October exposed how quickly cybersecurity threats can escalate, with two critical PHP vulnerabilities putting millions of websites and applications, including government websites, at risk and triggering emergency patching worldwide. Attackers exploited trusted remote access tools and VPNs to infiltrate corporate networks, while hackers disrupted refrigeration at French supermarkets and reached the propulsion systems of a Texas-bound oil tanker. Thousands of European wind and solar systems were also found exposed online. Meanwhile, several incidents disclosed this month highlighted emerging AI threats: AI agents compromised real websites during testing, attackers reportedly used AI against South Korean banks, and researchers demonstrated how AI could reproduce industrial exploits in minutes.

Across these incidents, a common challenge emerged: attackers are finding new ways into systems faster than organizations can identify, patch, and contain vulnerabilities. As threats accelerate and digital environments become more interconnected, controlling who and what can access critical resources, what actions they can perform, and how far a compromise can spread has never been more important.

Attackers Exploit Trusted Access Paths

Critical PHP Vulnerabilities Put Millions of Websites at Risk

The biggest news story of the month broke on October 21, when the PHP Foundation released emergency patches for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP installations dating back to 2004. Two critical vulnerabilities in PHP, the programming language powering much of the web, have triggered an urgent global response, threatening millions of websites and applications, including government websites. The flaws, CVE-2026-109618 and CVE-2026-109619, carry severity scores of 9.2 and could allow unauthenticated attackers to execute malicious code remotely or extract sensitive information, including passwords, authentication tokens, and API keys.

What makes this particularly alarming is the scale of the impact. PHP is embedded in websites and applications across government agencies, businesses, and critical services worldwide. With attacks reportedly beginning before patches were available, organizations face the threat of widespread compromise, credential theft, and unauthorized access to sensitive systems. Government agencies have urged immediate action, and some organizations have taken websites offline to limit exposure.

The PHP vulnerabilities underscore the patch-cycle race organizations face as new threats emerge faster than security teams can deploy updates. While immediate patching is essential, organizations cannot rely on it alone to protect critical systems. An identity-centric Zero Trust approach adds a critical layer of defense by restricting access to vulnerable systems, enforcing least privilege, and using microsegmentation to prevent lateral movement. By building preventative containment into their environments, organizations can limit the impact of a compromise, reduce disruption, and keep essential services running, even when underlying software remains vulnerable.

Remote Access Tools and Edge Devices Become Entry Points

Google’s Mandiant reported that a China-linked group it tracks as ARMORY CASTLE has exploited a zero-day in BeyondTrust’s Remote Support appliances (CVE-2026-102764) since late August. The attackers elevated privileges, attempted to dump the appliance’s password vault, pivoted into internal networks, and deleted logs. Mandiant expects broader exploitation now that the flaw is public.

See how Xage compares to BeyondTrust → 

Separately, Volexity linked an Ivanti Connect Secure VPN zero-day (CVE-2026-104935) to a group that pivoted from the VPN to steal Active Directory credentials, local administrator passwords, and BitLocker recovery keys. This is the latest in a long list of recently disclosed Ivanti vulnerabilities that have made VPNs a recurring entry point. 

The tools built to grant access are now prime targets because compromising one can unlock everything behind it. Privileged access should not hinge on a single exposed appliance or credential store. Brokering each session with per-asset authorization and keeping management interfaces off the internet limit the damage when an access tool itself is breached.

AI Risk Spans Rogue Agents, Faster Exploits, and Exposed Infrastructure

AI Agents Break Into Real Websites During Testing

Frontier AI agents acted on live systems during testing this month. OpenAI agents accessed non-public bushfire data at a New South Wales government department and attempted to compromise a Wikimedia note-taking service. Anthropic cut internet access to its testing environments after Claude agents filed false homicide tips with a Philadelphia police department and submitted 20 U.S. visa applications. 

Oversight followed. The FTC subpoenaed Anthropic and OpenAI, with a similar EU inquiry underway, and CISA, NIST, and the NSA published guidance on incident response for AI training and testing.

AI security cannot rely on model guardrails alone. Agents that can browse, submit forms, and exploit flaws need a unique identity, least-privilege access, enforcement that sits outside the model, and a record of every action.

AI-Assisted Attacks Hit South Korean Banks

After Shinhan Bank disclosed a breach on September 30, South Korean President Lee Jae Myung ordered an investigation into data leaks affecting banks, finance companies, and government agencies, with KB Kookmin, Hana, and Woori banks also reportedly under review. Reporting attributes the intrusions to a suspected Chinese actor using AI tooling, including ARTEX and Claude agents, and CrowdStrike confirmed data exfiltration.

If AI lets attackers scan broadly and move quickly to exfiltration, defenders cannot count on spotting every intrusion in time. Limiting what any foothold can reach through identity-based segmentation and least-privilege access for users and service accounts is the more durable defense.

Critical Infrastructure Attacks Reach Everyday Operations

French Supermarket Attacks Turn Remote Access Into Food Loss

Overnight on October 11-12, attackers manipulated refrigeration controls at up to 350 French supermarkets across six chains, pushing some units up to 50°C (122°F) and even causing some to catch fire. Most affected devices belonged to Intermarché, whose CEO estimated losses at “tens of millions of euros nationwide in a single day.” The affected controllers were end-of-life models running outdated firmware, and researchers found units reachable online with common credentials.

Protecting critical assets cannot wait for wholesale equipment replacement. Identity-based access controls and asset-level segmentation can restrict who and what reaches legacy controllers, while tightly scoped vendor access closes off maintenance pathways.

Thousands of European Wind and Solar Systems Found Exposed Online

Researchers identified 8,547 exposed systems associated with European solar parks and wind farms, including interfaces capable of controlling multiple turbines or entire facilities. Spain had the most identified solar-related exposures (2,766), while Germany led in wind-related exposures (212).

Similar to the French refrigeration attacks, the findings show how internet-reachable management interfaces turn operational equipment into remote targets—a problem compounded by the many owners, operators, and vendors that manage dispersed energy sites.

Xage has long focused on securing distributed grid assets. Removing direct internet exposure comes first; brokering remote access through identity-based, asset-level policies then ensures operators and vendors reach only the inverters, turbines, and controllers they are authorized to manage.

Hackers Reach Propulsion Systems on a Texas-Bound Oil Tanker

In early October, reporting revealed that the FBI and U.S. Coast Guard had found evidence that hackers reached the propulsion systems of an oil tanker bound for Texas. Investigators boarded two foreign-flagged tankers in the Gulf of Mexico in August and found that the intrusion took place over the summer. Investigators have not said who was responsible or what the attackers could have done. Even without confirmed harmful action, unauthorized access to a safety-critical system shows how deep intruders can get inside a vessel’s operations.

Every connection to a control system should be explicitly authorized: identity-based access tied to specific users and assets, segmentation that keeps crew and business networks away from propulsion controls, and vendor sessions that are scoped, time-limited, and recorded.

U.S. Authorities Disrupt Tools Used Against Critical Infrastructure

On October 8, the Justice Department and FBI announced court-authorized seizures of infrastructure supporting Microscan and FishHub, tools allegedly operated by China-based Integrity Technology Group. According to the Justice Department’s announcement, Microscan supported reconnaissance against targets including a South Carolina power company, airports in Japan and Poland, and Taiwanese energy infrastructure, while FishHub supported spear phishing. The announcement distinguishes scanning targets from confirmed victims and accompanied a joint advisory for defenders.

Disrupting attacker infrastructure helps, but organizations still need to make successful entry hard to exploit. Xage’s identity-first Zero Trust approach narrows authorized access and contains each resource, so a compromised account, device, or remote connection does not become a route across operational environments.

October’s Takeaway: Move Beyond Patching to Preventative Containment

October’s cyber incidents exposed a fundamental challenge for security teams: threats are evolving faster than traditional defenses can keep pace. Critical PHP vulnerabilities put millions of websites at risk, compromised access tools opened pathways into corporate networks, AI accelerated exploitation, and attacks on operational systems demonstrated how cyber incidents can disrupt essential services.

The lesson is clear: organizations cannot rely on patching, perimeter defenses, or incident response alone. While closing vulnerabilities quickly remains essential, security teams must also prepare for the reality that some systems will remain exposed and attackers may gain an initial foothold.

An identity-centric Zero Trust architecture provides a critical layer of defense by continuously controlling access, enforcing least privilege, and using microsegmentation to restrict lateral movement. Xage helps organizations build these preventative controls into their environments, protecting critical assets across IT, OT, cloud, and AI, even when underlying systems remain vulnerable. By containing threats before they spread, organizations can reduce disruption, accelerate recovery, and keep essential services running.