Fenestra TI's Threat Landscape for October 2026 is now available. Each edition draws on Fenestra's own collection and analysis to give security, risk and intelligence teams a grounded read on the month.
October's common thread: the month's most serious threats arrived where people and goods move. Airports, shipping lanes and the software that runs websites were all hit. Few organisations own these, but most depend on them.
Key Findings
- The Houthis turned Saudi airports and energy sites into targets. After declaring Saudi airspace an "open target" on 5 October, the group struck Riyadh, Abha and Dammam airports and Aramco facilities. A missile on Riyadh's main airport reportedly killed 12 people, and the airport stayed shut for around two weeks.
- France was the month's standout mover. Its share of protest and unrest events rose more than any other country's, as school protests escalated into nationwide rioting and curfews. Turnout fell on 31 October, but violence at the end of marches did not, and unions have called a national strike for 5 November. France was the sharpest edge of a wider wave of youth and cost-of-living protests across Europe, from Italy and Belgium to Greece and Germany. Protest and unrest rose to 43% of Europe's security events, while conflict held steady.
- Shipping was hit on two fronts. Attacks around Hormuz continued under a US blockade of Iran, at least 35 in October on UKMTO's data, the most in any month of the war. In the western Black Sea, Romania blamed Russia for a drone that sank a cargo ship.
- Ransomware concentrated again. The top three groups' share of victims rose from about a quarter to about 38%. Qilin almost doubled its share in the month an alleged core member was arrested in Germany.
- Edge devices and the web stack dominated exploited vulnerabilities. CISA added 36 vulnerabilities to its Known Exploited catalogue, led by VPN, remote-access and email-security appliances, and by PHP. Three Ivanti Connect Secure flaws were exploited as a chain to take over VPN gateways without logging in.
- PHP2Shell: the warnings ran ahead of the harm. The alarm was immediate, but confirmed, successful exploitation took about five days to follow. Several criminal forums that run on PHP went offline on the day of disclosure and had to patch like everyone else.
- North Korea is blamed for the largest crypto theft on record. About US$6.3 billion left Binance's online wallets on 29 October. On 31 October the FBI attributed the theft to North Korea's TraderTraitor unit. Binance says it has replaced about 95% of the stolen tokens from its own funds.
Inside the Report
- Geospatial & Physical Security — month-on-month shares of terrorism, conflict, violence, crime and activism, with France and the Gulf driving the change, and a map of protest and unrest across Europe.
- Maritime & Aviation — the tanker war around Hormuz, drone attacks on merchant ships in the western Black Sea, and the closure of Riyadh's main airport.
- Ransomware — the leaderboard, sectors and countries, and Qilin's return to the top.
- Vulnerabilities & Exploitation — what was exploited in October, from edge appliances to the PHP stack.
- Internet Signals — how quickly newly exposed services are found and probed.
- Cyber Underground — the forums that had to patch, fraud and data leaks, and AI cooling after September's surge.
- Spotlights — the Houthi campaign against Saudi Arabia; PHP2Shell, and whether the threat matched the hype; and the Binance heist.
Download the full report (PDF)
Get in touch if you'd like to discuss how these trends apply to your organisation, its supply chains or its operating locations.
Information correct at time of writing (2 November 2026). Some situations described, including ongoing investigations, may have developed since.