No Zero-Days Needed: What Attackers Exploited in October 2026

across the access and exploit listings posted between 19 September and 9 October, not one intrusion required a technique that did not already exist. Sellers described Apache Struts, SMB, Telnet, phpMyAdmin, WordPress and broken permission checks — and exactly one current CVE, in a service most organisations do not know they are running.

These are the sellers' own descriptions of what they used. They are writing for buyers who would call out a lie, which makes them the most honest account of working tradecraft available.

The one you should act on today

A seller documented exploiting CVE-2026-42589 in Gotenberg 8.23.0 against ESAM University in Bolivia, achieving remote code execution and then privilege escalation.

Gotenberg converts HTML to PDF. Developers embed it, it runs in a container, and it appears on almost no asset register — which is precisely why it is worth the post. Search your environment for it by image name, not by asset inventory, because the inventory will not have it.

The CVE-2026-42589 write-up. Capture the method section; redact any host names.

And the one that should not still work

Another seller used CVE-2017-5638 — the Apache Struts flaw behind the Equifax breach — to take root on four servers, one of them a Canadian university. Their post notes they found active external user sessions on the compromised host.

Nine years of advisories. Still returning root, still finding live sessions to ride.

A 2017 vulnerability, exploited this month, with a tool the seller advertises alongside it.

Services still listening that nobody meant to leave on

• Port 445. GOLDUNITED SDN BHD in Brunei lost every Windows system to ransomware over SMB, exposing financial records, HR files and foreign worker permits. The same week, “full data and SMB access” to Emirati insurer Hosn Al Sharjah went up for sale.

• Telnet, on Windows 2000. A UK server-management host, which the seller valued not for itself but as “a gateway to a subnet”.

• phpMyAdmin with root credentials. Published free, with the URL, for a Mexican university. No sale, no negotiation — posted for reputation, which means there is no window in which anyone could have intervened.

• WordPress. A remote exploit gave a seller full access to a US dental group's site and database: patient records, insurance details, appointments, prescriptions.

Authorisation, not authentication

Three of the month's most serious listings involved systems where login worked exactly as designed and the checks behind it did not.

A permissions flaw on Nigeria's Edo State judiciary site yielded administrative reach over a claimed 52 million court records. The FBI's Federation Services portal was described as exploited through local file inclusion, session fixation and exposed sensitive files, reaching Federal Firearms License data. And @pouahaha offered the Comptroller and Auditor General of India's database, admin panel and a web shell as a single $300 bundle with proof attached.

Energy is being probed for reach, not data

A seller used tooling they call TRK25 against Saudi Ghawar Petroleum, describing enumeration of multiple SCADA and PLC systems and exploitation of several, against live oil and gas production.

Days earlier, the main control panel of a Siemens Energy gas engine plant — posted while displaying active fault alarms. Days later, SCADA access to a fuel station in Cedar Grove, Wisconsin, complete with fuel inventory readings.

A live plant control panel, posted with faults showing on screen.

Access is being banked

One post deserves reading twice. A seller took a Windows Server by capturing the password as the user typed it. The machine was new and held nothing of value. Their stated plan was to keep the access for later encryption.

That is the gap between intrusion and incident, described by the person holding it. An empty result from a compromise assessment is not the same as an absence of access.

Access taken, nothing stolen, kept for later. The intrusion and the incident are separate events.

Credentials are now sold by employer

The combolist trade has stopped selling volume and started selling targeting. Bundles arrive labelled by country — Italy at 739,000, the UK at 428,000, Colombia at 252,000 — and, more usefully to an attacker, by employer with the suffix “HQ”: Ubisoft HQ, PayPal HQ, Twitter HQ, one listing simply titled “Binance Coinbase Targeted HQ Lines”.

“HQ” means corporate accounts rather than customer ones. Someone has already done the work of separating your employees from your users.

One detail changes the response plan. India's National Informatics Centre dump was advertised as including detailed authentication and session data. Session material survives a password reset. If a listing naming your organisation mentions tokens, cookies or sessions, the control is session invalidation.

What to check this week

• Grep your container images for Gotenberg and any other embedded conversion or rendering service. Start here; it is the cheapest check on this list.

• Scan your own perimeter for 445, 23 and phpMyAdmin. Not the documented estate — the actual address space.

• Test one authorisation path. Pick a portal and try to read another account's record by changing an identifier. That is the whole technique behind the month's biggest government listings.

• Add session invalidation to your credential-exposure runbook. If it currently ends at “force password reset”, it is incomplete.

• Ask whether any Struts-era application is still reachable. Someone is still getting root with it.

Outlook

The economics favour this continuing. A seller who exploits a known flaw in forgotten software spends nothing on research and prices access at $300. Nothing about that changes while the software stays unlisted, so the advantage goes to whoever can answer what they are actually running — not what they think they deployed.