For: people who run servers, VPN appliances, member data or outside services, and people who want to know whether a service they use was breached. This article summarizes what this site published in October and public information from CISA. It does not cover attack procedures.
October in numbers
The 115 is a count of this site's articles
It counts only the first-report articles this site published in October (articles published on November 1 are not included): 65 Japanese incidents, 28 overseas incidents, 4 global incidents and 18 vulnerabilities. Incidents we did not cover are not included, and it is not a statistic compiled by any government or agency. It cannot be used to say that incidents rose compared with the previous month.
Exploited vulnerabilities: what was in the 36
KEV is CISA's list of vulnerabilities it has judged to be exploited. October 1 to 31 saw 36 additions, bringing the catalog to 1,766 entries. By product type:
Edge and remote-access products: 11
Plex, PHP, Ahsay, Zammad: 10
Others (Windows, Linux kernel, GitLab and more): 10
Old flaws published 2015-2023: 5
Items with an article on this site are linked. Items without one are listed as the KEV records them.
| Group | Product and CVE | Added | This site's article |
|---|---|---|---|
| Edge device | Ivanti Connect Secure CVE-2026-104935 | Oct 13 | Edge device roundup |
| Edge device | Ivanti Connect Secure CVE-2026-111357, CVE-2026-118527 | Oct 30 | Ivanti Connect Secure follow-up |
| Edge device | Palo Alto Networks PAN-OS CVE-2026-0322 | Oct 14 | Edge device roundup |
| Edge device | Fortinet CVE-2025-61624 (FortiOS and others) | Oct 16 | Edge device roundup |
| Edge device | Fortinet FortiMail CVE-2026-104286 | Oct 1 | None |
| Edge device | Cisco Secure Email Gateway CVE-2026-76519 | Oct 14 | Edge device roundup |
| Edge device | Cisco Secure Firewall ASA CVE-2026-76418 | Oct 29 | Cisco ASA and FTD VPN |
| Edge device | Citrix NetScaler CVE-2026-88779 | Oct 4 | CVE-2026-88779 |
| Edge device | Arista VeloCloud Orchestrator CVE-2026-114625 | Oct 23 | VeloCloud Orchestrator |
| Edge device | BeyondTrust Remote Support CVE-2026-102764 | Oct 16 | None |
| Old flaws | ISC BIND CVE-2015-5477, ProFTPD CVE-2015-3306, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199, Strapi CVE-2023-22894 | Oct 8 (all five) | None |
| Same-product group | Plex Media Server CVE-2026-96652, 96654, 96655, 96656 | Oct 20 | Plex Media Server |
| Same-product group | PHP CVE-2026-109618, CVE-2026-109619 | Oct 26 | PHP critical security release |
| Same-product group | Zammad CVE-2026-102489, CVE-2026-102490 | Oct 2 | DIVD intrusion and Zammad |
| Same-product group | Ahsay AhsayCBS CVE-2026-105133, CVE-2026-105134 | Oct 14 | None |
| Other | SiteGuard Server Edition (Japan-made) CVE-2026-106931 | Oct 20 | SiteGuard Server Edition |
| Other | Linux kernel CVE-2026-46300 | Oct 28 | Linux kernel CVE-2026-46300 |
| Other | VMware ESX CVE-2026-41709 | Oct 28 | VMware ESX logging flaw |
| Other | GitLab CVE-2026-97229 | Oct 29 | GitLab critical patch |
| Other | Adobe Commerce CVE-2026-48356 | Oct 27 | Adobe Commerce |
| Other | Google Brotli CVE-2026-111497 | Oct 27 | Brotli |
| Other | Collabora Online CVE-2026-110447 | Oct 23 | Collabora CODE |
| Other | Microsoft Windows CVE-2026-96951, Atlassian CVE-2026-21589, Siemens Software Center CVE-2026-110936 | Oct 13, 15, 20 | Atlassian only: edge device roundup |
The groups "Edge device", "Same-product group" and "Other" are this site's own, not KEV's.
Our reading: what stands out in October's KEV is not a new kind of weakness but edge devices and old products that tend to stop receiving updates. The five added on October 8 were published 3 to 11 years ago. Even if you do not use those products, it is a cue to check for old environments that are still running. For how to rank fixes, see How to decide which CVEs to fix first (CVSS, EPSS, KEV).
The largest Japanese breaches
The table lists the official figures as written in this site's articles. A record is one entry; people means an approximate count with duplicates removed. "Possible" means the announcement did not say the leak was confirmed. Because units and certainty differ, this is not a ranking. Dates are announcement dates. Some cases announced in October (Club Tourism, Tin Pan Alley, Northflank, Chainalysis, Linux CVE-2026-98432) were published on this site on November 1.
| Organization and service | Announced | Figure (unit used) | Certainty (as announced) | This site's article |
|---|---|---|---|---|
| E-Store (ShopServe) | Oct 16 (final report) | About 23.356 million people | Leaked (buyers, store operators and affiliates combined, duplicates removed, approximate) | ShopServe |
| Ryohin Keikaku (MUJI app) | Oct 30 | Up to about 27.26 million records | Possibly leaked (includes people who left) | MUJI app |
| Club Tourism | Oct 31 (first notice) | About 4.32 million records | Possibly leaked | Club Tourism |
| Hana Cupid | Oct 28 | Up to 4,238,242 records | Leaked (the count is of "customers who may be affected") | Hana Cupid |
| Matsuya Foods Holdings (Matsuya app) | Oct 30 | 2,377,127 records and more (app members: 2,000, possibly up to 3,000) | Leaked | Matsuya |
| Sony Network Communications (So-net) | Oct 27 | 2,141,986 So-net member records; 443,495 plala (S course) member records | Leak confirmed | So-net |
| H2O Retailing (H2O ID) | Oct 19 | About 1.26 million records | Leaked (part of the data of almost all H2O ID members) | H2O ID |
| World (subsidiary Tin Pan Alley) | Oct 30 | About 1.2 million records in total | Possibly leaked | Tin Pan Alley |
The leaked items differ by case. For example, the MUJI app announcement lists email address, date of birth and gender, and says names and addresses are not included. Hana Cupid lists user ID, encrypted password and email address. Check your own items in each article.
A record count is not a head count, and being counted is not the same as being affected
A record is not a person, and several cases include people who had already left the service. Whether you are affected is confirmed through the individual notices the companies say they will send and through the notice on the official site.
Five themes in October
(a) Breaches through service providers and SaaS
Even if your own company did nothing wrong, a list you entrusted to a provider can leak. In October, incidents hit an email delivery service, a disaster-alert email service, an airline reservation contractor and an IT management platform.
- Blastmail: leak confirmed of company and contact names for all contracts, and of recipient lists for 345 contracts
- SpeeCAN RAIDEN: a service used for municipal disaster emails; up to about 3.136 million email addresses (estimated) may have leaked
- JAL and ANA reservation contractor: about 92,000 people (JAL and JTA) and about 37,800 people (ANA) had reservation data accessed through a contractor, according to the announcements
- ConnectWise Cloud Backup: unauthorized access to app credentials led to a service stop; a cloud provider reported sign-in attempts against more than 2,250 tenants
(b) Member and app databases
Leaks from member databases and app management systems at retail, restaurant and telecom brands continued through the second half of October. Besides the table above, this site covered several more cases during the month.
- MUJI app (up to about 27.26 million records, possible)
- Matsuya app management system (2,377,127 records and more)
- Hana Cupid (up to 4,238,242 records)
- H2O ID (about 1.26 million records)
(c) Cryptocurrency thefts
From late September to the end of October, incidents hit exchanges and related services at once. Figures are as the companies announced them, and most causes were still under investigation.
- Binance: estimated the impact of unauthorized withdrawals on October 29 at about USD 6.3 billion and said it will cover the loss
- Bitget: said about USD 387.5 million was taken after a zero-day in a third-party security product was exploited (the incident was in late September; this site's article was published in October)
- Bithumb: reportedly, unauthorized access to an internal mobile groupware exposed personal data of 844 customers
- Polymarket: said a third-party provider was compromised (reported to be via a script), paused trading, and said it would compensate affected users
(d) AI developer platforms and AI-assisted attacks
Incidents hit platforms that hold AI API keys, AI developer tools and hosted AI. Reports of attacks that use AI capabilities also continued.
- Northflank: told customers to treat all stored environment variables as decrypted; misuse of AI API keys was reported
- OpenCode: some users' linked AI-provider API keys were affected
- Zeabur: said 3,218,965 environment variables and information on 321,810 accounts were read
- A Cursor extension: a tampered "Claude Code" extension was distributed in the marketplace for about 11 hours
- Chainalysis: said it suffered unauthorized access using what it calls "offensive agentic techniques"
- Cloudflare Workers AI: said data from other customers' requests was mixed into responses in 155 cases
Separately, Linux kernel CVE-2026-98432 was reportedly demonstrated in a lab as remote code execution by an AI company's research team. This rests on that company's own report, which the press has not verified. As far as we could confirm, no real-world attack has been seen and it is not in KEV. The overall picture is in AI-assisted attacks and the order to defend.
(e) Edge devices
Beyond the 11 in KEV, Ivanti Connect Secure was added twice, on October 13 and 30, for different flaws. Patching does not remove traces of an intrusion that happened before the update.
- Exploited edge device vulnerabilities, mid-October 2026
- Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527
- VeloCloud Orchestrator CVE-2026-114625
- How to defend VPN devices and remote access
What to do in November
Patch KEV-listed edge devices first
List the product and version of every VPN appliance, firewall and mail gateway, and move anything in KEV to a fixed version within days. Save logs before updating, and limit the sources that can reach the admin interface to your management network.
Inventory outside services that hold your customer lists
List the services that hold customer emails and names: email delivery, reservations, member management, backups. Also check whether data remains after a contract ended.
Rotate stored keys when a platform has an incident
When a cloud or AI developer platform reports an incident, rotate the environment variables, API keys and tokens stored there, and check usage records for anything you do not recognize.
Prepare for email that pretends to be a breached company
After a breach is announced, email in that company's name tends to increase. Do not log in or enter anything through its links; compare with the notice on the official site. If you may be affected, change passwords first on any service where you reused the same one.
For how to spot such email, see What is phishing?.
Sources
- CISA, "Known Exploited Vulnerabilities Catalog" (JSON feed; this site counted the additions from October 1 to 31, 2026) — cisa.gov
- This site's articles: edge device roundup, ShopServe, MUJI app, Club Tourism, Hana Cupid, Matsuya, So-net, H2O ID, Tin Pan Alley (each cites the official announcements)
- The count of first reports is this site's count of the Japanese-language breaking articles it published in October 2026
Read next
- Year-long list: 2026 data breaches and cyberattacks timeline
- Defending exposed devices: How to defend VPN devices and remote access
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- AI-assisted attacks: AI-assisted attacks and the order to defend
- Checking for compromise: How to check whether your server was compromised