2026-11-01
October 2026 cyberattacks and data breaches: 36 exploited vulnerabilities and large-scale leaks
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October 2026, seven fewer than September's 43. Eleven were edge and remote-access products such as VPN appliances and firewalls, five were old flaws published between 2015 and 2023 (all added on October 8), ten were in Plex, PHP, Ahsay and Zammad, and ten were other products. This site published 115 first reports on incidents and vulnerabilities in October (65 Japanese incidents, 28 overseas, 4 global, 18 vulnerabilities); that is a count of this site's articles, not national statistics. In Japan, leaks from member and app databases kept coming. The largest announced figures were ShopServe (about 23.356 million people), the MUJI app (up to about 27.26 million records, possible), Club Tourism (about 4.32 million records, possible) and Hana Cupid (up to 4,238,242 records). Service-provider and SaaS breaches, crypto exchange thefts and AI developer platform incidents also continued. Our conclusion for November: patch the edge devices that reached KEV first, inventory the outside services that hold your customer lists, and prepare for phishing that pretends to be a breached company.