This October’s cybersecurity digest covers a major cloud outage that knocked banks and digital services offline, a wave of emergency patches for actively exploited vulnerabilities, Microsoft’s largest Patch Tuesday on record, and serious data breaches affecting a national identity register and the Pentagon.
1. Google Cloud outage knocks Revolut and UK banks offline
A power event at Google Cloud’s London infrastructure disrupted business websites, video links, and several major banks on October 20. Cloud Run, Google App Engine, Google Kubernetes Engine, and Cloud Filestore were affected, and these are the layers many businesses depend on to run apps and store files, so services failed even where the businesses’ own code hadn’t changed.
As we informed you last week, Revolut was hit hardest. Its status page listed 28 services as partially unavailable, including sign-ins, card payments, transfers, and currency exchange. Halifax and HSBC also reported problems, while Lloyds said its apps and logins were working, but some online features were affected. Revolut confirmed customer money and data remained safe throughout.
Google says the issue is now mitigated, though it hasn’t explained what caused the power event itself. This incident reminds us that even well-resourced platforms can be taken down by a single point of failure in their cloud provider. And it raises the question of whether backup arrangements can keep essential services running when one cloud location goes dark.
2. Hackers exploited critical PHP flaws days before the PHP emergency update was ready
PHP released emergency fixes on October 21 for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10), known together as PHP2Shell, which could let attackers run code on vulnerable web servers. Amazon Threat Intelligence found exploitation attempts as early as October 17 – four days before the public disclosure and the patch.
Update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and make sure PHP-FPM or your Apache module is updated too, not just the CLI package.
3. Fortinet urges customers to patch critical FortiOS, FortiManager and FortiAnalyzer flaws
Fortinet released coordinated updates on October 22 for FortiOS, FortiManager, and FortiAnalyzer, addressing critical and high-severity flaws, some found through AI-assisted testing. Fortinet’s CISO urged customers not to treat this as routine maintenance and to prioritise internet-facing devices first. Fixed versions vary by product and branch, so you should see Fortinet’s advisory for your specific setup.
Fortinet recommends identifying exposed systems, backing up configurations, scheduling urgent maintenance, and reviewing logs for unusual administrator access both before and after patching.
4. Chrome 156 fixes 353 flaws, including six critical vulnerabilities
Google released Chrome 156 on October 20, fixing 353 security issues, six of them critical memory-corruption and use-after-free bugs affecting Skia, Accessibility, CSS, Paint, and WebRTC. Users should check that their browser has been updated to version 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac and restart it to apply the fixes.
5. Microsoft’s October 2026 Patch Tuesday addresses a stunning number of 1,118 vulnerabilities
Microsoft’s largest Patch Tuesday yet covers 1,118 vulnerabilities, up from 973 in September. Alongside the release, Microsoft also introduced “risk cohorts,” an experimental approach grouping vulnerabilities by shared risk questions rather than listing them individually. This is meant to supplement rather than replace individual vulnerability assessments. The largest cohort covers Windows filesystems, storage, and backup features with 136 CVEs, followed by Office document and mail clients with 135, and Windows graphics, media, and content processing with 131.
6. Ransomware group claims to have stolen data from PwC. Claims remain unverified
The Everest ransomware group claims to have stolen 590 GB of data from PwC, including HR records and internal documents, with a listing reported on October 22. It’s important to stress that none of this has been independently verified: PwC has not responded publicly, no evidence has been shown of how the data was obtained, and claims of working credentials or a specific ransom demand remain unconfirmed. The Everest group has reportedly set an October 28 deadline before threatening to publish the data, though that date hasn’t been independently verified either.
7. Admin password “123456” exposed 8.8 million Danish national ID records
A weak administrator password (“123456”) is at the centre of a breach exposing roughly 8.8 million Danish national ID records. An attacker reportedly used a leaked former-employee password at Pays, an IT firm with access to Denmark’s Central Person Register, to extract data undetected for 21 days from September 10 onwards before being discovered. There’s no confirmed evidence of fraud yet, but the incident is a clear reminder to block common passwords, enforce MFA, and disable former employees’ accounts promptly.
8. Pentagon confirms breach exposing data of 3 million people
The U.S. Department of Defense confirmed a breach of a Defense Manpower Data Center system exposing unencrypted personal data including Social Security numbers and military job details for more than three million people. Unauthorised access reportedly ran from October 2025 to July 2026 via a file-sharing system vulnerability, discovered and patched on July 16. Notifications to affected individuals started going out on September 18.
Officials say there’s currently no evidence the data has been misused, though that doesn’t remove the long-term risk, especially for personnel in sensitive roles. Affected individuals are being offered a year of free credit monitoring and identity-restoration services.
Staying secure means more than just being informed. It’s about prevention, timely patching, proper backup strategy, and ongoing training against ever-emerging threats. We hope your systems remain safe and compliant with NIS2. If you need assistance, please contact us for expert advice!