Black October 2026 punished businesses for skipping: risk assessments, asset inventory, access management, and quarterly strategy reviews with compliance guidance.
• Green Belt: Comprehensive Protection adds incident response planning and security awareness training, so your team recognizes a fake recruiter or deepfake call, plus monthly assessments and continuous monitoring.
• Black Belt: Strategic Mastery adds threat hunting, penetration testing, and 24/7 SOC integration, with a dedicated vCISO, weekly strategy sessions, and board-level reporting for organizations with complex operations or high regulatory demands.

With 20 years of experience protecting businesses, nonprofits, schools, and public agencies, our team turns headlines like these into a practical plan for your organization, without the cost of a full-time CISO.ls, and public agencies, the team converts headlines like these into practical, prioritized plans—without the cost of a full-time CISO.

The Takeaway

Black October won’t be the last month like this. AI is helping attackers find weaknesses faster and helping vendors find more bugs to patch, and both trends point the same way: more incidents, less time to respond. The businesses that come through it best won’t necessarily have the biggest budgets. They’ll know what’s connected to their environment, patch quickly, keep backups attackers can’t reach, and have a plan before the next wave hits.

Want to know how your business would have held up in Black October? Schedule a free assessment with Black Belt Secure today.

Sources: FBI/USSS joint advisory (Oct 6); BleepingComputer (Oct 9); BleepingComputer (Oct 8); BleepingComputer (Oct 10); BleepingComputer (Oct 13); BleepingComputer (Oct 17); CSO Online (Oct 21); Dark Reading (Oct 20); The Verge (Oct 22); BleepingComputer (Oct 22); BleepingComputer (Oct 22); BleepingComputer (Oct 30); Axios; Dark Reading (Oct 23); Davis Wright Tremaine.