SecurityWeek

SecurityWeek tracked 37 cybersecurity merger and acquisition (M&A) deals announced in October 2026.

For a look at last year’s activity, see SecurityWeek’s 2025 Cybersecurity M&A Report, which covers more than 420 deals.

Here are some of the most important cybersecurity M&A deals announced in October 2026:    

Absolute Security acquires FirmGuard

Endpoint security and cyber resilience firm Absolute Security has acquired FirmGuard, the UEFI BIOS firmware security and management business of Phoenix Technologies. Absolute will integrate FirmGuard with its firmware-embedded Absolute Persistence technology, adding below-the-OS management, continuous firmware integrity monitoring and patching, and compliance enforcement.

Aikido Security acquires OutKept and Cyberly

Belgian application security unicorn Aikido Security has acquired OutKept and Cyberly and used the two startups to launch Noon, a workforce security business. OutKept is based in Belgium and provides phishing simulations and security awareness training. Poland’s Cyberly develops AI-powered attack simulations and tools for tracking employee AI usage. Both deals closed in September but weren’t made public until October.

Anthropic to acquire Opaque Systems

AI company Anthropic has agreed to acquire Opaque Systems, a confidential AI company that grew out of research at UC Berkeley. Anthropic has described the deal as licensing Opaque’s technology and hiring some of its engineers, reportedly including CEO Aaron Fulkerson and CTO Rishabh Poddar. Financial terms weren’t disclosed.

Cohere to acquire AISLE

Canadian AI developer Cohere has signed a letter of intent to acquire AISLE, a startup whose autonomous AI systems find and help patch vulnerabilities in critical software. AISLE’s roughly 50 employees will join Cohere, which is setting up a cybersecurity unit called Cohere Cyber. AISLE CEO Ondřej Vlček, the former CEO of Avast, will become its senior vice president.

Hex-Rays to acquire HexAI

Hex-Rays, the Belgian company behind the IDA Pro reverse engineering tool, has agreed to acquire HexAI, an Israeli startup founded in 2025. HexAI’s AI agents analyze source code and binaries to uncover vulnerabilities, malware and backdoors. The deal is reportedly worth $30 million to $35 million. Hex-Rays plans to grow HexAI’s Israeli operations and build new AI-powered research tools.

IonQ has to acquire Elisity

Quantum computing company IonQ has agreed to acquire zero trust security firm Elisity in an all-stock deal worth up to $1.3 billion, including up to $150 million in performance-based earnouts. IonQ will combine its post-quantum cryptography and quantum key distribution technology with Elisity’s IdentityGraph platform, which enforces least-privilege access for users, devices, workloads and AI agents. The deal is expected to close in the fourth quarter of 2026.

Proofpoint to acquire Varonis

Thoma Bravo-owned Proofpoint has agreed to acquire data security company Varonis for roughly $6.3 billion in cash. Together, the companies want to offer a single platform for discovering and protecting sensitive data, controlling access to it, and preventing data loss as organizations adopt AI.

Other cybersecurity M&A deals announced in October 2026:

Acture Solutions acquires Digital BackOffice

Axelo acquires Cynch Security

Basware acquires Trustpair

Bendings acquires Scopertos

Bregal Milestone acquires Majority Stake in Nethive

Bytes Technology Group to acquire CyberOne

ctrl:cyber to acquire Razilio

CyberFOX acquires Optimize365

EC-Council acquires Cyber Insurance Academy

Forte Technologies acquires Business Cyber Security Solutions

GCubed acquires RightDirection Technology Solutions

Infotech acquires Zluri

Katalyst acquires Bluetowne

Lineal acquires Forentec

Macnica to acquire Majority Stake in CyberSec IT Consulting

Maximus to acquire Agile Defense

Nethive acquires JoyComm

Protectt.ai acquires Majority Stake in AIShield

SAIC acquires Information Security Corporation

Sequrio acquires Althammer & Kill, DATATREE and Nextwork

SGS acquires Majority Stake in Prescient Security

Tegria acquires CloudWave

Tiny acquires Oso

V-Key acquires Majority Stake in CloudsineAI

Vista Equity Partners to acquire HID’s PKI Business

Workday to acquire C1.ai

Xopero Software acquires Vigil Guard

Related: Cybersecurity M&A Roundup: 39 Deals Announced in September 2026

The Florida Department of Education (FLDOE) says hackers breached its student financial aid website, potentially exposing the personal information of roughly 4.9 million people.

The department discovered the intrusion on October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach.

“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.

The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.

Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.

“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.

The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.

The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.

According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.

The breach follows a September incident at the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.

FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.

Related: Revolve Data Breach Impacts at Least 180,000 People

Related: Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

Related: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card information was stolen in a data breach.

The incident occurred on September 11 and involved unauthorized access to certain systems, including the company’s online shopping platform.

Immediately after learning of the cyberattack, Revolve initiated incident response and contained and remediated the unauthorized activity.

The company’s investigation into the incident determined that the hackers may have accessed and exfiltrated the names, addresses, payment card numbers, and payment card expiration dates of customers who saved the data to their accounts on the company’s e-commerce platform.

“This incident has not resulted in operational disruption or interrupted service to any customers, and as of the date of this report, the company does not believe this incident will have a material impact on its business,” Revolve said in a filing with the US Securities and Exchange Commission.

The fashion retailer said it has notified law enforcement and retained a cybersecurity company to help with the remediation efforts.

Last week, the company started notifying the potentially affected individuals of the data breach. Based on notices filed with the Attorney General’s offices in Iowa, Massachusetts, Texas, and Vermont, Revolve sent notification letters to at least 179,259 people.

The company is not providing the affected individuals with free identity theft or credit monitoring services, but reminds them to review their account statements and remain vigilant for incidents of fraud or identity theft.

Revolve has not shared the number of impacted individuals or details on who hacked it and how. SecurityWeek has emailed the company for additional information on the data breach and will update this article if it responds.

Related: Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

Related: Over 41,000 DHS Employee Records Leaked Online

Related: Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

Related: Genesys Hack Exposes Customer Data From Internal Systems

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.

The premier payout is “specifically designed to recognize high-impact architectural research” and will be handed out to researchers who can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.

According to the internet giant, to qualify for the reward, the exploit path should not depend on pre-existing access to a project, previously compromised credentials, or user interaction/social engineering.

Reports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward.

“Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification,” Google Cloud CISO Chris Betz said.

The company has added the root-in-cloud validation criteria to its Cloud VRP page, explaining that it will award the bug bounty if its analysis of the initial entry point, execution context, and attack surface demonstrates that full arbitrary tenant or project takeover is possible.

“Identifying tenant-isolation bypasses and complex cross-service logic flaws requires human creativity, intuition, and rigorous systems analysis combined with the power of agentic systems,” Betz noted.

According to Michael Cote, Google Cloud’s vulnerability reward program lead, first-time researchers who combine their own intuition with agentic tools are finding more interesting bugs, on average, than novices did two years ago. 

He also pointed out that finding bugs eligible for the new root-in-cloud tier requires deep architectural intuition and AI.

“High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity,” Cote said.

Related: Google Partially Reverses Chrome Bug Bounty Cuts

Related: Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

Related: Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Related: Will AI Kill the Bug Bounty Industry?

Cursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.

The incident occurred on October 29 and involved versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension, which were live in the Cursor VS Code Extension Marketplace for roughly 11 hours.

Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.

Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumont notes.

The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.

“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Rieseberg said.

To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.

Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.

Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.

“We have no evidence that other versions of the extension or the official distribution are affected,” Cursor said.

The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.

“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,” Microsoft notes.

The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.

According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.

Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.

“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.

Related: LiteLLM Compromised in Fresh Supply Chain Attack

Related: Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Blockchain analytics company Chainalysis has announced falling victim to an AI-driven cyberattack that resulted in a data breach.

“This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools,” the company said.

The incident, it pointed out, is not related to the recent $6.36 billion Binance heist that was blamed on North Korean hackers.

According to Chainalysis, the attack did not result in the compromise of investigation content, transaction or query results, passwords in clear text, or other credentials and secrets.

“Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users,” Chainalysis said.

The company continues to investigate the full scope of the data breach and has not disclosed how many individuals were potentially affected. 

“Our teams have been working around the clock to investigate unauthorized activity, patch vulnerabilities, and harden our systems,” it said.

Chainalysis noted that it has observed an industry-wide rise in AI-driven cyberattacks, as many other tech platforms have been hit in recent weeks.

The company has been working with external cybersecurity experts and LLMs to review its security posture and strengthen it against these evolving threats.

Because names and email addresses were compromised, it recommends that users watch for unexpected authentication prompts and password reset requests, and make sure they have MFA enabled.

Related: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related: Over 41,000 DHS Employee Records Leaked Online

Related: Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

Related: HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

Polymarket says it is returning $3.9 million to traders following last week’s supply chain attack. Website performance monitoring firm DebugBear, meanwhile, has disclosed that its DNS records were compromised.

On October 29, the prediction market halted trading on its international platform after users reported unauthorized withdrawals. Hudson Rock researchers linked the activity to malicious JavaScript served from a DebugBear address that Polymarket’s site loaded.

The script targeted logged-in traders. It checked their portfolios, and then either dumped positions or shifted assets to a wallet chosen by the attacker. The code read credential-related data stored in the browser, but Hudson Rock saw no evidence of it sending passwords, seed phrases or private keys back to the attacker. Instead, it piggybacked on the trading permissions of the open session.

In an October 30 update, Polymarket said 726 wallets were affected. At that point, all but 37 had been made whole, and the rest were being paid once their details were checked.

Polymarket is also covering traders hurt by the trading halt or whose positions were sold or transferred by the malicious script, paying out $1.19 million across roughly 5,500 wallets. Together with the roughly $2.7 million stolen directly, that brings the payout to $3.9 million.

“The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement & will share a postmortem,” Polymarket said.

DebugBear, whose real user monitoring (RUM) script lets websites measure page load performance for visitors, initially told customers to remove the embed code and has now shared its initial findings.

“Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain,” the company said.

According to DebugBear, the attackers appear to have gone after one customer’s website specifically, though it stressed that this is a preliminary finding. It did not name the customer, and Polymarket has not named the compromised provider.

DebugBear has not explained how the attackers obtained access at the registrar level, and its investigation is ongoing. The company said it found no indication that its internal systems were compromised.

Polymarket faced a similar incident in June, when it said a third-party vendor compromise resulted in a malicious script being injected into its frontend. The theft was reported at around $3 million.

Related: FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

The FBI has formally blamed North Korean state-sponsored hackers for the record-breaking Binance cryptocurrency heist and is asking the crypto industry to help stop the stolen funds from being laundered.

The attack was conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.

Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.

The FBI released its attribution on October 31, two days after the theft.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.

The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.

Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.

The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.

Binance says the attack went beyond one laptop

Binance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in a statement.

Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.

He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.

Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.

According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.

“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.

Laundering appears to be automated

Blockchain analytics firm Elliptic puts the theft at $6.43 billion across 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.

According to Elliptic’s latest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.

“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.

The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.

By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.

Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.

Chainalysis also reported laundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.

Related: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Related: Hackers Return $263 Million Stolen From Liquid Network

Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained with a vulnerability the company disclosed last month.

The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.

According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.

CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.

This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.

CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.

The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.

Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.

“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.

The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.

Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.

CISA added the two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.

CVE-2026-104935 has been in the KEV catalog since October 13.

Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.

By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.

The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.

Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however, reported that attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.

Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs

Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Northstar Security, a startup developing AI agents for security teams, has emerged from stealth mode with $7 million in seed funding.

Wing Venture Capital led the round. MVP, Outliers, and cybersecurity veterans Gerhard Eschelbeck, Renaud Deraison, and Justin Somaini also invested.

The company ingests data from existing security and IT tools to build what it calls a Security Context Graph. Updated in real time, the graph shows how identities, assets, applications, vulnerabilities, and business systems connect to one another.

Northstar aims to catch so-called toxic combinations. Issues such as a vulnerability, an unmanaged device, or an account with excessive privileges may seem under control on their own, but together they can expose critical business systems.

For instance, the platform could flag a laptop lacking endpoint protection whose owner is a privileged user able to reach a critical payroll system.

Analysts can investigate findings like this by asking questions in plain language. Northstar’s agents can then kick off fixes, such as installing endpoint protection, notifying the user, or limiting their access, and people can supervise those actions where appropriate.

Customers can also give external AI agents access to the graph through Model Context Protocol (MCP) and build their own security workflows. Northstar says it connects to more than 70 enterprise security and IT products, among them Okta, GitHub, Workday, Microsoft Defender and Entra, AWS, and Google Cloud.

“Security teams are drowning in data but starving for context,” said Amer Deeba, Northstar’s CEO and co-founder.

Deeba co-founded Normalyze, which Proofpoint later acquired, and was previously a senior executive at Qualys. His co-founder, CTO Ed Rowe, held the same role at Farmers Business Network and led engineering as an SVP at AppDynamics.

The startup will use the money to develop its platform, hire staff, and expand its go-to-market push.

Related: Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise

Related: Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave

Related: Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform