Summary

October reshaped the cybersecurity landscape, with 15 zero-day vulnerabilities actively exploited. One of the most notable threats came from Armory Castle (UNC5221), a suspected China-nexus espionage group that exploited CVE-2026-102764 in BeyondTrust Remote Support as a zero-day, exposing privileged credentials and downstream systems. Citrix also patched CVE-2026-88779, a NetScaler SAML zero-day that lets unauthenticated attackers crash appliances, plant web shells, and steal configuration backups.

Additionally, PHP2Shell (CVE-2026-109618 and CVE-2026-109619) puts nearly every PHP release since 5.4 at risk of unauthenticated remote code execution, with a group assessed to be Lazarus-linked already mapping 216 unpatched hosts. Attackers also hijacked the release process of LiteLLM, an AI gateway with about 23 million weekly downloads, to ship the privcollect stealer that harvests cloud, AI, and CI/CD secrets.

Moreover, the suspected nation-state cluster CL-STA-0954 deployed the memory-resident PEERSTITCH implant after stealing configurations and keys for over 500 FortiGate firewalls from a telecom provider's FortiManager. Meanwhile, SafePay ransomware has hit at least 600 organizations, breaking in through stolen or brute-forced credentials and edge-device flaws before destroying backups and encrypting data. With risks like these growing, strong defensive measures are more important than ever.

Insights

Threat distribution

Celebrity Vulnerabilities

Vulnerability Details: Vulnerabilities Summary

Attack Details: Attacks Summary

Actor Details: Adversaries Summary

Targeted Products, Countries and Industries

Most targeted countries

Most targeted industries

13 industries are highlighted in the Threat Distribution summary; the report ranks Oil & Gas, FMCG, Research Organizations, Banking, Political Entities, Consumers, Biomedical and Maritime among the least targeted.

Top 5 Takeaways

1. 01
   Zero-days

   In October 2026, 15 zero-day vulnerabilities surfaced.
2. 02
   New malware

   Malware active in October spanned a broad mix of Backdoors, Infostealers, Loaders, Web Shells, and Proxies.
3. 03
   Top countries

   Beyond the many campaigns with worldwide reach, targeted activity concentrated on the United Arab Emirates, United Kingdom, United States, Australia, and Iraq.
4. 04
   Top industries

   Financial, Telecommunications, Aviation, IT Services, and Technology sectors absorbed the bulk of targeted activity, with ransomware operations, espionage campaigns, and software supply chain compromises driving operational disruption.
5. 05
   Leading actors

   Activity during the period was dominated by Armory Castle, TraderTraitor, and CL-STA-0954, a mix of China-nexus, North Korean, and suspected nation-state groups.

Recommendations

Security teams: This digest can be used as a guide to help security teams prioritize the 66 significant vulnerabilities and block the indicators related to the 5 active threat actors, 23 active malware, and 240 potential MITRE TTPs.

Uni5 users: This is an actionable threat digest for HivePro Uni5 customers, who can get comprehensive insights into their threat exposure and take action easily through the HivePro Uni5 dashboard by running a scan to discover the assets impacted by the 66 significant vulnerabilities, and testing the efficacy of their security controls by simulating the attacks related to active threat actors, active malware, and potential MITRE TTPs in Breach and Attack Simulation (BAS).

Top Indicators of Compromise (IoCs)

Top MITRE ATT&CK TTPs

240 MITRE ATT&CK techniques were observed across the month; the 25 most frequent are listed above.