Our weekly review covers 16 to 22 October. The approach does not change: the events that matter, read through the eyes of a risk owner rather than an analyst, and for each one, what it changes for a Canadian organization.
The last issue was about the equipment nobody managed. This week the thread runs elsewhere: the people who keep your secrets. A ransom negotiator suspected of working both sides of the table. A command-line tool and an AI library swapped for credential stealers, inside the very pipeline that updates your machines. In Canada, a security firm, an information-management software vendor and two intellectual property law firms claimed within four days. Each time, the target was not the end victim. It was the person, the tool or the firm to which others had entrusted their keys, their documents, their patents. And each time, the question for leadership is the same: what did we hand over, to whom, and what does the contract say on the day it breaks?
Part 1: delegated trust, attacked link by link
The negotiator who knew about victims before they did
On October 19, journalist Brian Krebs reported that the FBI suspects an executive at a US ransomware negotiation firm, "a prestigious firm with more than 1,000 associates" according to his sources, of helping the ShinyHunters extortion group run the website that pressured its victims into paying. The site, live from May 3 to October 16, listed close to a hundred organizations. The executive has not been charged. A few days earlier, on October 8, a Canadian industry executive, formerly a managing partner at a Canadian ransomware response firm, had been arrested in Pennsylvania and charged with conspiracy to extort; his former employer denies any role in ransom payments. According to Krebs's sources, these negotiators "often knew the details about new ShinyHunters victims before the victims themselves." The FBI puts the group's take this year at more than US$70 million. Status: the arrest and charges are on the court record; the rest is alleged by anonymous sources, and nobody has been convicted.
Two supply chains hijacked within 48 hours
On October 19, between 14:47 and 16:21 Paris time, an attacker used a developer's hijacked account to replace the GitHub release binaries of five versions (v0.11.0 to v0.15.0) of OVHcloud's command-line tool. About 250 downloads. The substitute program stole everything a developer's machine keeps on disk: AWS, Google Cloud and Azure credentials, SSH keys, Docker, Kubernetes and Terraform configurations, and the databases of AI coding assistants (VS Code, Cursor, Continue, Cody, Claude). OVHcloud's advisory says how the account was stolen: the developer's personal laptop had been compromised months earlier by a malicious VS Code extension. And why the swap was possible: the repository did not enforce release immutability, and the organization allowed personal GitHub accounts. Source code and build chain were untouched. Status: confirmed by OVHcloud.
On October 21 it was LiteLLM's turn. LiteLLM is a widely used gateway that connects applications to AI models, which means it holds the API keys for every provider behind it. Its release pipeline was compromised: for 1 hour 44 minutes, version 1.107.0 on PyPI, and for a little over two hours, the "latest" Docker images, carried a program that steals credentials, loads remote-execution tools and relaunches itself every time Python starts. The attacker held the team's GitHub tokens, overrode branch protections and ran the release from a lookalike repository, one hyphen away from the real one. Security firm Wiz estimates the poisoned version was downloaded some 49,000 times. It is LiteLLM's second hijack in seven months: in March, two versions were poisoned through a security scanner that had itself been compromised. Status: confirmed by the vendor; initial entry point still under investigation; download count reported by a third party.
What it changes: three links, one mechanism. The end victim did nothing wrong. It downloaded the official update, installed the standard library, called the recommended negotiator. Trust had been delegated, and the delegate gave way. For leadership, the question is no longer "are our vendors serious?" but "which of them can put code or hands into our systems without anyone on our side doing anything?" A tool that updates itself, a remote-support product, a library with no pinned version, a negotiator called in the middle of a crisis: each deserves a line in the register, a named owner and a verifiable requirement. Signed, pinned and immutable releases for code; and for the negotiator, a choice made calmly, in the incident plan, not under the pressure of a ransom note.
Part 2: the edge, the patch that was never applied, and PHP
BeyondTrust and Fortinet: three days to act
We opened the week on Monday with BeyondTrust Remote Support, the remote-control tool used by support teams: an authentication bypass (CVE-2026-102764, CVSS 9.3) exploited since August 29 by an actor Google and Mandiant suspect is linked to China, to dump the credential vault, open sessions to endpoints and wipe the logs. CISA added it to the KEV catalog on October 16 with a three-day deadline, due Monday. The same day it added a "medium" Fortinet flaw (CVE-2025-61624): a path traversal in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, which already requires privileged access, and which Fortinet confirms is exploited. Status: confirmed by CISA and the vendors; attribution suspected.
Palo Alto: patched in May, exploited in October by ransomware groups
On October 19 and 20, Unit 42, Palo Alto Networks' research team, updated its brief on CVE-2026-0257 in the GlobalProtect VPN portal (PAN-OS and Prisma Access): the Qilin and INC ransomware groups are exploiting it on unpatched appliances to open VPN sessions without valid credentials, straight past multi-factor authentication. Once inside: remote management tools to map the network, a detour through vCenter to disable an integrity control on ESXi hypervisors, then password extraction straight from a domain controller's virtual disk, which sidesteps the detection agents installed inside the machine. The fix dates from May 13; the flaw has been in KEV since the same day. It only affects portals where the "authentication override" cookie is enabled, a convenience that spares users from re-authenticating, and Palo Alto offers two workarounds: a dedicated certificate for that cookie, or turning the feature off. Status: confirmed by the vendor.
PHP: two flaws out before their time
On October 20, the PHP team announced fixes for two critical flaws for the next day at 14:00 UTC, reserving the right to publish earlier if details leaked. They leaked the same day, in a forum post, ahead of the disclosure planned for the 22nd. The fixes shipped on the 21st as announced: CVE-2026-109618 and CVE-2026-109619, rated 9.2 by PHP, unauthenticated remote code execution that "affect[s] all PHP installations serving web requests" according to CISA. Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus source patches for the 7.4 to 8.1 branches the project no longer maintains. CISA's October 21 alert says what leadership needs to hear: inventory first, because "PHP is often a component of other software and prevalence may not be directly observable"; patch starting with internet-facing systems; take offline what you cannot patch, especially versions 8.1 and older; a web application firewall as a stopgap. The UK's NCSC calls for immediate updating. As of October 21, CISA had not observed exploitation; Cloudflare says it is seeing early attacks and Amazon reports an attempt against its honeypots as early as the 17th. This morning PHP published a third advisory (CVE-2026-115560) on the same upload-progress feature, with a setting to disable until the next release. Status: confirmed by PHP and CISA; exploitation reported by third parties.
Plex: 36,000 servers, at home and at the office
On October 20, CISA also added to KEV the four flaws of the "Plex2Shell" chain in the Plex media server (chain rated 9.8): a proof of concept published on the 16th, first exploitation on the 17th, then cryptocurrency miners and proxy malware that relays other people's traffic through the victim's network. The fix has existed since August 3; Shadowserver still counted more than 36,000 exposed, unpatched servers in early September. Status: confirmed by Plex and CISA; exposure count reported.
What it changes: run these five facts through the three filters we lay out tomorrow: exploited, exposed, targeted. The Fortinet flaw is "medium" and exploited: the score does not tell you the urgency. The Palo Alto flaw has been fixed for five months and still serves ransomware groups: "fixed by the vendor" is not "applied here", and a convenience feature was enough to cancel MFA. PHP is not "a server": it is a component of your intranet, your website, your vendor's tool, and you will not patch it if you do not know where it runs. A Plex server on the office NAS makes your IP address somebody else's infrastructure. The governance decision does not change from one week to the next: what is reachable from the internet here, in which version, and who checks every month?
Part 3: Canada, the firms that keep other people's secrets
Four days, three claims, three professions built on trust.
On October 19, the Qilin group claimed GardaWorld, the Montreal-based security services and cash-handling company, one of the largest in the world in its field. No detail published on the nature of the data, and no statement from the company that we are aware of. In November 2025, CodeRED, the emergency alert system operated by its Crisis24 subsidiary and used by municipalities in Canada and the United States, had been taken offline after a cyberattack, with citizens' contact details at stake; client municipalities confirmed it. Status: claimed, unconfirmed; the 2025 incident confirmed by clients.
On October 20, Mimori, a group that surfaced this month with three victims to its name, claimed OpenText, the Waterloo vendor of enterprise information management software, announcing 94,306 files and a publication date of October 29, according to leak-site trackers. No sample, no screenshot, and no statement from the company that we are aware of. Status: claimed, unconfirmed.
On October 21, INC Ransom listed Bereskin & Parr and Smart & Biggar, Canada's two largest intellectual property firms, in the process of merging under the same Australian owner, citing a "database" and "client case data". INC is one of the two groups Unit 42 sees exploiting the Palo Alto flaw above; nothing links the two facts. Status: claimed, unconfirmed.
And on October 16, The Gentlemen claimed ServiceMaster of Ottawa, a property restoration and commercial cleaning company. Status: claimed.
The context: by our count of claims published on ransomware.live, 268 Canadian organizations have been claimed by ransomware groups since January 1, 2026, four more than a week ago. Manufacturing still leads (50, or 18.7%), followed by professional services (46, 17.2%) and technology (38, 14.2%): this week's three claims fall into the second and third boxes. These are claims, not confirmed incidents, and the country assigned by leak sites is sometimes wrong. Statistics Canada, in its 2023 survey, counts 16% of Canadian businesses hit by a cyber security incident (30% of large ones) and $1.2 billion in recovery costs, double the 2021 figure. The Canadian Centre for Cyber Security, in its 2025-2026 assessment, writes that groups seek to exploit a single supplier intrusion to trigger a cascade of incidents, and that ransomware attacks on digital supply chains will almost certainly continue.
What it changes: a security firm holds its clients' guard schedules, floor plans and alarm codes. An information management vendor holds, by definition, other people's documents. A patent firm holds inventions that are not yet public and litigation files. If any of these claims is confirmed, the victims are first and foremost their clients, and those clients will find out, at best, by letter. For leadership, the question is not whether this or that vendor is serious. It is: which of our vendors hold our secrets, what have we required of them in writing (72-hour notification, encryption, right to audit, destruction at contract end), and could we say within a day what they held of ours? Our free vendor security questionnaire asks those questions in order; on Tuesday we turn to the vendors you cannot lose.
Part 4: AI on both sides of the table
On October 19, Microsoft published "Securing the agentic insider" and introduced Guardian Agents, agents that watch other agents, as part of its Project Perception program. The line that matters comes from Hayete Gallot, who runs Microsoft's security business: "frontier models, regardless of their origin, cannot be trusted." Not out of malice, but unpredictability: they are trained to complete a task, not to follow an organization's norms. Microsoft therefore proposes treating every agent as an insider: its own identity, minimal permissions adjusted to the task, human approval for risky decisions, and containment when behaviour drifts (the agent keeps read access, loses approval and write powers). Its Defender tool claims to spot up to 60 types of agents employees bring to work, Claude Code and Codex among them. Satya Nadella, in an October 10 post: "We simply can't outsource responsibility for what intelligence does on our behalf," and "A model provider's assurances do not relieve us of that responsibility." Status: confirmed by the company; features in private preview, availability announced for mid-November.
On the attackers' side, the two hijacks in Part 1 show where the appetite is going. The program slipped into OVHcloud's tool targeted the databases of AI coding assistants by name, alongside cloud keys. LiteLLM is an AI gateway: compromise the gateway and you hold the keys to every model behind it. And in its notice, LiteLLM floats a hypothesis about where its stolen GitHub tokens came from: a Claude Code behaviour that, in some cases, copies the user's GitHub token into a response, which then ends up in logs; the vendor says it has not confirmed it yet. Status: confirmed by OVHcloud for the targeting; vendor hypothesis for LiteLLM.
What it changes: the company that sells more agents than anyone says they must be watched from outside the model, with an identity, a perimeter and a kill switch. That is what our series asked ten days ago: an agent is a privileged account. Add what this week teaches: the keys to your AI tools (coding assistant tokens, API keys in the gateway, logs that copy them) are now the first thing thieves look for on a developer's machine. Your inventory of AI uses must say where those keys live, and governance you can't measure, our Thursday episode, gives the indicators to check it.
The three questions of the week for an executive committee
- Which vendors, tools or libraries can execute code or open a session in our environment without anyone on our side clicking, and which of them guarantee signed, pinned and immutable releases?
- Which of our providers hold our secrets (lawyers, security, software vendors, cloud), what does each contract say about notification deadlines, and could we say within 24 hours what they held of ours?
- Of the flaws our vendors have fixed in the past six months, which are still open here on an exposed device, and in what order do we close them?
If the third question has no one-page answer, thirty minutes with an expert is enough to run your list through the three filters and come out with five to ten actions. To see what is actually reachable from the internet at your organization, versions included, the free exposure report shows it in 48 hours, nothing to install. Forta Suppliers keeps the list of providers that hold your secrets and what you require of them; Forta Radar tracks the claims and exploited flaws aimed at your sector.
One last word, then we stop talking about ourselves
Tomorrow, our Saturday article picks up Part 2's grid: a critical vulnerability isn't necessarily urgent, three filters to prioritize. On Sunday, the risk series puts exposure in the register: what attackers see first. On Monday, alongside the news, an article on talent: the shortage didn't vanish, it moved to your vendors. And on Thursday, October 29, the first issue of "AI Thursday", our weekly newsletter on adopting AI without losing control: sign up, unsubscribe in one click.
Sources: CISA, BeyondTrust Remote Support alert (Oct. 16) · CISA, two flaws added to KEV (Oct. 16) · CISA, six flaws added to KEV (Oct. 20) · CISA, PHP alert (Oct. 21) · PHP, security announcements of Oct. 20, 21 and 23 · NCSC (UK), PHP · Palo Alto Networks, CVE-2026-0257 · Fortinet, FG-IR-26-122 · BeyondTrust, advisory BT26-05 · Google Threat Intelligence Group and Mandiant, ARMORY CASTLE · OVHcloud, advisory GHSA-862f-55f5-vmvw · LiteLLM, Oct. 21 incident notice · Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026 · Statistics Canada, Canadian Survey of Cyber Security and Cybercrime 2023