The Biggest Security Incidents of Autumn 2026

Every week we keep a running list of the security incidents and critical vulnerabilities reported across the technology industry, and check each one against the software and services we run. This is that list as it stood on 7 November 2026: seventeen incidents, each with the public reports behind it. Things will get worse before they get better, so we are sharing what we see.

The biggest security incidents of autumn 2026 at a glance

Seventeen incidents from April to November 2026, roughly in order of reach, with a link to the reporting on each one. Select a name to jump to the detail.

What kinds of attack were they?

Most of them came through software flaws that had, or soon had, a fix: GitLab, Oracle, Atlassian, Ivanti, Next.js, Fortinet and WordPress plugins. The rest came through stolen access, stolen secrets, customer systems, a hijacked update channel and factory default passwords.

How fast do attackers move once a flaw is public?

Within days, and sometimes before the fix exists. Atlassian's file access flaw was attacked two days after the advisory, Oracle's flaw was being probed a week after its patch, and the Ivanti chain was used for twelve days before Ivanti published a fix.

Every incident, in detail

1. Binance hot-wallet theft: about $6.3 billion taken from hot wallets in one evening

Binance says the theft began at about 20:05 UTC on 29 October 2026, when hot wallets were drained across roughly ten blockchains. Its own estimate is about $6.3 billion, around four times the $1.5 billion Bybit theft that held the record before it. Binance's early investigation pointed to a compromised DevOps engineer's laptop.

Why it matters. One trusted machine was enough to reach the wallets that move money every minute. The lesson for any business is the same at a smaller scale: the people with the most access are the most valuable targets, and their devices need the strongest protection.

Stolen access  29 Oct 2026  ·  Reported by Redwerk · StealthEX

2. MUJI app customer data: up to 27.26 million customer records reached through the MUJI app

Ryohin Keikaku, the company behind MUJI, announced on 30 October 2026 that unauthorised access may have exposed up to about 27.26 million records, including email addresses, dates of birth and gender, and including members who had already left. It says card details, names, addresses and phone numbers were not included, and it has blocked the access.

Why it matters. Former customers were in the data too. Information a business no longer needs is still information it can lose, which is why keeping only what you use is a security decision as much as a GDPR one.

Customer data  30 Oct 2026  ·  Reported by FASHIONSNAP · SmartScope

3. Revolve saved payment cards: saved cards for about 1.5 million shoppers taken by automated means

Revolve, the online fashion retailer, told the SEC that an unauthorised actor got into certain systems and used automated means to pull saved customer payment details. Filings list the breach as starting on 11 September 2026 and being found on 29 September, with notices from 29 October. A Texas filing puts the total at 1,515,073 shoppers, far above the 180,000 first reported.

Why it matters. The breach ran for almost three weeks before anyone noticed. Detection time is what turns an intrusion into a disaster, and it is the number every team should know about its own systems.

Customer data  Disclosed 29 Oct 2026  ·  Reported by SecurityWeek · Malwarebytes

4. Railway environment variables: a hosting platform told every customer to rotate their secrets

Railway disclosed on 21 October 2026 that an unauthorised party may have accessed encrypted environment variables and decrypted some of them. It paused deployments, invalidated every Railway API token on 22 October, and asked all customers to roll their environment variables, API keys and registry credentials.

Why it matters. Environment variables are where most software keeps its keys. When the platform that stores them is reached, every key in it has to be treated as gone, and the only defence that works is being able to replace them all quickly.

Stolen secrets  21 Oct 2026  ·  Reported by Railway disclosure · BleepingComputer

5. GitLab CVE-2026-97229: a maximum-severity flaw, with more than 1,000 servers still open

GitLab disclosed CVE-2026-97229 on 12 October 2026, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 that allows code to run without logging in. CISA added it to its Known Exploited Vulnerabilities catalogue, and Shadowserver counted over 1,000 GitLab instances still vulnerable. A second regex compiler bug, CVE-2026-110264, followed.

Why it matters. The fix shipped on the day of disclosure. The thousand servers still open are the gap between a patch existing and a patch being installed, and attackers live in that gap.

Unpatched software  12 Oct 2026  ·  Reported by BleepingComputer

6. Oracle E-Business Suite CVE-2026-101767: attackers probing a critical flaw seven days after the fix

CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite 12.2.3 to 12.2.15 that can lead to remote code execution, rated CVSS 9.8. Horizon3.ai reported it in July, Oracle fixed it in the October Critical Patch Update on 20 October, and Defused saw exploit attempts on 27 October.

Why it matters. A week is all it took for attackers to turn a published fix into a target list. Enterprise systems that are patched quarterly are exposed for most of each quarter.

Unpatched software  20 Oct 2026  ·  Reported by The Hacker News · Help Net Security

7. Atlassian Data Center CVE-2026-21589: file access without a login across eight Data Center products

Atlassian's 5 October 2026 advisory rated CVE-2026-21589 at CVSS 9.3: an unauthenticated attacker can read files within the web application root of eight self-hosted Data Center products, including Jira, Confluence and Bitbucket. VulnCheck saw exploitation against Bamboo on 7 October, and CISA added it to the KEV catalogue in mid-October. Atlassian Cloud was already patched.

Why it matters. Two days from advisory to attack. The cloud editions were safe on day one, which is the quiet argument for letting the vendor run the software.

Unpatched software  5 Oct 2026  ·  Reported by Help Net Security · Akamai

8. Ivanti Connect Secure zero-day chain: a VPN broken open before any fix existed

Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure, on 13 October 2026, with Volexity reporting a zero-day chain used against fully patched appliances since at least 1 October. On 29 October Ivanti added two more flaws to the chain, CVE-2026-111357 and CVE-2026-118527, and CISA listed them the next day.

Why it matters. When the attack comes before the patch, patching speed cannot save you. What does is limiting what a compromised device can reach, and noticing quickly when it is used.

Unpatched software  13 Oct 2026  ·  Reported by Rapid7 · The Hacker News

9. Next.js critical RCEs: two unauthenticated remote code execution flaws in a popular web framework

On 14 October 2026 Next.js shipped versions 16.4.1 and 15.5.28 to fix two critical flaws that let an attacker run code without logging in, one in the App Router's cache components and one in image handling.

Why it matters. Frameworks sit under thousands of businesses' websites, so one flaw is thousands of exposures. Our own website runs on Next.js, which is exactly why a list like this is checked against what we run.

Unpatched software  14 Oct 2026  ·  Reported by Netlify · Cloud Security Alliance

10. cPGuard update channel hijack: a security product's own updates used to plant a backdoor

OPSSHIELD confirmed on 3 November 2026 that attackers used stolen credentials to reach cPGuard's update infrastructure and pushed a malicious script to customer servers running versions 5.88.12 to 5.88.19. The script installed a backdoor and took root credentials; OPSSHIELD estimates the attacker retrieved 32 files, each tied to one customer server, and says it stopped the attack within 12 hours.

Why it matters. Customers who kept their software up to date were the ones hit. Trusting an update channel is unavoidable, so the defence is knowing exactly what each tool on your servers is allowed to do.

Supply chain  3 Nov 2026  ·  Reported by SecurityOnline · The Hacker Wire

11. European supermarket fridges: refrigeration across Europe pushed to 50°C

In late October and early November 2026, fridges and freezers in supermarkets in France, Sweden, Belgium, Luxembourg, Estonia and elsewhere were pushed to about 50°C. Ahold Delhaize, Colruyt, ICA, Coop and Carrefour reported problems. The head of the UK's National Cyber Security Centre said the French fridges were on the internet with default passwords.

Why it matters. No ransom was demanded, which points to sabotage. Equipment nobody thinks of as a computer still has a password, and the factory one is public.

Default passwords  2 Nov 2026  ·  Reported by Axios · ITV News

12. DreamHost file manager: a hosting provider breached for about ten weeks

DreamHost reported a breach running from mid-August to late October 2026 to California's Attorney General on 2 November. It shut down its File Manager on 23 October and reset passwords; reporting says FTP and SFTP credentials, some webmail sessions and stored files may have been exposed.

Why it matters. Ten weeks inside is the headline. The longer an attacker goes unnoticed, the more of what they reach they can take.

Stolen access  Aug to Oct 2026  ·  Reported by WebHosting.Today · BleepingComputer

13. Fortinet FortiSIEM critical flaw: code execution in the system meant to watch for attacks

Singapore's Cyber Security Agency issued an alert on 22 October 2026 about a critical FortiSIEM vulnerability, rated CVSS 9.8, that allows code to be executed. It adds to a year of actively exploited Fortinet flaws in FortiClient EMS, FortiSandbox and FortiOS.

Why it matters. Security tools are software too. A flaw in the system that collects every alert hands an attacker the map of your defences.

Unpatched software  22 Oct 2026  ·  Reported by CSA Singapore

14. WordPress plugin takeovers: plugins that let a stranger create an administrator

Through 2026, critical WordPress plugin flaws have been used to take over sites by creating rogue administrator accounts. WP Maps Pro (CVE-2026-8732) drew more than 3,600 exploitation attempts in a single day across 15,000+ sites, and Kirki (CVE-2026-8206, CVSS 9.8) was attacked across around 200,000 vulnerable installations.

Why it matters. Every plugin is another vendor with access to your site. Fewer plugins, kept up to date, is the whole defence.

Unpatched software  2026  ·  Reported by TechRadar · SC Media

15. Rohto Pharmaceutical mail-order system: possible unauthorised access to a mail-order sales system

Rohto Pharmaceutical announced on 11 September 2026 that it had found possible unauthorised access by a third party to the system behind its mail-order sales the day before, and restricted access to it while the scope was investigated.

Why it matters. Customer-facing ordering systems hold names, addresses and purchase histories in one place, which makes them a steady target for attackers everywhere.

Customer data  10 Sep 2026  ·  Reported by Rocket Boys (Japanese)

16. DigiCert support portal: a certificate authority's support systems used to sign malware

DigiCert disclosed that attackers delivered malware through a customer chat channel, reached its internal support portal and abused stolen certificate issuance data to obtain valid EV code-signing certificates. It revoked 60 certificates from the exposure window, 27 linked to the attacker, which were used to sign Zhong Stealer malware.

Why it matters. A support chat was the way in. Every channel where outsiders can send files to staff is part of the attack surface.

Stolen access  April 2026  ·  Reported by SecurityWeek · CyberInsider

17. Vercel via Context.ai: a third-party AI tool used as the way into a cloud platform

Vercel's April 2026 bulletin says the intrusion began with a compromise of Context.ai, an AI tool used by a Vercel employee, which led to that employee's Google Workspace account and some Vercel environments. A limited set of customers' non-sensitive environment variables was exposed; variables marked sensitive were stored so they cannot be read.

Why it matters. The attacker came in through an AI tool someone had connected to their work account. Every tool given access to company accounts is part of the company's security, whoever chose it.

Stolen secrets  April 2026  ·  Reported by Vercel bulletin · Security Affairs

What do these incidents have in common?

Almost every one started with something ordinary: a laptop with too much access, a key stored where an attacker could reach it, an update not yet installed, a password nobody changed, a tool connected to a work account without much thought. The scale is new. The weaknesses are not.

• Secrets are the prize. Railway and Vercel both ended with customers rotating keys. Wherever keys are kept, that place is the target.
• Patch windows are now days. Two days for Atlassian, seven for Oracle, minus twelve for Ivanti. Quarterly patching leaves most of the quarter exposed.
• Trusted channels carry risk. cPGuard's own update channel and DigiCert's own support chat were both used against their customers.
• Time to detect decides the damage. Revolve's attacker had almost three weeks and DreamHost's about ten.

How does Recruitly keep watch?

We monitor our own systems all the time, we track threats like these as they are reported, and we collect the data that tells us whether any of them could apply to us. When one could, we deal with it before it can become our incident. Next.js is on this list, and our own website runs on it, which is exactly why every entry gets checked against what we run.

That watch sits on top of how Recruitly is built:

• Every request passes through Cloudflare before it gets near our servers.
• Two-factor sign-in is compulsory for every user, with no off switch.
• Nothing inside is trusted by default. Our AI, built on Claude, runs the servers and holds no keys: it fetches each one from a locked vault that records every fetch.
• Every code change is checked by our AI reviewer and scanned for leaked keys before it ships.
• Every part of Recruitly is checked every two minutes, from inside and outside.
• Backups are locked for fourteen days, so nobody, not even us, can delete them.

The full picture, layer by layer, is in How Recruitly protects your data and on our security page.

What should a recruitment agency do about it?

An agency holds thousands of CVs, client contacts and salary details, which is exactly the kind of data in this list. The habits that protect it are the same for a team of five as for a bank.

• Keep two-factor sign-in on, and never read your code out to anyone, including someone who says they are from support.
• Use a password you use nowhere else, and change any factory default the day equipment arrives.
• Give API keys only to tools you trust, and never paste one into a chat or a spreadsheet. Share passwords and keys safely instead.
• Check what every AI tool you connect to your work accounts can reach, as Vercel's incident shows.
• Keep only the candidate and client data you still use. Data you no longer hold cannot be lost.

Our security awareness lesson walks through each of these with two recruiters at the same agency. We will keep watching, and we will keep sharing what we see.