What Has Been Pwned Today: data breaches, hacks & exploited CVEs
Today's data breaches, ransomware attacks, cyber outages, actively exploited vulnerabilities and critical CVEs with their CVSS scores. Each item is first spotted on X and kept only after we find an official source such as a vendor advisory, NVD, CISA KEV, a company statement or a regulatory filing. Newest first.
Railway is a cloud service where developers host their apps. The company says that on 21 October an outsider may have reached the stored settings of customers' apps, including secret passwords and access keys, and in some cases read them. Railway has confirmed the incident and says it may affect only some users, but it is telling everyone to change their keys.
What this means
Railway recommends that all users immediately change (rotate) every environment variable and API key stored in Railway, as well as any private registry credentials, and review logs for those services for unusual activity.
Railway has paused all deployments while it investigates, so new versions of apps cannot be rolled out until builds are restored.
Railway says it will email the customers it confirms were affected; it has not yet said how many accounts are involved.
Changing a leaked key stops future misuse but does not undo anything an attacker already did with it, which is why the log review matters.
Technical details
Railway detected anomalous activity on 21 October involving systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents, which can include API keys and database and registry credentials. Railway paused all deployments, has asked upstream AI inference providers to revoke keys, and recommends that all users rotate every variable and review logs.
Oracle has put out an emergency fix for Java, the software platform that runs many business and web applications. The flaw is in the part of Java that handles secure (encrypted) connections, and Oracle says attackers could use it over a network without needing a password. Oracle's alert does not say it is being exploited; active exploitation is not confirmed.
What this means
If you run Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 or 27.0.1, Oracle GraalVM for JDK 17.0.21 or 21.0.13, or GraalVM Enterprise Edition 21.3.20, apply the patch listed in Oracle's Security Alert.
Oracle says server software that passes data to the affected APIs, for example through a web service, can be attacked, as can sandboxed Java clients that run untrusted code.
Oracle says unsupported older releases are not tested but are likely also affected, and recommends upgrading to supported versions.
Oracle has not said whether the flaw has been exploited or who reported it.
Technical details
Oracle issued Security Alert CVE-2026-91403 on 21 October 2026, outside its regular patch schedule, for a flaw in the JSSE (TLS) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Oracle scores it CVSS 3.1 9.1 and says it is remotely exploitable without authentication over the network, with high impact to confidentiality and integrity. Affected supported versions include Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20.
affected
Oracle Java SE (8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1), Oracle GraalVM for JDK (17.0.21, 21.0.13), GraalVM Enterprise Edition 21.3.20
Cisco Expressway is equipment companies use so staff and partners can join video calls and phone systems from outside the office network. Cisco found a serious flaw that could let an attacker take full control of these devices when they are set up in a group (cluster). Cisco has released a fix and says it is not aware of the flaw being used in attacks, so exploitation is not confirmed.
What this means
If you run clustered Cisco Expressway-C or Expressway-E on X15.5.3 or earlier, upgrade to X15.5.20, as Cisco's advisory says; X14 and earlier need to migrate to a fixed release.
Cisco says there are no workarounds, so updating is the only fix.
Cisco says its security team is not aware of public announcements or malicious use of this flaw at the time of publication.
Technical details
Cisco disclosed CVE-2026-76466 on 21 October 2026, a flaw in the database service of Cisco Expressway-C and Expressway-E (virtual and appliance) that could let an unauthenticated remote attacker with network access run operating-system commands as root. It stems from persistent cookies and from client certificates not being validated for clustering when TLS Verify Mode is enabled, and affects devices configured in a cluster. Cisco rates it CVSS 3.1 9.8, says there are no workarounds, and lists X15.5.20 as the fix for X15.5.3 and earlier; X14 and earlier must migrate to a fixed release.
affected
Cisco Expressway-C and Expressway-E (clustered; X15.5.3 and earlier, X14 and earlier)
LiteLLM is a popular open-source tool that developers use to connect their apps to AI models. On 21 October attackers hijacked its release process and published a fake version, 1.107.0, containing malware that steals passwords and access keys from any machine that installs it. LiteLLM has confirmed the incident and removed the bad version.
What this means
If you installed litellm 1.107.0 from PyPI (11:39 to 13:23 UTC, 21 October) or ran the v1.107.0, latest, main-latest or main-stable Docker images in that period (until 14:20 UTC), LiteLLM says to treat that environment as compromised.
Rotate every secret the affected host could reach, including cloud roles, AI provider keys stored in the LiteLLM database, LiteLLM master and virtual keys, and database passwords.
Reinstall pinned to litellm 1.106.2, ideally by rebuilding from scratch; LiteLLM warns that starting Python on an infected machine, even to run pip, re-triggers the malware.
LiteLLM says earlier versions and its private enterprise registry were not affected.
Technical details
Attackers used stolen GitHub credentials belonging to three LiteLLM developers to change the release pipeline. They published litellm 1.107.0, which steals credentials and loads remote code, to PyPI (11:39 to 13:23 UTC on 21 October) and to several Docker Hub and GHCR tags (until 14:20 UTC). LiteLLM says to treat any environment that installed or ran it as compromised, pin 1.106.2, and rotate every secret the host could reach.
State Bank of India told stock exchanges on 21 October that some of its customer data had been found on the dark web (hidden websites often used to trade stolen data). A first check found personal details of 3,897 customers, such as names, phone numbers, birth dates and addresses. The bank confirms the incident, is investigating, and says its banking services are running normally.
What this means
SBI says the exposed records included names, registered mobile numbers, dates of birth, gender, email and home addresses, and customer and loan-lead IDs; its filing does not mention passwords or card numbers.
Customers may get scam calls, texts or emails that use these details to seem genuine; a bank will never ask for your PIN, OTP or password, so don't share them.
The 3,897 figure comes from a preliminary review of about 375,000 leaked records; SBI hasn't yet said whether more customers are affected.
SBI has hired an independent CERT-In-empanelled cybersecurity firm to investigate and says there is no material impact on its core operations.
Technical details
SBI told Indian stock exchanges on 21 October that its threat-intelligence provider, the Defence Cyber Agency and CERT-In had warned it on 16 October about customer data exposed on the dark web. In about 375,000 leaked records, a first review found 3,897 customer records with personal data, including names, mobile numbers, dates of birth, addresses and loan-lead metadata. The bank says it has hired an independent CERT-In-empanelled firm and that core operations are not materially affected.
eMudhra, an Indian company that issues the digital certificates websites use to prove their identity (the padlock in your browser), created weak security keys for eight of its certificate-issuing authorities in 2025. After a researcher showed the keys could be cracked, Apple, Google, Microsoft and Mozilla stopped trusting them. eMudhra confirms this and says none of its systems or data were breached.
What this means
Most people don't need to do anything: eMudhra says the eight affected certificate authorities never issued a single website certificate, and Mozilla says Firefox blocked them automatically.
Websites whose certificates come from eMudhra's now-distrusted ECC root can show browser security warnings until they are replaced; eMudhra says this affects one customer ecosystem in the United States and it is issuing replacement certificates.
eMudhra says its Indian digital signature (DSC) and eSign services and its other products run on separate systems and need no action.
eMudhra says it knows of no evidence that anyone recovered or used the weak keys before disclosure; it has not yet confirmed the exact root cause.
Technical details
eMudhra says a flaw in its 30 April 2025 key-generation ceremony created weak keys for eight intermediate CAs under its ECC root, and those weak keys were the ones published to browser root stores. A researcher showed the keys could be recovered and reported it to the Apple, Google, Microsoft and Mozilla root programs, which then distrusted the affected CAs and one root. eMudhra says its infrastructure and data were not compromised and that its Indian DSC and eSign services are unaffected.
affected
eMudhra Ltd (global TLS business / emSign ECC hierarchy)
Plex Media Server is popular software people run at home to stream their own movies, TV and music. Attackers are widely exploiting four bugs that, combined, let someone on the internet take over an out-of-date Plex server without logging in. Plex and the US cybersecurity agency CISA confirm the attacks; version 1.43.3.10861 or later is fixed.
What this means
Check your server version in Plex Web under Settings > General and update to 1.43.3.10861 or newer; NAS users may need to install the update manually.
Plex says that if your server was older than that and reachable from the internet, you should assume it may be compromised; hacked servers have been used to run cryptocurrency miners and proxy software.
Signs Plex lists include unfamiliar processes, unknown .so or .dll files in the Codecs folder, and high CPU use when nothing is playing; if you see them, rebuild from a clean install, sign out of all devices and change your Plex password.
If you don't need remote access, Plex suggests turning it off and not forwarding port 32400.
Technical details
CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on 20 October: two SSRF bugs, an encoded-URI neutralization flaw and an arbitrary file write. Chained together, they lead to code execution on the server. Plex Media Server 1.43.3.10861 and later contain the fixes.
PHP, the programming language behind a large share of websites, released updates on 21 October that fix two serious flaws. Under the right conditions, someone with no login could use them to take control of a web server running PHP. At release time the PHP team said it had not seen a working public attack, so active exploitation is not confirmed.
What this means
If you run PHP on a server, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package) and restart PHP services; PHP says updating is the only complete fix.
PHP rates Apache with mod_php as the highest-risk setup, but every PHP installation that serves web requests is affected, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
PHP 8.1 and older no longer get official updates; ask your distribution or long-term-support vendor for a backported fix, or move to a supported version.
Switzerland's NCSC advises also checking appliances and internal apps that use PHP behind the scenes, and reviewing logs for signs of compromise, because an update does not undo a break-in that already happened.
Technical details
The PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical bugs in memory handling: corruption after out-of-memory errors and stale global state that survives between requests. Either can let an unauthenticated attacker run code on the server, and PHP rates Apache with mod_php as the highest-risk setup. The CVE IDs leaked a day before the coordinated release; at release time the PHP Foundation said it had found no working public exploit.
Nikkei, the Japanese media company behind the Nikkei newspaper, says someone used stolen login details on 7 October to get into a cloud service it uses for software development. About 1.83 million items of personal information leaked, of which about 150,000 can identify a person. Nikkei confirms the breach and says no credit card data was involved.
What this means
The identifying items include names, email addresses, postal addresses, phone numbers or dates of birth; about 120,000 of them contain an email address.
Nikkei says it will contact each person whose data is confirmed leaked, and as of 16 October it had found no misuse of the data.
People whose email addresses leaked may receive phishing emails made to look like they come from Nikkei, so treat unexpected messages asking you to click links or log in with care.
Nikkei is still reviewing the scope of the breach and hasn't said how the login details were stolen.
Technical details
Nikkei Inc. says someone used stolen credentials early on 7 October to access a cloud service it uses for system development, leaking about 1.83 million personal-information items. About 150,000 contain identifying details such as name, email, postal address, phone number or date of birth, and none include credit card data. The company reported the breach to Japan's Personal Information Protection Commission on 11 October.
Criminals are bundling a genuine, signed copy of Siemens Software Center (a program for installing Siemens software) with their own malicious files and spreading it outside Siemens' official channels. Older versions of the program load those files, so the malware runs on Windows PCs. Siemens and CISA confirm the abuse; Siemens says its own systems were not breached.
What this means
Update Siemens Software Center to 4.0.9.8 or later; Siemens says existing installs update automatically the next time the program starts.
Siemens links the campaign to "ClickFix" tricks, fake "I am not a robot" pages that ask you to paste a command into the Windows Run box or PowerShell; a real check never asks for this, so don't do it.
Warning signs Siemens lists include "Siemens Software Center" in the startup apps of a PC that never had it installed, or a folder named "SM Software Provisioning Service" under AppData\Local\Programs.
Only download Siemens software from official Siemens sources; if a PC shows signs of infection, Siemens advises isolating it, removing the startup entries and scheduled tasks, and resetting passwords.
Technical details
Siemens ProductCERT confirmed that attackers are abusing a DLL search-path flaw in Siemens Software Center. They bundle a genuine, signed copy of the program with malicious DLLs and distribute it outside official channels. Siemens says no Siemens system was breached, fixed the issue in version 4.0.9.8 (advisory SSA-580366), and CISA added the CVE to KEV on 20 October.
Ahold Delhaize, the company behind supermarket chains such as Albert Heijn, Food Lion, Stop & Shop and Giant, confirms that attackers caused the IT problems it first disclosed on 12 October. It took most of its brands' websites and apps offline as a precaution, but kept stores open. The company says it has no evidence so far that sensitive customer data was taken.
What this means
Online shopping and apps were disrupted for most brands in Europe and the US; Albert Heijn's website and app are back, with home deliveries expected from 23 October, and US e-commerce is expected back in the coming days.
Stores across all brands stayed open throughout the incident.
The investigation is ongoing, and the company hasn't said what kind of attack it was or how the attackers got in.
Ahold Delhaize notified the Dutch National Cyber Security Centre and filed a police report on 19 October.
Technical details
Ahold Delhaize says its investigation found that suspicious activity in its IT infrastructure, first disclosed on 12 October, was caused by malicious actors. It took websites, apps and other systems offline for most of its European and US brands as a precaution, but kept stores open. The company notified the Dutch NCSC, filed a police report on 19 October, and says it has no evidence so far that sensitive customer, associate or partner data was taken.
affected
Ahold Delhaize (Albert Heijn, Food Lion, Stop & Shop, Giant and other brands)
SiteGuard Server Edition is security software, widely used in Japan, that filters attacks on websites. A flaw in it lets someone who already has limited access to the server run commands with full control of the machine. Japan's JPCERT/CC and the US cybersecurity agency CISA confirm it is being exploited.
What this means
If you run SiteGuard Server Edition 2.20 or later, update to Ver8.00 Update 5 (Apache, Nginx, IIS) or Ver7.00 Update 6 (Apache and Nginx on FreeBSD), or apply the vendor's patch, which is also offered for end-of-life versions.
The flaw is in the statistics feature, which is on by default; for IIS, versions 3.10 to 4.00 Update 4 are not affected.
Because exploitation is confirmed and CISA has flagged this flaw for forensic triage, admins should also check affected servers for signs of compromise, not just patch them.
Technical details
EG Secure Solutions' SiteGuard Server Edition, a host-based WAF widely used in Japan, has an OS command injection flaw that lets an attacker run commands as root or SYSTEM. JPCERT/CC published it through JVN, and CISA added it to KEV on 20 October with a 23 October deadline for federal agencies.
Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.
What this means
If you installed and activated Rank Math PRO 3.0.123 in that window, Rank Math says to treat your site as compromised and, ideally, restore it from a backup made before 15 October, 20:02 UTC.
Change every password and secret the site could reach, including WordPress, database, hosting, API and payment keys, even if you restored from a backup.
Then install the clean version 3.0.124 from your Rank Math account; if you only downloaded 3.0.123 and never installed it, Rank Math says there is no sign from this incident alone that your site was hacked.
Rank Math says it never sends login or download links by email, so treat such emails as suspicious.
Technical details
Rank Math says some Rank Math PRO 3.0.123 packages downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware that compromises the site once the plugin is activated. The malware can recreate its own backdoor, so the vendor recommends restoring from a clean backup, rotating all credentials, and installing the clean 3.0.124. The free WordPress.org version is not affected.
Ivanti Connect Secure is a VPN gateway, the device employees use to connect to their company network from outside. A flaw in versions before 25.1.3.0 lets an attacker on the internet run commands on the device without a password. The US cybersecurity agency CISA confirms it is being exploited.
What this means
If you run Ivanti Connect Secure, update to 25.1.3.0 or later; according to the NVD record, version 22.7R2.14 and earlier are not affected.
Because exploitation is confirmed and CISA has flagged this flaw for forensic triage, admins should also check the device for signs of compromise, not just patch it.
Neither CISA nor the NVD record says how widely the flaw is being exploited; Ivanti's advisory has the vendor's full guidance.
Technical details
An authentication-bypass-by-spoofing flaw in Ivanti Connect Secure before 25.1.3.0 lets a remote, unauthenticated attacker run arbitrary commands. Version 22.7R2.14 and earlier are not affected. CISA added it to KEV on 13 October.
Palo Alto Networks makes widely used firewalls, the devices that guard company networks. A flaw in the firewall's admin web page lets an attacker who can reach that page and log in to it take complete control of the firewall. Palo Alto has released fixes and CISA confirms it is being exploited, though Palo Alto says it has seen only very limited attacks.
What this means
Update PAN-OS on PA-Series and VM-Series firewalls and Panorama to a fixed release listed in Palo Alto's advisory, such as 12.2.4 or later on the 12.2 branch.
Limit the management interface to trusted internal IP addresses or a single jump box; Palo Alto says the risk is highest when that interface is reachable from the internet.
Cloud NGFW and Prisma Access are not affected.
Technical details
A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. Palo Alto Networks says limiting management-interface access to trusted IPs greatly reduces the risk. CISA added it to KEV on 14 October.
BeyondTrust Remote Support is software that IT help desks use to control computers remotely. A flaw lets an attacker on the internet, without logging in, tamper with files on the server that runs it. BeyondTrust has released a fix, and the US cybersecurity agency CISA confirms the flaw is being exploited.
What this means
BeyondTrust says its cloud (SaaS) customers were patched on 9 October.
Self-hosted customers on version 26.2.3 or earlier should apply the BT26-05-RS patch if their appliance doesn't update automatically; anyone on a version older than 24.3.1 must upgrade first.
Because the flaw is exploited in the wild and CISA has flagged it for forensic triage, admins should also check their appliances for signs of tampering, not just patch them.
Technical details
BeyondTrust Remote Support does not properly check where internal messages come from, which can let a remote attacker perform file operations on the appliance. BeyondTrust patched SaaS customers on 9 October, and self-hosted appliances need the BT26-05-RS patch (version 24.3.1 or later). CISA added the CVE to KEV on 16 October with a 19 October deadline for federal agencies.
affected
BeyondTrust Remote Support (self-hosted, all versions <= 26.2.3; SaaS patched 9 Oct)
Cisco Secure Email Gateway is a device companies use to filter incoming email for spam and malware. A flaw lets an outsider take full control of the device just by sending an email with a specially crafted attachment, if a malware-checking feature called file reputation is turned on. Cisco has released a fix, and the US cybersecurity agency CISA confirms it is being exploited.
What this means
Cisco says the fix is in Content Scanner Tools 25.3.0.5525 or later, which installs without a restart; appliances with automatic updates enabled receive it on their own.
Admins should run the check described in Cisco's advisory (search system_logs for "System Security") and contact Cisco TAC if it reports a compromise indicator; Cisco says there are no workarounds.
Cisco Secure Email Cloud Gateway customers don't need to act: Cisco says it has fixed the cloud service and contacted customers where it found malicious activity.
Because an attacker with full control can hide their tracks, Cisco advises also checking network and firewall logs for unusual traffic to or from the device.
Technical details
A path traversal bug in the Advanced Malware Protection feature of Cisco Secure Email Gateway lets an unauthenticated remote attacker write arbitrary files to the underlying OS with a crafted email attachment. It only applies when the file reputation service is enabled. CISA added it to KEV on 14 October.
OpenCode, which makes an AI coding assistant, says its hosted Console service was breached on the night of 16 October. It says 1.4% of Console users were affected, all of them people who had connected outside AI providers. OpenCode confirmed the breach on its official X account and emailed those affected.
What this means
OpenCode says that if you did not get an email from it, you were not affected.
OpenCode hasn't publicly said what data was accessed.
If you were notified, a sensible precaution is to revoke and replace any AI provider API keys you saved in Console and check those provider accounts for usage you don't recognise.
Technical details
OpenCode says it had a security breach on the night of 16 October, which it links to a large-scale distillation attack, affecting 1.4% of OpenCode Console users. The affected users were a subset who had connected external AI providers. OpenCode emailed every affected user on 17 October and says users who got no email were not impacted. OpenCode's statement does not say what data was accessed.