67.6M Records Breached, 86% of Firms Hit by Hiring Fraud: October 2026's Twin Crisis

Oracle Health (Cerner): 20 million patient records exposed, traced to credential abuse in 2025

State attorney-general filings confirmed about 20 million patient records were compromised after attackers used stolen customer credentials against legacy Cerner systems. The access went undetected from 2025 into 2026. It is a clear case of the risk from credentials that are never rotated, legacy health-record systems and missing anomaly detection.

What to do: if you use Oracle Health or another legacy EHR platform, audit credential hygiene and access to legacy systems now.

Malicious LiteLLM 1.107.0 published to PyPI and the official Docker images

Attackers used compromised GitHub tokens to publish a LiteLLM release carrying a credential stealer and a backdoor. It was available through official channels for about two hours before it was removed. The root cause was an internal key exposed in May and never revoked. This is LiteLLM's second security incident of 2026: AI tooling needs the same supply-chain discipline as any production dependency.

PHP core remote code execution (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) exploited in the wild

Two unauthenticated remote code execution flaws in PHP itself were emergency-patched on 21 October after technical details leaked ahead of the planned disclosure. Exploitation was reported within hours. PHP runs roughly three-quarters of server-side web applications.

What to do: confirm the patched PHP version on every PHP application and server, and add WAF rules that block exploitation attempts until patching is complete.

Microsoft's October Patch Tuesday: a record 1,413 CVEs, including an actively exploited Windows Shell zero-day

The release included CVE-2026-96951, a Windows Shell security-feature bypass that was exploited before a patch was available. At this volume, prioritising patches by hand is no longer practical for an enterprise. Automated, risk-based patch management is now a baseline requirement.

SBI customer records on the dark web: about 375,000 records, 3,897 with personal data

A dark-web dataset of roughly 375,000 SBI customer records surfaced in October 2026, of which 3,897 contained personally identifiable information. The source is under investigation, and a breach of SBI's core systems has not been confirmed. The case shows the risk from data aggregators, fintech partners and API integrations that hold banking customer data with weaker controls than the bank itself.

eMudhra intermediate CA certificates revoked worldwide after weak private keys were found

Researchers found that the private keys of eight eMudhra intermediate certificate authorities could be recovered from their public certificates because of weak key generation. Major browsers and vendors revoked the affected intermediates. The incident raises hard questions about PKI governance at Indian certificate authorities, especially those issuing certificates for government and banking systems.

CERT-In urges 12-hour patch cycles as AI shortens the time to exploitation

CERT-In's October advisory calls for 12-hour patch cycles where feasible, because AI-assisted exploitation is shrinking the gap between disclosure and attack from days to hours. Microsoft Windows, Office and cloud authentication flaws are flagged as the highest priority. The 6-hour incident reporting requirement still stands.

Checkr 2026 (3,000 US managers): 40% interviewed a candidate using a fake identity, up from 31%

86% of organisations saw at least one type of hiring fraud in the past year. 38% suspect a fraudulent employee is on their payroll right now, and 28% admitted advancing a candidate they suspected of dishonesty because the role was urgent.

22% of recruiters have confirmed a deepfake in a video interview

In a Pin survey of more than 475 recruiters, 22.4% confirmed a deepfake or identity swap in a video interview and a further 16.3% suspected one. A large meta-analysis puts human accuracy at spotting deepfakes at 55.54%, barely better than a coin toss. 68% of hiring managers say candidates now fake identities with AI faster than employers can catch them.

HYPR 2026: 98% have faced candidate fraud, and 44% have no post-hire identity check

For one company in four, resolving a fraudulent hire took one to three months. Fraudulent hires averaged 5.73 days of system access before they were detected.

DPDP consent manager framework starts in November 2026: background checks must be ready now

Background verification programmes will need to show that candidate consent was collected digitally, covered only the checks actually run, and that data handling can be audited. Manual or email-based workflows will fall short. The full set of obligations (notice, security, breach reporting) follows on 13 May 2027.

Post-hire fraud is India's fastest-growing background-check blind spot

Pre-hire checks are now common, but the period after joining is largely unmonitored. In iChek's October 2026 verification data, duplicate employment through UAN manipulation, upgraded qualifications on internal HR records and undisclosed concurrent jobs are the fastest-growing fraud patterns among mid-to-senior staff. One-time pre-employment checks miss all three.

Healthcare and pharma: rising credential fraud where the stakes are highest

Fabricated nursing, pharmacy and clinical-research credentials are increasing across private hospital groups and pharmaceutical manufacturers. Here a fake qualification is a patient-safety risk, not just a contract problem. Mid-career lateral hires are the highest-risk group.