The month of October 2026 witnessed some of the critical cyberbreaches and software security flaws coming to light. From hackers claiming to have accessed sensitive customer information at AU Small Finance Bank to a critical vulnerability in PHP that may allow attackers to take control of computer systems, many incidents were reported that made headlines.
These incidents have affected different sectors, including banking, government organisations, technology companies and software developers. Some companies have confirmed security incidents, while others are still investigating claims made by hackers.
Here is a look at some of the major cyberattacks and security incidents reported in October 2026.
AU Small Finance Bank Data Breach Claim
AU Small Finance Bank came under the spotlight after a hacking group called ScarlettGroup claimed to have accessed sensitive customer and internal company information.
The group reportedly claimed that it had obtained customer Know Your Customer (KYC) documents, Aadhaar and PAN details, credit reports, bank statements, loan applications and other financial records. It also threatened to make the allegedly stolen information public.
The bank has confirmed that it is investigating a potential data leak involving a software platform managed and hosted by Salesforce. However, it clarified that its main banking systems remain unaffected and all banking services are operating normally.
State Bank of India Customer Data Found On The Dark Web
India’s largest public sector lender, State Bank of India (SBI), also reported a suspected data exposure in October. The bank informed stock exchanges that it had received alerts about customer information allegedly appearing on the dark web. An investigation found 3,897 SBI customer records containing personal information among a larger collection of around 3.75 lakh records.
The exposed information reportedly included customers’ names, mobile numbers, dates of birth, email addresses, residential addresses and details linked to loan records. SBI has initiated an investigation and appointed an independent cybersecurity agency to examine the incident.
Critical PHP2Shell Vulnerability Puts Websites At Risk
One of the biggest cybersecurity concerns in October was a critical security flaw discovered in PHP, a programming language widely used to build websites and online services. The vulnerability, known as PHP2Shell, could allow hackers to run their own commands on affected computer systems without requiring login credentials.
In simple words, attackers could potentially take control of vulnerable servers by sending specially designed requests to them. The Indian Computer Emergency Response Team (CERT-In) issued an advisory on October 22, warning organisations about the risks associated with these vulnerabilities.
Malicious Claude Code Extension Affects 5,000 Users On Cursor
October also saw a security incident involving Cursor, a coding platform owned by SpaceX. The company discovered a malicious version of Anthropic’s Claude Code extension on its extension marketplace. The extension was not developed or published by Anthropic.
According to reports, the modified extension could have allowed attackers to access users’ information and gain remote access to their devices. Cursor said that up to 5,000 users could have been affected by the incident. The company temporarily took down its extension marketplace while investigating the issue.
Rajasthan Police Faces Alleged Cyberattack
Rajasthan Police also reportedly came under the spotlight after a hacking group claimed to have breached its systems and accessed government data. The group allegedly claimed that it had obtained information from the police department and offered the allegedly stolen data for sale on an online hacking forum.
The claims prompted authorities to launch an investigation into the matter. According to reports, Rajasthan Police officials were also advised to change their email passwords as a precautionary measure.
eMudhra Digital Certificate Security Incident
Indian digital certificate provider eMudhra also faced a major security concern after weaknesses were discovered in some of its digital certificate keys. These keys are used to establish trust in websites and software. They help browsers and operating systems verify whether a website or software publisher is genuine.
According to security advisories, eight intermediate certificate authority keys in eMudhra’s emSign G3 hierarchy were generated with weak security. This made it possible for the keys to be recovered.
If attackers misuse such keys, they could potentially create fraudulent digital certificates, impersonate trusted websites or make malicious software appear to come from a genuine publisher. CERT-In issued an advisory about the incident in October. However, the agency clarified that eMudhra’s regulated digital signature and eSign services in India were not affected by this particular incident.
