Trending Topics Cybersecurity – October 2026

PHP2Shell: First Successful Attacks on PHP Systems Confirmed

According to heise Security, following millions of attack attempts, the first successful PHP2Shell attacks on honeypots have been confirmed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has subsequently added the vulnerabilities to its catalog of actively exploited security flaws. Security updates are available, but numerous services continue to report potentially vulnerable versions. This information does not allow for a definitive assessment of the patching status, as some Linux distributions backport fixes to older versions.

eMudhra: Eight Intermediate Certificates Use Privately Keys That Are Trivially Determinable

According to ComputerBase, eight intermediate certificates from the eMudhra certification authority used extremely weak private keys that security researchers were able to determine with little effort. This made it possible to issue certificates for any domain. The major browser vendors have already revoked the affected certificates. However, for applications and server environments with their own certificate stores, it is necessary to check separately whether the trust lists have been updated.

Notebooksbilliger Confirms Unauthorized Access to Data from Tens of Thousands of Customer Accounts

According to the company, unauthorized parties accessed data from a mid-five-digit number of customers at Notebooksbilliger. The breach reportedly involved email addresses as well as, potentially, names, addresses, and bank account information. It remains unclear whether data was leaked and, if so, to what extent. There are no indications that passwords have been compromised. The company has contained the attack, notified those affected, and informed the data protection authority.

Cyberattack on Japanese Cloud Provider May Affect Up to 26,739 Servers

Following unauthorized access, the Japanese provider GMO Internet has gradually shut down the servers of its Onamae Desktop Cloud service. The company confirmed the presence of malware in individual customer environments; a total of up to 26,739 servers may be affected. Data stored on these systems may have been exposed, but no actual data breach or misuse has been confirmed. According to the provider, payment information is stored on a separate infrastructure and is not affected.

University of Copenhagen: Test Environment Contains Data on Approximately 525,000 People

Attackers gained access to a test environment at the University of Copenhagen that contained personal data on approximately 525,000 people. The information that may have been exposed included names, national identification numbers, and contact information. In addition, access card PINs for approximately 20,000 employees and students were exposed, prompting the university to replace access codes and temporarily lock down certain areas. The unauthorized access has since been blocked; there are no indications that the systems supporting day-to-day university operations have been compromised.

Berlin Administration Concludes Immediate Response to Data Theft

Following the cyberattack on two Berlin Senate administrations, the Senate Chancellery reports that the immediate response phase has concluded. The attackers did not succeed in permanently infiltrating the state network under investigation. However, at least 1.2 million data records had previously been published, including personal and confidential information. Meanwhile, the analysis of the stolen data and further protective measures are continuing.

Cyberattack Forces Eichstätt City Administration to Shut Down Its Servers

The Eichstätt city administration has taken its servers offline as a precautionary measure following a cyberattack. As a result, various administrative services, email communication, and the telephone system have gone down, while the city’s website remained accessible. Investigations are still underway to determine whether any data was compromised. The city has set up alternative contact options for urgent matters.

Attack on French Supermarket Cooling Systems Leads to Spoiled Food

Attackers have taken the cooling and freezing systems of hundreds of French supermarkets offline. According to the news agencies Reuters and Bloomberg, food has spoiled. Reuters also reported fires at several locations. In the affected facilities, the control systems were tampered with and the refrigeration systems were switched to defrost mode. The French cybersecurity agency ANSSI is investigating the incident.

Asos Investigates Unauthorized Activity on Customer Communication Platforms

The British online retailer ASOS has confirmed an unauthorized customer notification after thousands of app users received a message about an allegedly compromised Snowflake instance. According to the company, basic personal information such as names and contact details may have been affected. The retailer sees no evidence that account passwords or credit card information were compromised; operations are continuing without interruption.

BSI Recommends Securing Small Networked Systems Against Sabotage

Following the attack on French supermarket refrigeration systems, the BSI has also urged operators of small networked systems to secure their systems. The recommendations are directed, among others, at operators of refrigeration systems, solar inverters, wind turbines, and drinking water supply facilities. Direct internet access should be avoided, and necessary remote access should be protected using VPNs, multi-factor authentication, and restricted access permissions. The agency emphasizes that these measures apply regardless of the specific incidents in France.

Post-Quantum Cryptography: High-Risk Applications to Be Migrated by the End of 2030

The Federal Ministry of the Interior, the Ministry of Digital Affairs, and the BSI have published joint guidelines on the implementation of the European roadmap for post-quantum cryptography. According to the BSI, the migration of high-risk use cases should be completed as early as possible and no later than the end of 2030; the entire transition should be largely completed by 2035. The guidelines are aimed in particular at government agencies, companies, and operators of critical infrastructure. Recommendations include clear responsibilities, a systematic risk assessment, and the early involvement of manufacturers and supply chains.

Investigative Authorities Seize Infrastructure of Bulletproof Hosting Provider Virtualine

International investigative authorities have seized the central domain of the hosting provider Virtualine. In the Netherlands, dozens of physical servers were also seized, resulting in the shutdown of hundreds of virtual servers. The investigative authorities have secured data from more than 3,000 customer accounts; further measures are being considered. Among other things, the provider is alleged to have provided infrastructure for ransomware, botnets, infostealers, and phishing.

Operation Against KillSec: Authorities Secure at Least 110 Terabytes of Data

In an international operation against the ransomware group KillSec, investigative authorities took control of its leak site and secured at least 110 terabytes of data against unauthorized access. The group is said to have used the platform to blackmail affected organizations by threatening to publish stolen data. The investigation, led by the Hamburg State Criminal Police Office (LKA Hamburg), involves approximately 1,000 suspected cyberattacks worldwide, including at least 70 in Germany.

CEO Fraud: Court Affirms Extensive Liability Following Losses Exceeding 50 Million Euros

The Cologne Regional Labor Court has affirmed extensive personal liability on the part of the employee involved in a CEO fraud case. Within 25 days, the employee had initiated nearly 60 wire transfers totaling more than 50 million euros after attackers posed as corporate executives using a spoofed phone number. The ruling is not yet final: An appeal is pending before the Federal Labor Court, so a final decision has yet to be reached.

AI in Hospitals: Protecting Patient Data

Generative AI can significantly reduce the workload for hospitals—whether in preparing physician reports, summarizing guidelines, maintaining quality documentation, or handling administrative tasks. At the same time, hospitals process patient data—health information that is subject to special protection under data protection law and is also covered by physician-patient confidentiality.