October 2026 brought some of the clearest signs yet that artificial intelligence is reshaping cybersecurity on both sides, with AI models uncovering widespread software flaws while attackers turned agentic tools against the vendors businesses depend on. Federal agencies also stayed in the headlines as breach fallout led to arrests, a class action lawsuit and new reporting demands, continuing the AI-enabled attacks and supply chain risks expected heading into 2026. This latest Recap by SWK Technologies covers the top headlines from this month to highlight the trends shaping the last leg of the year and how they may affect your business going into the next:
Orgs Scramble to Patch Widespread PHP Vulnerability Discovered by AI
The PHP project released emergency updates on October 21, 2026 to fix two critical vulnerabilities that can let an unauthenticated attacker run code remotely on a web server. Both flaws affect every PHP release going back to version 5.4, and even a bare-bones application running on an affected version can be exposed. With PHP powering close to 70% of websites, updating to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is the only complete fix, and the project is no longer issuing releases for branches older than 8.2.
Artificial intelligence did much of the work in finding the bugs, with Calif researchers using GPT-5.6 Sol through OpenAI’s Patch the Planet initiative, while a Wiz team independently traced the same weaknesses in August with help from Gemini 4 Argon. A limited form of the issue had been spotted in 2024 without being treated as significant, though frontier AI models made it possible to turn that buried flaw into working exploits against platforms such as WordPress and Drupal. Researchers used AI to build and adapt those exploits across multiple applications within hours, a pace that shows how quickly AI is changing the way attackers and defenders operate.
The same models that sped up discovery can also help attackers produce offensive tools and exploits much faster, turning the window between disclosure and patching into a race against AI-assisted threat actors. Details of the flaws leaked ahead of the scheduled release, and Cloudflare saw attack traffic aimed at its customers with payloads that kept changing to get around defenses. Amazon has since warned that the bugs are being broadly exploited, though CISA had not observed exploitation when it issued its alert urging immediate patching.
European authorities advised isolating exposed applications from public networks when updates cannot be applied right away, while agencies in the U.K. and U.S. recommended taking vulnerable systems offline until they are fully patched. Government services and major websites in several countries went temporarily offline as system admins worked to apply the updates. WordPress has noted that the flaws are not specific to its platform and that no WordPress update is planned, which leaves site owners and hosting providers responsible for updating PHP itself.
NOTE: www.swktech.com is hosted on a WordPress domain that runs on PHP, which has been updated and patched as of October 22, 2026. Current SWK customers should receive an email with more information about these vulnerabilities and how they may affect your various systems – anyone who has not received that message or is not a current SWK customer can send questions to info@swktech.com.
Oracle PeopleSoft and Accenture to Blame for September 2026 FBI Hack?
The ShinyHunters gang claimed in September 2026 that it had breached the FBI, taking data on nearly every agent and job applicant in the process. The Bureau had not yet confirmed at the time whether the breach began with a third-party provider or inside its own systems.
Later reports indicate that the FBI removed an Accenture contractor on October 5 over their part in the breach, with sources identifying Oracle PeopleSoft as the platform that was initially breached and the contractor as the party responsible for the access used to exploit it. The Bureau’s cyber chief has said publicly that the incident followed a contractor’s failure to apply a security patch issued specifically to protect the platform, and Accenture did not respond to questions about the individual. Data exposed in the breach included counterintelligence job details, street addresses of intelligence operatives and medical records, along with employee phone numbers and information on spouses.
Later reporting tied the breach to a PeopleSoft flaw that Oracle patched in an out-of-band security alert on June 10, 2026, the same day attacks were publicly reported. ShinyHunters appears to have modified its original exploit to slip past the web application firewall rules guarding the vulnerable endpoint, leaving systems that relied on those rules instead of the patch open to attack.
Oracle PeopleSoft has been a repeat target for the gang, which claimed in June 2026 to have compromised the PeopleSoft servers of more than 100 victims by exploiting the same vulnerability as a zero-day. ShinyHunters continued targeting healthcare, education and other sectors through July, as researchers attributed the June PeopleSoft campaign to the same group and its affiliates. Oracle’s October 2026 Critical Patch Update added 109 PeopleSoft fixes among close to 1300 in total, though the company has not flagged any of them as exploited in the wild.
Federal agents arrested Edward Dubrovsky, ostensibly a former managing director at ransomware negotiation firm CYPFER, on October 8 on charges of conspiring to commit extortion. His case was moved to the Eastern District of Texas, which sources describe as the center of the FBI’s ShinyHunters investigation, though the complaint remains sealed and his alleged involvement has not been made public. Authorities in the Netherlands and Jordan also detained suspected members of the gang in September and early October 2026.
Chinese Hackers Used AI to Hack ConnectWise and Spy on Customers
ConnectWise disclosed in mid-October that attackers gained unauthorized access to application identities in its Cloud Backup platform, which managed service providers (MSPs) use to back up Microsoft 365 and Google Workspace data for their clients. The company disabled the affected identities and temporarily shut down several services on October 17, then began a phased restoration on October 21.
Microsoft assessed that Storm-0940, a China-aligned group focused on data theft, was behind the attack and used ARTEX, an open-source penetration testing framework that relies on artificial intelligence agents to automate offensive work. The group ran reconnaissance, password spraying and application abuse at machine speed, with sign-in attempts reaching more than 2250 customer tenants. Most of that targeting failed, though several attacks gained privileged cloud access in less than three hours. ARTEX had already surfaced earlier in October 2026, when an unidentified and likely financially motivated threat actor used the tool against South Korean financial institutions and stole data.
The stolen application credentials let attackers sign in to customer environments as authorized users and reach their email and files. Researchers have confirmed unauthorized sign-ins in at least 162 Microsoft 365 tenants, and ConnectWise has said it has no visibility into customer tenants to determine whether a specific environment was accessed. Microsoft has advised affected customers to keep ConnectWise connections disabled, preserve their sign-in and audit logs and review any credential or permission changes before removing unauthorized access.
Two Marines Open Class Action Lawsuit Against Pentagon Over Breach
Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli filed a proposed class action lawsuit against the Pentagon on October 20, 2026, alleging the Department of War (formerly the Department of Defense) violated federal privacy laws by failing to protect service members’ records. The suit, filed in federal court in Washington, D.C., claims the DOW ignored internal warnings and multiple inspector general reports that flagged weak cybersecurity controls before the breach.
The complaint points to basic safeguards the plaintiffs say were missing, from regular account reviews and vulnerability scanning to encryption of Social Security numbers and monitoring of system logs. The plaintiffs also argue the Pentagon was too slow to notify the people affected, some of whom learned of the breach two to three months after it was discovered.
The breach stemmed from a vulnerability in a file-sharing system at the Defense Manpower Data Center that let unauthorized users reach files from October 2025 until it was found and patched on July 16, 2026. Roughly 2.76 million living people and 294,000 deceased individuals had Social Security numbers exposed along with names, birth dates, contact details or military personnel information. Affected individuals began receiving notice letters on September 18 with an offer of 12 months of credit monitoring and identity restoration services. The Pentagon has said it has no indication that the exposed information has been misused, and the Defense Manpower Data Center began incident response work to strengthen the security of the affected system.
White House Orders AI Companies to Disclose Cyber Incidents
The White House’s Super Intelligence Force told AI companies on October 9 that they must immediately disclose and remediate security incidents involving their models, describing the process as mandatory and a national security obligation. The demand follows an increasing number of breaches and other incidents involving various artificial intelligence models, including now several cases where agents autonomously acted to hack external networks such as the Hugging Face incident with OpenAI and several incidents with various Claude models.
Questions remain about how the requirement will work in practice, since the task force has not yet defined what counts as an incident, who receives the reports or what penalties apply. Legal analysts have also noted that the demand does not reflect a new reporting statute or regulation, which leaves enforcement unclear while the task force works through a 120-day review of AI risks.
The mandate builds on a voluntary accord that leading AI developers agreed to with the administration on September 30, committing them to regular meetings on safety risks and independent third-party audits. President Trump described the agreement as morally binding, though critics have pointed out that the accord has no federal enforcement arm behind it.
The order comes as AI developers disclose a growing number of security incidents involving their own models, many of them tied to autonomous agents reaching live systems during testing. Anthropic’s review found models exploiting software flaws to run commands on servers, submitting forms they should not have and working around restrictions to reach gated data, though the company said most cases had little impact outside its own testing. Anthropic has since cut off live internet access for its internal evaluations and briefed the White House and each affected agency.
OpenAI reported in July that two of its models used a zero-day flaw to escape a testing environment and gain code execution on Hugging Face servers, an event the company called unprecedented. Those cases were ostensibly the first of many since as the number continues to grow, raising difficult questions about who can be held legally accountable when an AI agent breaks into a system on its own.
Follow SWK Technologies for More Cybersecurity Updates
Cybersecurity has evolved tremendously over the past year, and the pace of those changes shows little sign of slowing heading into 2027. SWK Technologies follows the latest threats, vulnerabilities and regulatory changes in cybersecurity each month to keep your business informed of the developments that could affect your technology decisions.
Contact SWK here with any questions about the stories covered in this Recap, and check back next month for the latest cybersecurity news from SWK Technologies.