Threat Report: India, October 2026

Summary

October was dominated by attacks on edge devices — firewalls, VPN gateways, email gateways and remote-support tools — and by fraud aimed at payments. For families, the month’s risks were browser and phone updates and the familiar scam calls; for small organisations, unpatched internet-facing devices and PHP web applications.

1. Actively exploited vulnerabilities

The US CISA Known Exploited Vulnerabilities (KEV) catalogue lists flaws with evidence of real-world exploitation. Catalogue version 2026.10.23 holds 1,756 entries. Between 1 and 23 October 26 were added (43 in September). None of October’s additions is yet marked as known to be used in ransomware campaigns.

Older flaws keep coming back: on 8 October five vulnerabilities from 2015–2023 (in BIND, Apache Struts, Strapi, ONLYOFFICE and ProFTPD) were added after fresh exploitation was seen — a reminder that “old” does not mean “safe”.

2. CERT-In in October

CERT-In published 9 advisories (CIAD-2026-0046 to 0054) and 44 vulnerability notes between 1 and 26 October, of which 27 were rated Critical, 15 High and 2 Medium. Advisories that stand out:

• Payments and lending (9 Oct, Critical): threat actors abusing payment and disbursement APIs for unauthorised fund transfers at NBFCs, digital lenders, fintechs, payment service providers and wallets.
• AI agents as an attack vector (15 Oct, Critical): attacks that use AI agents against Indian ICT assets.
• MSMEs — PHP remote code execution (22 Oct, Critical): affected PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.3. Small businesses running PHP websites should update now.
• Software supply chain (21 and 23 Oct): compromise of intermediate certificate-authority certificates of an Indian CA, and a compromised LiteLLM PyPI package (1.107.0) and Docker images.
• Monthly vendor patches: Microsoft (14 Oct), SAP (14 Oct), Oracle (22 Oct) and Fortinet (24 Oct).

For home users, the notes to act on were the four Critical Chrome desktop notes (1, 6, 14 and 26 October), Apple (1 Oct), Mozilla (5 Oct) and Android (6 Oct), plus curl/libcurl and the Google Brotli decoder (26 Oct), which ship inside many apps.

3. The fraud picture

Official figures released this year show the scale of payment fraud — and that fast reporting works:

• As of 30 June 2026, the Citizen Financial Cyber Fraud Reporting and Management System had saved more than ₹11,158 crore across more than 32.8 lakh complaints, according to the Ministry of Home Affairs’ reply in the Rajya Sabha on 12 August 2026 (as reported by Outlook Money).
• The same reply put the Suspect Registry at 30.5 lakh suspect identifiers and 32.1 lakh first-layer mule accounts.
• The Department of Telecommunications told the Rajya Sabha on 5 February 2026 that citizens filed 5,19,662 reports on Sanchar Saathi’s Chakshu in 2025, up from 2,08,224 in 2024 (as reported by Angel One).
• The RBI Annual Report 2025-26 recorded 10,114 bank and financial-institution fraud cases worth ₹48,021 crore in FY26 (frauds of ₹1 lakh and above; as reported by PTI).

4. Five actions for this month

1. Update browsers and phones today — Chrome, Firefox, Safari, Android and iOS all had important fixes in October.
2. Organisations: patch or isolate edge devices from Fortinet, Citrix, Ivanti, Palo Alto Networks, Cisco and BeyondTrust listed above. Internet-facing devices are the front line.
3. Small businesses on PHP: move to the fixed PHP releases named in CERT-In’s 22 October advisory.
4. Fintechs and lenders: review payment and disbursement API controls against CERT-In’s 9 October advisory.
5. Families: remember that banks never ask for an OTP, PIN, CVV or password, and never install an app because a caller asked you to.

How TotalHeal helps

At home, TotalHeal blocks phishing and look-alike bank pages, warns when a remote-access tool starts during a suspected scam call and keeps definitions current with signed updates. For organisations, TotalHeal VulnSight Vulnerability Management matches devices against the CISA KEV catalogue, and TotalHeal PatchPilot applies the fixes.

About this report

This report uses public sources only, read on 27 October 2026. The KEV catalogue version used (2026.10.23) covers additions up to 23 October. CERT-In figures cover advisories and notes published 1–26 October. Government figures are quoted as reported by the press, with the original statement named. It contains no TotalHeal customer data.

All threat reports