Date saved: 2026-10-25 18:01 (PDT)
Sources: CISA, FBI, Unit 42 Palo Alto Networks, TechCrunch, Medium, Verizon, ITRC, Capcom, Coinotag, Yahoo Finance, Xact Cybersecurity
Key findings
Major ransomware operations and critical infrastructure
- CISA / FBI / Germany / UK Joint Advisory (October 20, 2026): SafePay ransomware has compromised at least 600 organizations across critical infrastructure sectors since August 2024; the playbook uses initial access through vulnerabilities in VPNs, firewalls, and backup software, achieves data theft and encryption often within 24 hours of getting in, deliberately attacks backup systems to sabotage recovery, and exfiltrates data staged with 7-Zip and WinRAR archives to Backblaze B2 cloud storage using its legitimate b2.exe tool; Infosecurity Magazine notes SafePay may be a rebrand linked to LockBit, ALPHV/BlackCat, or INC affiliates and calls it one of 2026's most active groups. (Source)
- Xact Cybersecurity (October 22, 2026): CISA, the FBI, and international law enforcement partners released a joint advisory warning about SafePay ransomware; the advisory was developed by CISA, the FBI, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom, and describes SafePay activity observed through investigations conducted as recently as August 2026. (Source)
- Palo Alto Networks Unit 42 (October 19, 2026): Multiple ransomware groups are actively exploiting the Palo Alto GlobalProtect authentication bypass CVE-2026-0257 in PAN-OS, even though it was patched in May; Rapid7 saw attacks from May 17, and Unit 42 named Qilin and Inc among the operators; once inside, attackers use legitimate IT management tools to move laterally, and Palo Alto's warning is that because access comes through the victim's own VPN, it can look like normal remote work. (Source)
PHP critical vulnerabilities and public exploit code
- Unit 42 Palo Alto Networks (October 23, 2026, updated October 25): CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems, allowing remote code execution; the threat brief was updated October 25 as exploitation activity continued. (Source)
- MSN / Google News (October 23, 2026): Critical PHP2Shell exploit code went public as hackers attempted to deploy botnet malware, a significant development given PHP's ubiquity in web infrastructure. (Source)
Major data breaches
- MSN (October 23, 2026): The Capcom data breach has been confirmed with around 11.7 million accounts thought to have been affected, making it one of the year's largest gaming-sector breaches. (Source)
- ITRC H1 2026 Data Breach Report: The Identity Theft Resource Center counted 1,803 compromises in the first half of 2026 and 471.2 million victim notices, already more than all of 2025; the record volume reflects the scale of supply-chain and ransomware attacks. (Source)
- Verizon 2026 Data Breach Investigations Report: 48% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in; the report is the industry's most comprehensive annual accounting of breach patterns. (Source)
- FBI investigation (October 2026): The FBI is investigating a dark web service called Nexus that sold scans of more than 153 million U.S. and Canadian driver's licenses and other identity documents, with evidence suggesting near real-time exfiltration tied to IDscan.net before Nexus abruptly disappeared; a healthcare technology company also reported a data breach affecting more than 9.5 million patients. (Source)
- ASOS (October 2026): The UK fashion retailer confirmed a breach exposing customer names and contact details after attackers gained access to an employee account through impersonation. (Source)
Bitcoin and AI-hacking threat scenario
- Yahoo Finance / Benzinga (October 23, 2026): Billionaire investor Chamath Palihapitiya predicted Bitcoin will eventually be hacked and go to zero, arguing that recursively self-improving AI models could target Bitcoin's SHA-256 security and potentially crack Satoshi Nakamoto's wallet; Palihapitiya said a coordinated transition to quantum-resistant cryptography is "basically impossible" given how divided the Bitcoin community already is on basic coordination; the prediction was made on the Moonshots podcast and Palihapitiya noted an attacker could profit twice -- first by draining the wallet, then by shorting Bitcoin after revealing the hack publicly. (Source)
- Coinotag (October 25, 2026): Palihapitiya's zero call is a scenario, not a disclosure; SHA-256 hashing and wallet-signature security are distinct cryptographic layers, and no catastrophic protocol breach has occurred in Bitcoin's history, which is the fact any attack thesis must first overcome; the counterweight is that Jordi Visser has dismissed a similar zero-call, on-chain accumulation has continued with whales adding 243,000 BTC since July, and the argument will be settled by cryptographers, not by a forecaster who left the position years ago. (Source)
CISA workforce reductions and infrastructure targeting
- CISA (October 2026): The Cybersecurity and Infrastructure Security Agency ended six free critical-infrastructure cybersecurity assessments amid workforce reductions, raising concerns given recent targeting of U.S. water systems; in July, CISA observed malicious cyber activity targeting more than 100 internet-exposed water and wastewater systems across at least a dozen U.S. states. (Source)
- CISA / NSA / FBI Advisory AA26-251A (September 8, 2026): Six China-based AI labs -- DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI -- were named for industrial-scale API distillation against Claude, GPT, Gemini, and Grok; the alleged theft ran through premium subscriptions, transfer-station proxies, and millions of teacher-model queries rather than through breached servers. (Source)
October 2026's third week was one of those weeks where the cybersecurity news stops being about individual breaches and starts being about the collapse of trust in the infrastructure everyone depends on. The CISA-FBI-Germany-UK joint advisory on SafePay ransomware on October 20 was the headline: the group has compromised at least 600 organizations across critical infrastructure sectors since August 2024, with a playbook that uses VPN and firewall vulnerabilities for initial access, moves to data theft and encryption often within 24 hours, deliberately attacks backup systems so victims cannot restore, and exfiltrates data staged with 7-Zip and WinRAR archives to Backblaze B2 cloud storage. That is not a smash-and-grab -- it is an operationalized extortion machine running against hospitals, utilities, and local governments. At the same time, Palo Alto Networks' GlobalProtect authentication bypass CVE-2026-0257, patched in May, was still being actively exploited by ransomware groups including Qilin and Inc as of October 19 -- meaning organizations that applied the patch months ago were still at risk because the attack comes through the victim's own VPN and looks like normal remote work. And then there is the PHP2Shell exploit code going public, with hackers attempting to deploy botnet malware on a vulnerability in one of the most widely used web scripting languages on earth. The Capcom breach -- roughly 11.7 million accounts thought to have been affected -- is the consumer-facing face of a week that also saw PHP critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 for remote code execution, updated October 25. The Verizon 2026 Data Breach Investigations Report found that 48% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. The throughline is that the attack surface is everywhere, the fixes are often known and unpatched, and the groups doing the exploiting are operating at a scale that makes individual incident response look like triage.
Source links
- CISA / FBI Joint Advisory: SafePay Ransomware Has Hit Hundreds of Organizations
- FBI probes 153 million driver's licence leak, Health data breach hits 9.5 million
- Palo Alto Networks Unit 42: Threat Brief -- Critical Vulnerabilities in PHP CVE-2026-109618, CVE-2026-109619
- Palo Alto Networks Unit 42: Active Exploitation of May 2026 PAN-OS CVE-2026-0257
- TechCrunch: The internet is having a very bad cybersecurity day
- Medium: The Week Trust Broke -- 8 Cyber Incidents That Made October 2026's Third Week Brutal
- Capcom data breach confirmed -- around 11.7 million accounts thought to have been affected
- Bitcoin Goes to Zero After a Hack, Chamath Palihapitiya Predicts