October is Cyber Security Awareness Month, and this year's headlines have delivered enough real-life cybersecurity horror stories to remind organisations that cyber threats are always lurking around the corner.
From critical vulnerabilities and exploited zero-days to a major Danish data exposure, October 2026 has demonstrated how quickly security risks can develop. For businesses and organisations, these incidents offer important lessons about software visibility, vulnerability management, access control and timely security updates.
PHP2Shell: From Emergency Updates to Confirmed Exploitation
October saw the disclosure of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. Emergency security updates were released on October 21, while websites and public services in Denmark and the Netherlands were temporarily taken offline as a precaution.
The threat continued to develop. On October 24, researchers observed 35 successful shell executions against specially configured honeypot servers. Two days later, CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, reflecting evidence of active exploitation.
While widespread compromise has not been established, these developments highlight the importance of identifying affected PHP installations, applying updates promptly, verifying remediation and monitoring for suspicious activity.
Denmark's CPR Incident: The Risks of Trusted Access
In early October, Danish authorities disclosed unauthorised access to names, addresses and personal identification numbers relating to approximately 8.8 million registered individuals in Denmark's Central Person Register (CPR). The figure includes people who have emigrated or died.
The incident involved misuse of a private company's legitimate access to the system, highlighting the importance of strong access controls, continuous monitoring and responsible management of sensitive information.
Organisations should regularly review third-party permissions, apply least-privilege access and investigate unusual activity. These measures help reduce the risk of unauthorised access and improve the protection of sensitive data.
Microsoft: A Record Patch Tuesday
Microsoft's October Patch Tuesday addressed 1,413 vulnerabilities across its products, including CVE-2026-96951, an actively exploited Windows Shell zero-day that could allow attackers to bypass security protections.
Additional security updates followed, including fixes for remote code execution vulnerabilities affecting Microsoft Office.
For IT teams, the challenge extends beyond installing updates. They must determine which vulnerabilities affect their environments, identify those being actively exploited, prioritise remediation and confirm that patches have been deployed successfully.
A risk-based patching strategy helps organisations focus resources where they matter most, rather than treating every vulnerability as equally urgent.
Google Chrome: Why Third-Party Patching Matters
Google Chrome also required significant security attention during October.
On October 20, Google released Chrome 156 with 353 security fixes, including several critical vulnerabilities. Just one week later, a further update addressed 52 security issues.
Browsers are among the most frequently used applications in organisations, making them an important part of the attack surface. Even widely trusted software requires regular updates as new vulnerabilities are discovered.
Businesses should maintain visibility into installed application versions, establish consistent third-party patching routines and verify that updates reach the devices that need them.
Building Stronger Cybersecurity Beyond October
October's incidents reinforce an important lesson: effective cybersecurity depends on continuous visibility, timely action and consistent security practices.
For organisations managing hundreds or thousands of endpoints, maintaining an accurate software inventory and keeping applications updated can be challenging. Vulnerabilities may remain unnoticed in outdated, unsupported or rarely used applications, while manual patching processes consume valuable IT resources.
A structured approach to vulnerability management helps address these challenges. This includes identifying installed software, detecting security weaknesses, prioritising high-risk vulnerabilities and automating remediation wherever possible.
SecTeer VulnDetect helps organisations put these practices into action by providing a centralised overview of installed applications across Windows endpoints and servers. It identifies vulnerable, zero-day and end-of-life software, enabling IT teams to prioritise remediation based on risk exposure. With reporting, group-based approval policies and automated patching of supported applications, VulnDetect helps reduce manual work while maintaining control over software updates.
For organisations using Microsoft Intune, SecTeer PatchPro simplifies third-party application management by publishing supported applications and updates directly into Intune. IT teams can automate publishing, customise installation packages and manage device assignments through their existing Intune environment.
Together, VulnDetect and PatchPro help organisations improve software visibility, streamline patching workflows and reduce the time between identifying vulnerabilities and addressing them.
Cyber Security Awareness Month may be coming to an end, but cybersecurity requires attention all year round.
Discover how SecTeer's VulnDetect and PatchPro can help your organisation strengthen vulnerability management and simplify third-party patching. Get in touch with our team to explore the right approach for your environment.