CYBERSECURITY RED ALERT: Major Cyber Incidents Put Enterprise Security on Alert

GLOBAL CYBERSECURITY NEWS REPORT | 22 OCTOBER 2026

A suspected customer-data exposure at India’s largest public-sector bank, a compromised IT services provider, exposed cloud secrets and malicious software releases have put organisations on alert. Between October 19 and 22, a series of major cybersecurity disclosures and incident updates highlighted risks across banking, cloud infrastructure, software supply chains and digital trust systems.

These developments are not evidence of a single coordinated campaign. Some involve confirmed unauthorised access; others concern vulnerabilities or potential exposure that require urgent investigation.

1. PHP: Critical Remote-Code-Execution Vulnerabilities

On October 21, PHP disclosed fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. The exploit might provide remote code execution by an unauthenticated attacker, allowing the attacker to gain control of vulnerable servers. CERT-In released a critical vulnerability note, emphasising that the updates should be implemented promptly.

What organisations should do: Organisations should update supported installations to PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 or PHP 8.2.35 (whichever applies). Track PHP instances on websites, APIs, servers and embedded products. Prioritise internet-facing systems. When patching can’t be done immediately, isolate exposed systems until remediation can be performed and then investigate suspicious activity and verify the fix.

2. SBI: Suspected Exposure of 3,897 Customer Records

An incident of the loss of some data was revealed by SBI on October 21. In a total of around 375,000 records on the dark web, its preliminary analysis was able to identify 3,897 customer records with personally identifiable information (PII). The information that was reported provided names, contact information, addresses, and identifiers for both customers and loans. The source of the exposure and full extent of the exposure are still being investigated. SBI stated that it did not experience material impact on its core operations and business continuity.

What organisations should do: Identify where the exposed data came from and the extent of the data exposure, review access and data transfer logs, audit third-party integrations, and improve access controls and monitoring. Customers are reminded to be vigilant against targeted phishing and should never provide OTPs, PINs, or banking information in response to an unsolicited communication.

3. eMudhra: Compromised Intermediate Certificate Keys

A security disclosure to eMudhra showed that eight intermediate certificate authorities were vulnerable due to the poor cryptographic key generation. Private keys found may be used to issue fraudulent TLS certificates, which might allow the attacker to spoof valid websites in some cases. The operators of the browser and trust-store decided to block these affected certificates. CERT-In stated that the Indian Digital Signature Certificate and eSign services of eMudhra were not impacted. As of 21 October, there had been no reports of public malicious use of affected keys.

What organisations should do: Update browsers, operating systems, certificate stores and runtimes of applications. Identify certificate dependencies during audit, replace affected certificates as required and check certificate chains. Do NOT skip the certificate validation warnings. Runtimes and containers that store independently will also need to be looked at by developers.

4. LiteLLM: Software Supply-Chain Attack

A public release pipeline has been compromised by LiteLLM, and the company announced this on October 21. The malicious litellm==1.107.0 package and some Docker images had malware that could steal credentials and load remote-code-execution components. These impacted releases were then removed or replaced with clean artifacts.

What organisations should do: Assume a compromised environment for those that carried out the affected release. Recreate impacted environments from clean sources, following LiteLLM’s recommendations of using 1.106.2, a verified safe version. Rotate API keys, database passwords, cloud identity credentials and other secrets. Monitor the cloud audit logs to look for suspicious activity. Do not open Python or execute package-management commands in a possibly infected environment before following vendor’s containment advice.

5. Node.js: Security Updates Across Supported Releases

On October 21, Node.js announced security updates for the 24.x, 26.x and 22.x lines. High-severity problems with DNS resolution and TLS certificate validity were corrected as well as some other vulnerabilities and dependency updates such as certificate-related updates that were related to the eMudhra incident.

What organisations should do: Upgrade to Node.js v22.23.4, v24.22.1 or v26.12.1, depending on the release. Check applications making outbound HTTPS requests, using certificate validation, or that process untrusted hostnames. Don’t forget to update container images and production deployment pipelines; updating a developer’s local environment is not enough.

6. Railway: Potential Exposure of Cloud Secrets

On 21 October, Railway, a cloud deployment provider, stated that an unauthorised third party could have accessed customer environment variables in certain instances; it could have gained access to the decrypted version of these variables. This includes API keys, database credentials and private registry credentials. Railway suspended deployments during the investigation and advised customers to regularly change the secrets they store and review the logs of the services.

What organizations should do: Change environment variables and all potentially exposed credentials, such as database and third-party AI-provider keys. Monitor and audit deployment and access history, review access issues where these are unexpected, and redeploy services with verified replacement. Follow Railway’s instructions for Integrations affected by incidents.

7. OpenCode, Ahold Delhaize, Splunk and BeyondTrust: Further risks to watch

The story doesn’t stop there, as other developments continue to build on the headline events:

OpenCode: In an OpenCode update announced today, it has identified a new vulnerability in the Console that could have led to the disclosure of third-party AI-provider API keys to users who accessed the service externally. Users affected have been told to remove and replace their keys.
Ahold Delhaize: The retailer maintained that its online systems, websites and apps in Europe and the United States are recovering from a cyber attack on their systems. There are no known cases of the breach of sensitive customer, employee or partner information as of October 19.
Splunk Enterprise: There is a critical issue with an unauthenticated management API that could be exploited to execute commands on affected systems. Administrators are advised to install the appropriate vendor patches and limit exposed management interfaces.
BeyondTrust Remote Support: Authorities have warned of active exploitation of CVE-2026-102764. For self-hosted installations, the vendor’s security patch should be applied followed by checking for unusual file operations.

Why Penetration Testing Must Be Proactive

These breaches highlight flaws in application security, access control, application dependencies, cloud access, secrets management, and certificate validation. Knowing about a vulnerability and patching it is only part of the equation; it doesn’t prove that there are other more exploitable paths.

These are some of the ways penetration testing can benefit an organisation to find and confirm vulnerabilities in web applications, APIs, mobile apps, cloud systems and connected systems. Can show too many permissions, insecure configuration, exposed endpoints and attack paths that span different components. Then a retest is administered to see if remediation has occurred.

How Qualysec Helps Enterprises Identify and Address Security Risks

Qualysec enables businesses to enhance their security defenses by organizing penetration testing and verifying vulnerabilities.

Identify vulnerabilities: Evaluate web applications, mobile apps, APIs, cloud systems and IoT for potential vulnerabilities.
Combine scanning with expert assessment: Take a multi-layered approach to scanning and expert assessment: scan with source-code scanners, cloud-suite scanners, a cloud-based vulnerability dashboard and expert audits to check for security vulnerabilities.
Correlate findings and attack paths: AI-assisted analysis to find patterns, link related findings, and point out attack chains for expert validation.
Focus on remediation: Give actionable results to security and development teams that will help them understand risk and focus on critical issues.
Retest vulnerabilities: Retest vulnerabilities to ensure that the vulnerabilities are fixed and that there is no remaining vulnerability.

The objective is to help enterprises find weaknesses before attackers exploit them, make informed remediation decisions and validate their security controls.

The Bottom Line

These disclosures and incident updates, from October 19-22, demonstrate why security teams can’t rely solely on patch announcements or automated scans. They must be aware of their exposure, identify vulnerabilities, safeguard credentials, and be aware of and verify remediation

In enterprise cybersecurity, the priority is not simply to discover a problem. It is to identify the risk before exploitation, contain it effectively and prove that the corrective action works.