October 2026 in identity: edge zero-days, leaked developer tokens, and the fake help desk

October 2026 had three defining identity stories. First, edge and remote-access appliances were the front door again: NetScaler, Ivanti Connect Secure and BeyondTrust Remote Support all had exploited flaws land on CISA's KEV catalog, and in each case the appliance was a route to directory or vault credentials. Second, developer and AI tooling leaked credentials at scale, from a poisoned LiteLLM release to GitHub token campaigns touching tens of thousands of repositories. Third, attackers got past MFA by asking or replaying, not by cracking: fake IT help desk chats, vishing, and stolen session tokens. Meanwhile passkeys posted their strongest numbers yet, and Workday agreed to buy an access governance vendor.

Everything below comes from what SWI published in October. Each item links to our post, which links to the primary source.

Edge and remote-access zero-days, and the KEV catalog

• NetScaler SAML, twice. An exploited SAML flaw, CVE-2026-88779, went onto KEV on October 4 and forced a second upgrade on anyone who patched in late September. Days later Citrix disclosed CVE-2026-107406, a CVSS 9.5 overflow in IdP and SP configurations, which raised the floor again to 14.1-73.46 and 13.1-64.29.
• Ivanti Connect Secure. The CVE-2026-104935 login bypass got a three-day KEV deadline, and the attackers used appliance access to harvest LDAP and Active Directory credentials. On October 30 CISA added the last two flaws in the chain after Ivanti's October 29 patch.
• BeyondTrust Remote Support. Mandiant says the China-nexus group ARMORY CASTLE used CVE-2026-102764 as a zero-day against self-hosted BeyondTrust Remote Support and pulled every admin credential from the appliance vault.
• Fortinet and Palo Alto edge devices. The FBI and Secret Service warned that FortiBleed is still locking out victims by changing admin accounts; Unit 42 found the PeerStitch implant stealing VPN credentials from 500+ firewalls; and Qilin and INC used a GlobalProtect auth bypass at Palo Alto Networks gateways to skip MFA. Access broker k0t exposed more than 70,000 credentials from both vendors' devices.
• More pre-auth and auth-bypass bugs. SonicWall's SMA1000 CVSS 10 SSRF drew exploitation attempts within two days, HPE fixed three ArubaOS authentication bypasses, and Okta patched an Access Gateway command execution flaw rated CVSS 9.1.

The pattern matches our Identity Vulnerability Report 2026: edge and remote-access appliances hold 60% of the exploited identity CVEs we track (24 of 40 as of November 5), and the median wait from disclosure to KEV is 3 days.

AI agents and developer tools leaked credentials

• LiteLLM. A poisoned litellm 1.107.0 shipped a credential stealer to PyPI and Docker, and Wiz saw stolen AWS role credentials tested hours later. LiteLLM traced it back to an admin key committed in May that was deleted but never revoked.
• GitHub token campaigns. GitGuardian counted about 1,900 hijacked accounts and 30,000+ repositories in GhostAction's October wave; a follow-on phish completed GitHub's OAuth device flow; and Gheist planted 13,500+ branches to print secrets into Actions logs. The Shai-Hulud stealer reached the tensorlake SDK with a wiper that fires if you revoke the token first.
• Publishing and registry trust. npm's trusted publishing let reclaimed repo names mint tokens for 1,500+ packages, and Docker Hub's GhostPAT flaw handed tokens to anyone named owner during an org conversion.
• Platforms holding customer secrets. Railway said up to about 100,000 workspaces may have had environment variables decrypted, Zeabur is shutting down after a non-expiring admin token exposed 3.2 million records, and an OpenCode Console breach may have exposed saved AI provider keys.
• Agents and AI tools as the attack path. One prompt pulled AWS AgentCore role credentials from IMDS, an encrypted web page got Copilot CLI to leak .env secrets, a tampered Claude Code extension on Cursor's marketplace planted an SSH key, and a shared ChatGPT link could read the viewer's session token. Cequence saw one scanner pose as 32 AI bots to hunt for .env files and SSH keys.
• App identities across tenants. A stolen ConnectWise app credential opened Microsoft 365 tenants across MSP customers in Microsoft Entra ID, and Microsoft later said Storm-0940 used those identities to try more than 2,250 tenants.

The common failure was a credential that outlived its purpose: deleted but not revoked, never set to expire, or never rotated after a 2025 incident.

Help desks, vishing, and stolen sessions

• The fake IT help desk. Arctic Wolf counted 400+ intrusions over Teams external chat that started with inbox flooding and ended in Quick Assist, some reaching code execution within 15 minutes.
• Vishing and impersonation. Dexcom said targeted voice phishing reached internal documents, and ASOS said an attacker posing as a trusted contact got an employee's login.
• Session replay over MFA. Huntress tracked one actor replaying stolen tokens into 79 Microsoft 365 organizations and swapping MFA methods to survive password resets. Fake ChatGPT, Gemini and Claude ad portals captured credentials and MFA codes with a live operator, and the AuthMask flaw let Android apps pull work tokens from Microsoft Authenticator.
• One credential, large losses. Binance tied a $6.3 billion theft to a compromised DevOps engineer laptop. Weak passwords still mattered: a 123456 password was linked to Denmark's CPR breach of 8.8 million people, and the UK ICO reprimanded two bodies over a 12-year-old test account with Password1.

Identity M&A and funding

• Workday agreed to acquire C1, formerly ConductorOne, to tie C1 access governance to the HR lifecycle, with close expected by January 31, 2027.
• IonQ agreed to buy Elisity for up to $1.3 billion in stock, a quantum company paying for per-identity network policy.
• Infisical raised a $40 million Series B at a $600 million valuation, partly for brokering AI agent credentials.
• IBM made Agent Identity and HashiCorp Vault 2.2 generally available, giving agents their own accounts in HashiCorp Vault.

Passkeys and standards

• The FIDO Alliance's Passkey Index 2026 puts passkeys at 36% of successful sign-ins, up from 26%, with a 93% success rate. Amazon says 500 million customers have turned them on.
• Frontline work is lagging: a survey for Imprivata and FIDO found only 15% use passkeys without a password, and 33% have seen credential sharing.
• At Authenticate 2026, FIDO said it will publish wallet certification documents and opened an advisory forum. NIST opened an implementation hub for SP 800-63-4 with draft conformance criteria.
• PKI and protocol plumbing broke too: browsers blocked eight eMudhra intermediate CAs after their keys leaked, GitLab fixed a SAML and LDAP account takeover, and an NGINX session ticket bug could skip client certificate checks.

Regulation, digital ID, and enforcement

• India ordered caller name display (CNAP) from November 1, a network-level identity signal against fraud calls.
• Bank of America told customers not to give AI agents their banking password, and that they are responsible for activity from shared credentials.
• The DOJ charged 14 people and shut 40+ laptop farms that let North Korean IT workers pose as US employees.
• The FBI said a contractor's missed patch led to the ShinyHunters breach of FBI employee records.

New from SWI research this month

On October 30 and 31 we published seven reports and three tools:

• Identity Vulnerability Report 2026: 115 identity CVEs checked against KEV; 30% are exploited.
• Identity Consolidation Report 2026: 63 acquisitions across 297 vendors; outside buyers pay about 99% of the money, and 67% of vendors stay independent.
• Identity Pricing Transparency Index 2026: only 27% of 295 identity vendors publish a paid price.
• Agent Identity Standards Map 2026: 70 AI agent identity specs, sorted into final, draft and missing.
• Identity Breach Report 2026: across 120 breaches, MFA was bypassed in 25 of the 40 with a known MFA status, and 46.5% of 2025-2026 cases had no login for MFA to protect.
• Identity Funding Report 2026: 99 equity rounds and $4.40B priced; half target AI agents.
• Phishing-Resistant MFA Matrix 2026: 54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them.
• Tools: the Identity Breach Database, the interactive MFA matrix, and the Identity Compliance Calendar.

What to watch in November

• November 9 to 10: Identiverse holds its first Washington, D.C. area event at National Harbor, MD.
• November 10: CMMC Phase 2 begins, and DoD intends to require Level 2 third-party certification, which covers MFA and least privilege, in applicable contracts.
• November 12 to 19: SailPoint runs the last SailPoint Navigate regional stops in Sao Paulo, Singapore and Tokyo.
• November 13: the federal KEV deadline for Ivanti's CVE-2026-118527. If you patched Connect Secure only on October 13, you are not done.
• November 30: the statutory review of Australia's Digital ID Act is due.

The Internet Identity Workshop wraps up today in Mountain View. Then expect more of October: edge appliance advisories with short KEV deadlines, and more developer tokens that someone forgot to revoke. Check your own long-lived tokens before an attacker does.