Skip to content
Ferroscope
Menu

08Chronology

Forty-eight hours,
laid out flat.

A wave is not a list. It is a sequence: disclosure, scanning, exploitation, and a second disclosure that lands while responders are still triaging the first.

14 disclosures21–23 Oct 2026all times UTC
14In the wave48-hour window
6VectorsDistinct surfaces
1Peak hour06
2Touch the laptopeMudhra + SBI
21 Oct 00:00 → 23 Oct 00:00 UTCeach tick = 1 hour
21 Oct22 Oct23 Oct

21 October

2026 · 6 disclosures

  1. 06:10

    UTC

    criticalWeb server01

    PHP2Shell

    A hole in the runtime behind roughly 70% of the web

  2. 09:30

    UTC

    criticalCertificate authority02

    eMudhra root keys

    The keys that prove a website is real were cracked

  3. 15:00

    UTC

    criticalData breach03

    California student data

    Every public school student since 2023, including disability status

  4. 18:20

    UTC

    criticalHosting04

    Railway

    Customer secret keys stolen from a hosting platform

  5. 20:00

    UTC

    criticalHosting05

    Zeabur

    321,810 accounts breached; the company is shutting down

  6. 22:10

    UTC

    criticalSupply chain06

    LiteLLM

    An AI package downloaded 3.4 million times a day, poisoned

22 October

2026 · 7 disclosures

  1. 00:00

    UTC

    criticalWeb server01

    GitLab Onigmo RCE

    A 10-out-of-10 hole in every self-managed version since 2014

  2. 03:30

    UTC

    highState actor02

    Cairn

    An AI hacking tool broke into 100+ companies

  3. 05:00

    UTC

    highRansomware03

    Ahold Delhaize

    The owner of Food Lion and Stop & Shop knocked offline

  4. 07:40

    UTC

    criticalHosting04

    Onamae

    Malware planted on up to 26,739 customer servers in Japan

  5. 09:00

    UTC

    highBanking05

    State Bank of India

    India's biggest bank confirms a data breach

  6. 11:00

    UTC

    highSupply chain06

    OVHcloud tooling

    Hackers slipped a password stealer into a cloud company's official tool

  7. 13:30

    UTC

    highEndpoint07

    Siemens

    A software hole being used to spread malware

23 October

2026 · 1 disclosures

  1. 02:00

    UTC

    highState actor01

    North Korean campaign

    State hackers launch a new attack campaign on South Korea

Why the order matters

Responders triage in the order things arrive, which is almost never the order of personal relevance. PHP2Shell landed first and dominated attention; the eMudhra root landed second and was the only one that could silently mint a trusted certificate for every domain. The timeline is a reminder that volume is not the same as impact.