Enforcement reached consent and data location, breach counts arrived late, and old flaws on edge systems drove the risk
Between Oct 10 and Oct 23, 2026, privacy and security news was driven by enforcement that dictates how data is handled, by incidents whose counts arrived late, and by old flaws used on edge systems. Every fact is judged against Oct 24, 2026.
Five conclusions
Enforcement now reaches the consent chain and the location of data
Norway's Datatilsynet fined Xandr NOK 92M, about EUR 8.6M, in a decision of Oct 2, holding that a joint controller cannot rely on another party's invalid consent. Texas settled with Temu on Oct 16 for $3M plus $8M for each year a data-security provision is violated, and the remedy fixes where the data lives. California's five 2026 CCPA settlements total $17.1M against $7.9M for nine in 2022-2025 (trade-press estimate), and the EDPB's draft fining guidelines take comments until Nov 13.
Breach counts arrive weeks after disclosure, and Japan is the volume story
Yamato Transport put its exposure at 5.31M records on Oct 16, and MM Research counted 454 Japanese leaks from January to September, 1.5 times a year earlier. CenterPoint Energy's Sept 14 8-K gave no count; a Texas attorney general listing later showed 1,062,060 Texas residents. OCR data shows 77 US healthcare breaches in July affecting at least 33,485,970 people, and ETS student files copied between May 22 and Sept 18 led to notices from Oct 16.
Cross-border rules held still; the one binding change is procurement
The EU-US Data Privacy Framework stays in force after Trump v. Slaughter (Jun 29), but its independence pillar is contested and the material holds no official reassessment. The only rule taking effect in the window is GSA's class deviation, effective Oct 19, with 72-hour notice. A report that the Commission confirmed Japan's adequacy on Oct 14 rests on one secondary source; Kenya's guidance covers 2 of 4 EU SCC modules, and a Thai act is only a draft.
Attackers keep using old flaws on edge and backup systems
CISA added 15 CVEs to KEV across five alert days from Oct 13 to Oct 20, and the Oct 20 batch peaked at CVSS 8.6. Qilin and INC exploit PAN-OS CVE-2026-0257 (CVSS 7.8), patched on May 13, and use Veeam CVE-2023-27532. The SafePay advisory AA26-293A of Oct 20 counts at least 600 victims, and Comparitech counts 306 healthcare ransomware attacks in Q3 2026, up 40% on Q2. Palo Alto did not say how many organizations were hit.
Risk from new code now moves in hours
The PHP2Shell flaws (CVSS v4.0 9.2) were patched on Oct 21 after an early leak; an attempt was logged on Oct 17, but widespread exploitation is not independently confirmed. PHP runs on 69.3% of sites with a known server-side language. LiteLLM 1.107.0 stayed on PyPI for about 104 minutes after an upload through accounts apparently reached with stolen tokens.
Items at a glance
| Type | Item | Date | Scale | Status (Oct 24) | Source |
|---|---|---|---|---|---|
| Enforcement | Xandr fine (Norway)GDPR Arts 6(1) and 9(1), real-time bidding on Grindr users | Decided Oct 2; announced Oct 12 | NOK 92M, about EUR 8.6M | DecidedAppeal status not stated | EDPB |
| Enforcement | Texas-Temu settlementUS-hosted data, restricted access from China | Oct 16 | $3M plus $8M per year of violation | Announced | pii.ai |
| Incident | Yamato Transport (Japan)Cyberattack first disclosed in September | Oct 16 | 5.31M records | Company statement | Asahi |
| Incident | CenterPoint Energy (US)Third-party access via an external-facing system | Texas AG listing, week of Oct 12 | 1,062,060 Texas residents | Reported7.49M claim unverified | TXLRS |
| Incident | ETS / California Dept. of EducationStudent files copied May 22 to Sept 18 | Notices from Oct 16 | Last three school years; count not stated | Notifying | Snowline USD |
| Rule | EU-US Data Privacy FrameworkFTC removal protection struck down in Trump v. Slaughter | Ruling Jun 29; analyses Oct 13, 20 | Decision not annulled | In force, under review (reported) | HLC |
| Rule | GSA LLM class deviationNo government data outside agreed premises | Effective Oct 19 | 72-hour notice | In effect | Inside Government Contracts |
| Advisory | SafePay advisory AA26-293AJoint FBI, CISA and partner advisory | Oct 20 | At least 600 victims; five CVEs | In effect | CISA |
| Flaw | PHP2ShellCVE-2026-109618 / -109619, two unauthenticated RCE flaws in PHP core | Patched Oct 21 | CVSS v4.0 9.2 | Patch GAAttempts seen | Elastic |
Regulators fined consent chains and fixed where data lives: Xandr in Norway and Temu in Texas
This module gives the decisions and rules behind the first conclusion. Dates and statuses are judged against Oct 24, 2026; guidelines in draft are not binding.
Enforcement and rules at a glance
| Item | Key figure | Date | Status (Oct 24) | Source |
|---|---|---|---|---|
| Norwegian DPA fine on XandrGDPR Arts 6(1), 9(1) | NOK 92M, about EUR 8.6M | Decided Oct 2; announced Oct 12; EDPB summary Oct 16 | DecidedAppeal status not stated | EDPB; Skanopy |
| Italian DPA fine on Wind TreTelemarketing | EUR 16.7M | Listed by EDPB Oct 12 | ReportedDecision date and legal basis not stated | EDPB |
| EDPB Statement 1/2026Smart glasses | Preliminary guidance | Announced Oct 13 | Published | pii.ai |
| Texas AG settlement with Temu | $3M plus $8M per year of violation | Oct 16 | Announced | pii.ai |
| CalPrivacy Delete WeekDROP platform | 560,000+ registrants | Oct 12-16 | Reported | pii.ai |
| ICO agentic AI call for evidence | Responses due Nov 20 | Opened in week of Oct 12-18 | Open | pii.ai |
| EDPB draft Guidelines 04/2026 on fines | 5 steps, 14 examples | Adopted Sep 17 (context) | DraftComments to Nov 13 | Bird & Bird |
| Italian email-pixel guidelines | Compliance date Oct 29 | Adopted Apr 17 (context) | Upcoming, 5 days out | Hunton via pii.ai |
Reading the decisions
Datatilsynet's final decision of Oct 2, 2026 fined Xandr Inc. (formerly AppNexus, owned by Microsoft) for real-time bidding on Grindr users in Norway. The EDPB summary names GDPR Article 6(1), no legal basis, and Article 9(1), sexual-orientation data without a valid exemption. Xandr was a joint controller and relied on Grindr's consent, which was invalid under Articles 4(11) and 7.
"Compliance can never be outsourced": each joint controller must itself verify that consent is valid and covers its own processing.
Skanopy and Servola place the announcement on Oct 12, while pii.ai and SCLA say the EDPB published it on Oct 16; this page follows the EDPB's Oct 2 decision date and treats both later dates as publication. Microsoft told BleepingComputer it is reviewing the decision and assessing its options. The appeal window is three weeks from receipt, and the receipt date is not stated, so the deadline cannot be computed.
Highest ever by Datatilsynet, per Skanopy; the euro figure follows the authority's conversion (noyb quotes EUR 8.5M).
The EDPB adopted draft Guidelines 04/2026 on Sep 17 and opened consultation on Sep 21 (Bird & Bird); comments are open until Nov 13, 20 days from Oct 24. The guidelines are not binding and replace 2017 Article 29 Working Party guidance. For non-minor infringements Crowell & Moring reads the draft as a strong presumption to fine. Ceilings stay EUR 20M or 4% of worldwide turnover, and EUR 10M or 2% for lesser obligations.
Is the infringement fineable, can the party be fined, was it intentional or negligent, is it minor, and would a fine be effective, proportionate and dissuasive? Negligence exists if the company was in a position to know its conduct was unlawful, and legal advice is no safe harbour if it departs from known authority positions (Bird & Bird).
The EDPB's Oct 13 smart-glasses statement says manufacturers are controllers in their own right and cannot push duties onto wearers. Garante email-tracking-pixel guidelines become enforceable on Oct 29, as pixels generally need prior, specific consent.
Decisions the EDPB listed on Oct 9-12; the amounts are in the chart below.
On Oct 16, Texas Attorney General Ken Paxton announced a settlement with Temu (PDD Holdings and WhaleCo), resolving a February 2026 lawsuit. According to pii.ai, Temu must keep Texans' personal data on US-owned and controlled servers and restrict access from China, pays Texas $3M, and faces $8M for each year a data-security provision is violated. The attorney general's own release is not in the material.
Clym counted 14 CCPA settlements through Sep 29; five in 2026 total $17.1M, against $7.9M for nine in 2022-2025. General Motors' $12.75M (May 8) is about 75% of 2026's total (12.75 ÷ 17.1). The other four average about $1.09M, against about $0.88M before 2026. This is a trade-press count.
CalPrivacy reported 560,000+ DROP registrants, close to 100M profiles deleted and 660-plus brokers. SB 690 (signed Sep 30) leaves only the Attorney General able to bring CIPA pen-register actions over websites from Jan 1, 2027, and SB 923 widens deletion rights from the same date (context). The material shows no FTC privacy or data-broker enforcement action in the window.
Clym count through Sep 29; trade-press estimate.
Italy's Garante fines listed by the EDPB (EUR million)
The Garante held that IQVIA's persistent identifier defeated its anonymity claim, and Wind Tre's EUR 16.7M is the largest amount listed. Decision dates differ: Sep 23, Jul 3 and May 14 are before the window, and Wind Tre's date is not stated.
Incident counts arrived weeks after disclosure: Japan is the volume story, and US utilities and schools reported late
These are the incidents disclosed between Oct 10 and Oct 23, 2026 that will feed regulators' next cases. Victims are named only from company or authority disclosures, and group claims stay labelled as claims.
Incidents at a glance
| Country | Item | Key figure | Date | Status (Oct 24) | Source |
|---|---|---|---|---|---|
| Japan | Yamato Transport | 5.31M records | Oct 16 | Company statementUpdate to a September disclosure | Asahi |
| Japan | H2O Retailing / Hankyu Hanshin | About 1.26M H2O ID accounts | Oct 19 | Company disclosureData "may" be exposed | Asahi |
| Japan | IwaiCosmo Securities | Unauthorized trades; 4,975 people's data | Oct 20 | Company announcementAccounts restored | Asahi |
| Japan | Arcadia app (Japanese police) | About 61,100 staff across six forces (sum) | Oct 21 | Police statementsData "may" be exposed | Asahi |
| United States | CenterPoint Energy | 1,062,060 Texas residents | Week of Oct 12 | ReportedTexas AG listing via a law-firm site; 8-K was Sept 14 | TXLRS |
| United States | ETS / California Dept. of Education | All students of the last 3 school years; count not stated | Notices from Oct 16 | Confirmed by CDE (via districts) | Snowline USD |
| United States | US healthcare, July breaches | 77 breaches, 33,485,970 people | Published Oct 15 | OCR portal dataVia HIPAA Journal | HIPAA Journal |
Reading the incidents
Asahi Shimbun (Oct 19) says Japanese companies are "disclosing massive data breaches almost daily". On Oct 16, Yamato Transport said a cyberattack first disclosed in September exposed 5.31 million records. On Oct 19, H2O Retailing said unauthorized access to a Hankyu Hanshin Department Stores website may have exposed about 1.26 million H2O ID accounts, "almost the entirety" of its membership database, including names, contact details, birthdates and the last four card digits.
IwaiCosmo Securities announced on Oct 20 that attackers in its online trading system placed unauthorized trades and exposed names and email addresses of 4,975 people; accounts were restored to their pre-trade state, so customers had no losses. On Oct 21 police forces said staff data may have been exposed through disaster-app provider Arcadia: Kanagawa about 16,000, Saitama 13,000, Fukuoka 11,000, Aichi 15,000, Kagoshima 2,200 and Tochigi 3,900, a sum of 61,100 (our arithmetic; possible exposure, not confirmed theft).
Experts quoted by Asahi say attackers go for flaws in internet-facing apps and "known vulnerabilities or configuration errors" rather than long network intrusions. The Personal Information Protection Commission said on Oct 14 that "some basic security measures are being overlooked". Keio Corp. said it had confirmed that Qilin claimed to have published some personal data taken from a group company (claimed; date not stated).
MM Research counts, reported by Asahi.
CenterPoint filed an 8-K on Sept 14 saying a third party obtained personal information on "a portion" of customers through an external-facing system, after an online post claimed the data; it gave no count. A Texas AG breach listing, reported in the week of Oct 12, shows 1,062,060 Texas residents, with names, addresses, Social Security information and driver license numbers; consumers had not yet been notified. On Oct 14 the company said its investigation was continuing.
A forum poster claimed 7.49 million records from a CenterPoint API. CenterPoint has not verified this, and the two figures measure different things: 7.49M ÷ 1.06M ≈ 7.1 times, but one counts Texas residents and the other claims records in any state. The material holds no primary filing, only a law-firm page.
An unauthorized party used a compromised login on an ETS file-transfer site to copy student files between May 22 and Sept 18, 2026; ETS identified it on Sept 25. CDE confirmed it to districts on Oct 16, and notices began that day and run to early November. The files cover students enrolled in the last three school years, some who left since 2006, with names, birth dates, addresses, disability status and test results, but exclude Social Security numbers, financial data and passwords. Summit School District (Vermont) also filed a notice in October 2026 covering Social Security and card data; the day and the count are not stated.
KCRA says the breach "happened on Sept. 25"; this page follows the district pages quoting CDE, where Sept 25 is the discovery date. No count of students is in the material.
The OCR portal data, summarized by HIPAA Journal (page dated Oct 15) and echoed by calHIPAA on Oct 19, shows 77 large breaches in July affecting at least 33,485,970 people, 642% above June and 154% above the 12-month average of 13.2M. Hacking and IT incidents were 67 of 77 breaches (87%).
15,000,000 (estimate) + 9,540,683 + 3,803,750 + 3,756,469 = 32,100,902, about 96% of the month. They are DentaQuest (ShinyHunters claimed 234 GB), Aesto, Unlimited Technology Systems and CareCloud; three of the four are business associates.
Vendor tallies disagree because they count different things; the ransomware advisory from agencies on Oct 20 is covered in module 5.
Counted differently by each vendor (via Tech Insider).
Healthcare ransomware attacks per quarter
Comparitech, updated Oct 15. Rates are our arithmetic.
Cross-border rules held still: the Data Privacy Framework stays in force, and the one new binding clause is a procurement rule
The window brought commentary and one new binding clause rather than a treaty-level instrument. Drafts, guidance and single-source reports are shown as such.
Rules at a glance
| Item | Key figure | Date | Status (Oct 24) | Source |
|---|---|---|---|---|
| EU-US Data Privacy Framework (DPF) | FTC removal protection struck down; decision not annulled | Ruling Jun 29; analyses Oct 13, 20 | In forceUnder review (reported) | KU Leuven CiTiP; HLC |
| Japan adequacy (EU) | 2026 APPI amendments held "non-material" | Oct 14 | Reported (one source) | Lawxy Times |
| Kenya ODPC transfer guidance | Clauses for 2 of 4 EU SCC modules; localisation for 6 categories | Sept 2026; reported Oct 19 | Published guidance | TechAfrica News |
| China data-export practice | Shanghai guidance; first banking negative-list filing | Aug 2026 | Context | Bird & Bird |
| India DPDP Rule 15 | Transfers allowed unless country restricted; no list as of Apr 2026 | Oct 20 | CommentaryLater status not stated | Law Gratis |
| US GSA LLM class deviation | 72-hour notice; no data outside agreed premises | Effective Oct 19 | In effect | Inside Government Contracts |
| Thailand draft Digital Infrastructure Service Business Act | Localisation comments | Oct 15 | Draft bill | Global Data Alliance |
Reading the rules
The DPF is the current EU adequacy decision for the US, and it survived the window intact. The US Supreme Court held in Trump v. Slaughter on June 29, 2026 that FTC Commissioners can be removed at will. That matters because the Commission's DPF decision cited statutory limits on removal as support for the FTC's independence, a factor GDPR Article 45(2)(b) requires it to weigh.
Per HLC (Oct 20), noyb urged an "orderly exit", the EDPB asked the Commission to "closely assess" the effect (date not stated), and some Member States have opened investigations. HLC argues the DPF can survive: the ruling neither annuls the decision nor removes the FTC's enforcement power. KU Leuven's CiTiP blog (Oct 13) adds that the General Court dismissed MEP Philippe Latombe's annulment action (Case T-553/23); appeal status is not stated. An Alston & Bird panel (Oct 20) asked whether elected state attorneys general, in 43 states, could count toward equivalence. The material holds no Commission statement.
| Framework | Adopted | Invalidated | Lifespan |
|---|---|---|---|
| Safe Harbour | 2000 | 2015 (Schrems I) | 15 years |
| Privacy Shield | 2016 | 2020 (Schrems II) | 4 years |
| DPF | 2023 | In force | About 3 years |
The DPF is lawful today, but its independence pillar is now a political question, and no official reassessment was published in the window. "Under review" is reported, not official.
According to the Lawxy Times, the Commission decided on Oct 14, 2026 (cited as COM/2026/0459) that Japan's adequacy decision continues to apply, calling the 2026 APPI amendments non-material after a challenge by Japanese NGOs. This is one aggregator summarising a news item; the material holds no Commission text.
The ODPC's Guidance Notes (Sept 2026) give operational detail on Part VI of the Data Protection Act 2019 and Regulation 40. Standard clauses cover controller-to-controller and controller-to-processor transfers only, so 2 of the EU's 4 2021 SCC modules have no Kenyan equivalent. Localisation is limited to 6 categories, such as elections and basic health care. The EU noted "positive progress" on adequacy in June 2026, with no decision yet.
Bird & Bird (Oct 14) covers August 2026: Shanghai CAC issued data-export guidance for membership, marketing, supply-chain and HR scenarios; Beijing CAC completed the first filing under a banking-sector negative list; a central Action Plan (2026-2030) backs negative lists in pilot free trade zones. The statutory routes are unchanged: security assessment, standard contract or certification.
Under Section 16 of the DPDP Act read with Rule 15 of the 2025 Rules, transfers are allowed except to countries the government restricts; as of April 2026 none was listed, though Rule 15 lets the government set conditions on making data available to foreign states. No new India transfer instrument appears in the window.
"Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems" was finalised Sept 28 and took effect Oct 19, 2026. It bars transmitting, storing or accessing Government Data outside agreed premises or authorised services without written consent, requires contractors to maximise US-developed LLMs, restricts models controlled by adversary foreign governments, and sets 72-hour notice of material violations. It binds only GSA contractors.
The Diplomat (Oct 13) reports Uzbekistan easing its 2021 localisation amendment; the date and text of the change are not in the extract. The cost figures are estimates cited there, and the claimed PayPal loss of at least $1.8 billion over five years is 1.8 ÷ 5 = $0.36 billion a year.
On Oct 15 the Global Data Alliance criticised localisation in a draft Act proposed by MP Supachai Jaisamut; its definition of cloud services is tied to data centres located in Thailand. These are lobbying positions on a draft, not law. CDP's table lists mandatory localisation for China, Russia and Vietnam (certain data) and none for the EU/EEA, UK, Brazil or Japan; India has only sectoral rules.
Only the GSA clause is binding; the others are estimates or drafts.
Attackers kept using old flaws on edge and backup systems, while new code moved risk within hours
This module covers how attackers reached data and which flaws set the patch queue from Oct 10 to Oct 23. Most items are old or ordinary access paths into edge, management or runtime software, not novel techniques.
The window at a glance
| Item | Key figure | Date | Status (Oct 24) | Source |
|---|---|---|---|---|
| CISA KEV additions | 15 CVEs, five alert days (2+4+1+2+6) | Oct 13-20 | In effect | CISA alerts (via Inceptus) |
| Ivanti Connect Secure CVE-2026-104935 | Zero-day auth bypass | KEV Oct 13 | Exploited | CISA |
| BeyondTrust CVE-2026-102764 | Auth bypass, 26.2.3 and earlier | KEV Oct 16 | ExploitedPatch out | CISA |
| Plex2Shell (4 CVEs), Siemens, SiteGuard | CVSS 5.3 to 8.6 | KEV Oct 20 | Exploited | The Hacker News |
| PAN-OS CVE-2026-0257 | CVSS 7.8; Qilin, INC | Patched May 13; named Oct 19 | ExploitedVendor attribution | The Hacker News |
| PHP CVE-2026-109618 / -109619 | CVSS v4.0 9.2 | Patched Oct 21 | Patch GAAttempts seen | Elastic |
| SafePay advisory AA26-293A | 600+ victims | Oct 20 | In effect | CISA |
| LiteLLM 1.107.0 (PyPI) | Malicious release, no CVE | Oct 21 | Removed | Kodem |
Reading the attacks
The Oct 20 batch held six flaws: four Plex Media Server CVEs (CVSS 5.3, 6.9, 5.3, 8.6), Siemens Software Center CVE-2026-110936 (8.4) and SiteGuard CVE-2026-106931 (8.5), none at 9.0 or above. The Hacker News's opening line says "four"; CISA's alert feed says six, which this page follows. Federal civilian agencies had to fix three by Oct 23 (passed) and the rest by Nov 3 (upcoming). Plex had shipped its fix on Aug 3, 2026.
CISA said actors exploit Ivanti Connect Secure zero-day CVE-2026-104935 (25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier) to steal credentials and data. Commands run in memory, so Ivanti's Integrity Checker may miss them, and version 22.8 reaches end of life on Jan 31, 2027. BeyondTrust-hosted deployments were already patched; self-hosted versions older than 24.3.1 must upgrade first. Neither alert gives a CVSS score.
Palo Alto patched GlobalProtect authentication bypass CVE-2026-0257 on May 13, 2026, and CISA listed it that day; Rapid7 saw exploitation from at least May 17. On Oct 19 Unit 42 named Qilin (Spikey Scorpius) and INC (Tarnished Scorpius). After a VPN session the attackers reached vCenter, disabled ESXi execInstalledOnly and dumped domain controller credentials from its virtual disk, bypassing in-guest EDR; they also used Veeam flaw CVE-2023-27532. Palo Alto did not say how many organizations were hit, and the attribution is a vendor's, not law enforcement's.
Oct 20; FBI, CISA, U.S. Secret Service, German and UK partners.
Veeam's CVE-2023-27532 appears in both this campaign and the Qilin and INC one, so backup servers are a shared target. WaterISAC notes patches have existed for well over a year. CISA urges patching internet-facing KEV flaws, MFA, offline backups and segmentation.
On Oct 20 details of two unauthenticated RCE flaws in PHP core leaked early. The PHP team rated both critical (CVSS v4.0 9.2) and brought its release forward to Oct 21, 14:00 UTC. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older get no updates, apart from minimal backports for 7.4, 8.0 and 8.1. The PHP team says there is no complete mitigation, and mod_php is highest risk.
Elastic says Wiz Research reported the flaws with help from frontier AI models; FortiGuard says Calif found the first through AI-assisted code analysis on Aug 1. According to an AWS Builder Center post, Calif used OpenAI's GPT-5.6 Sol. This page reads it as two independent discoveries.
Attempts are documented; mass compromise is not. FortiGuard (Oct 22) says widespread exploitation is not independently confirmed, and watchTowr had seen none.
Seven wheels reached PyPI at 11:39 UTC on Oct 21 and were removed at 13:23 UTC, about 104 minutes later. LiteLLM puts Docker Hub cleanup at 14:20 UTC; Kodem says floating tags pointed at it until 17:13, which this page treats as an outer bound. LiteLLM says three engineers' GitHub accounts were used, apparently via stolen GitHub CLI OAuth tokens; no actor is named and there is no CVE. The last clean version is 1.106.2.
Payload files in Python startup paths (cook.pth, sitecustomize.py) ran without litellm being imported, stole cloud and AI-provider credentials, and polled hourly for code.
The tensorlake 0.5.144 npm worm (Oct 8) carried an npm provenance attestation, which shows where a package was built, not that it is safe. GhostAction, per a Kaseya digest, hit 772 repositories from Aug 31 to Sep 30, then 30,000+ on Oct 8 to 9.
Times in UTC; project statement unless noted.
CISA KEV additions per quarter
Severity did not set the order: the Oct 20 KEV batch peaked at CVSS 8.6, a five-month-old 7.8 flaw feeds ransomware, and the 9.2 PHP flaw drew probes before its patch.
Prove consent, know where data sits and patch what is already exploited: the checklist by audience
This module turns the fines, incidents, transfer rules and attack methods into who-must-do-what. It uses only measures named in earlier modules and is not legal or security advice.
Checklist by audience
| Audience | Measure named in the material | Trigger and deadline | Basis |
|---|---|---|---|
| Security teams | Patch internet-facing KEV flaws first; federal civilian agencies had to fix three Oct 20 flaws by Oct 23 and the rest by Nov 3 | Oct 20 KEV batch, CVSS 5.3 to 8.6 | The Hacker News; CISA |
| Security teams | Upgrade self-hosted BeyondTrust older than 24.3.1; plan off Ivanti 22.8, end of life Jan 31, 2027 | KEV Oct 16 and Oct 13 | CISA |
| Security teams | Move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; 8.1 and older get no updates | Patch GA Oct 21 | Elastic; FortiGuard |
| Security teams | Use MFA, offline backups and segmentation; treat backup servers (Veeam CVE-2023-27532) as a shared target; pin dependencies | SafePay advisory Oct 20 | CISA |
| Privacy officers | Verify that upstream consent is valid and covers your own processing; a joint controller cannot outsource it | Xandr decision Oct 2 | EDPB; Skanopy |
| Privacy officers | Add prior, specific consent for email tracking pixels in Italy | Enforceable Oct 29 | Hunton via pii.ai |
| Privacy officers | Comment on EDPB draft Guidelines 04/2026 | Comments close Nov 13 | Bird & Bird |
| US government contractors | Keep government data inside agreed premises; give 72-hour notice of material violations | In effect Oct 19 | Inside Government Contracts |
| Executives | Ask whether the DPF remains the transfer basis; no official reassessment is in the material | Reported, Oct 13 to 20 | HLC; KU Leuven CiTiP |
What changed and what it means, by reader
The window's flaws were old or ordinary access paths: KEV added 15 CVEs; PAN-OS CVE-2026-0257 (7.8) feeds Qilin and INC; SafePay lists five CVEs with patches over a year old.
Rank patching by exploitation evidence, not CVSS, and start with edge and backup systems.
PHP2Shell (CVSS v4.0 9.2) saw an attempt before patch; LiteLLM 1.107.0 was live about 104 minutes.
Pin dependencies; provenance alone is not proof of safety.
Xandr was fined NOK 92M (about EUR 8.6M); Temu must keep Texans' data on US servers.
Document where data lives and whether upstream consent is real.
Counts arrive late: CenterPoint's 8-K had none, a Texas listing showed 1,062,060; ETS notices began Oct 16.
Plan notification on the first facts, then update the count.
California 2026 CCPA settlements total $17.1M for five cases, 75% from one (GM, $12.75M).
One large case dominates the exposure; this is a trade-press estimate.
Japan counted 454 leaks Jan-Sep and 19 cases of 1M+ records by mid-October.
Treat consumer-data platforms as the exposed front door.
DPF in force but contested; the GSA clause is the only new binding rule; Kenya and Thailand items are guidance or draft.
Track the DPF; apply the GSA clause only if you are a GSA contractor.
Dates to watch: what is in effect on Oct 24 and what lands next
Dates already past on Oct 24, 2026 are marked "In effect"; later dates are upcoming.
Timetable
| Date | Event | State on Oct 24, 2026 | Source |
|---|---|---|---|
| Oct 2, 2026 | Norwegian DPA decision on Xandr | In effect | EDPB |
| Oct 13, 2026 | Ivanti CVE-2026-104935 added to KEV | In effect | CISA |
| Oct 16, 2026 | Temu settlement announced; ETS notices begin | In effect | pii.ai; Snowline USD |
| Oct 19, 2026 | GSA LLM class deviation takes effect | In effect | Inside Government Contracts |
| Oct 20, 2026 | SafePay advisory AA26-293A published | In effect | CISA |
| Oct 21, 2026 | Fixed PHP versions released | In effect | Elastic |
| Oct 23, 2026 | CISA due date for three Oct 20 KEV flaws | In effect | The Hacker News |
| Oct 29, 2026 | Italian email-pixel guidelines enforceable | Upcoming | Hunton via pii.ai |
| Nov 3, 2026 | CISA due date for the rest of the Oct 20 KEV batch | Upcoming | The Hacker News |
| Nov 13, 2026 | EDPB draft Guidelines 04/2026 comments close | Upcoming | Bird & Bird |
| Nov 20, 2026 | ICO agentic AI call for evidence closes | Upcoming | pii.ai |
| Jan 1, 2027 | California SB 690 and SB 923 take effect | Upcoming | NatLawReview |
| Jan 31, 2027 | Ivanti Connect Secure 22.8 end of life | Upcoming | CISA |
| Mar 19, 2027 | ETS Experian IdentityWorks enrolment deadline | Upcoming | Snowline USD |