In one week, the foundation cracked in several places at once. A flaw in the language behind about 7 in 10 websites whose server-side language can be identified. A maximum severity flaw in the tool that holds your source code. A poisoned release of the AI gateway many teams route model calls through. Stolen platform keys at two hosting companies. And a certificate authority whose private keys turned out to be guessable.
The label going around is Black October. The label is useful only if you read it correctly. This was not one attack, one group, or one campaign. It was a pileup of disclosures, and several of the exposures behind them are months or years old. The week of October 19 to 22 is when the bills were dated, not when they were incurred.
The decision it forces is the one the UK National Cyber Security Centre warned about in May: build the capacity to patch at scale, because the disclosures are not going to slow down. AI-assisted discovery is now finding decade-old flaws in weeks, and the same capability is available to attackers. Patching one emergency at a time, on a normal change cadence, no longer matches the speed of disclosure.
What happened: the timeline
- April 30, 2025. A flawed key generation script at an eMudhra key ceremony produces weak private keys for eight intermediate certificate authorities. The weakness sits undetected for nearly 18 months.
- May 2026. The UK NCSC warns organizations to prepare for an AI-driven patch wave, a forced correction of technical debt across open source, commercial, and cloud software.
- August 2026. Wiz Research and Calif independently find the PHP flaws and report them to the PHP project. Separately, Zeabur suffers its first breach on August 27 to 28, and the cleanup misses credentials that matter later.
- October 14 to 15. An attacker uses leaked Zeabur internal credentials to read the platform database: 321,810 accounts and 3,218,965 environment variable records.
- October 17. A researcher reports the weak eMudhra keys to the Chrome Root Program. Amazon honeypots log a PHP2Shell exploitation attempt, four days before the patch. Zeabur announces it will shut down.
- October 18. eMudhra revokes all eight affected intermediates. Attackers begin using stolen UpdraftCentral keys to backdoor WordPress sites at 15:32 UTC.
- October 19. Apple blocks the eMudhra certificates. Zeabur publishes its preliminary incident report.
- October 20. Microsoft blocks the eMudhra certificates, Mozilla and Google confirm the compromise publicly, PHP2Shell details leak ahead of the coordinated release, and a six-agency joint advisory names SafePay ransomware at 600-plus victims.
- October 21. The pileup lands in one day: PHP patches, GitLab patches, Node.js patches, the poisoned LiteLLM 1.107.0 release, the Railway disclosure, the eMudhra statement, and CISA and NSA advisories on PHP.
- October 22. eMudhra announces it will exit the global TLS certificate business. Railway publishes a preliminary incident report.
- October 23. CISA updates its PHP2Shell alert with a SIGMA detection rule. CISA adds the Collabora Nextcloud flaw (CVE-2026-110447) to its Known Exploited Vulnerabilities catalog, covered in the October 24 brief.
Confirmed: the items that carry weight
PHP2Shell (CVE-2026-109618, CVE-2026-109619). Two memory safety flaws in the PHP engine itself, each rated CVSS 9.2 by the PHP security team. An attacker with no login can run code on a web server while PHP is still reading the request, before any application code runs. That is why updating WordPress, or any app, does nothing until the interpreter is patched. The flaws reach back to PHP 5.4, released in 2012. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older get no official release, only source backports. CISA urges systems that cannot be patched to be taken offline. Exploitation attempts were logged before the patch existed. CISA said it had not observed successful exploitation when its alert published, and no confirmed successful compromise has been publicly established. Treat attempts as the signal and patch as if compromise is possible.
GitLab (CVE-2026-110264). An integer overflow in regular expression compilation that GitLab rates CVSS 10.0, the maximum score. Under certain conditions it could let an unauthenticated user run code on a self-managed GitLab server. It reaches back to GitLab 7.0, from 2014. Only self-managed installations need to act. GitLab.com already runs the fixed version. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab reports no sign the flaw has been used in attacks, and it is not in CISA KEV as of October 22. If you patched GitLab's October 12 release, you are still in range: those versions sit below the new fixes.
Node.js Brotli (CVE-2026-111497). An out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution when attacker-controlled compressed data reaches the decoder, through a request body, a fetched response, or a websocket frame. Fixed in 22.23.4, 24.22.1, and 26.12.1, alongside nine other flaws including two TLS hostname check bypasses. Node.js 20 and older are end of life and get no fix. The flaw was reported by OpenAI Codex Security. A lab proof of concept appeared October 22. No exploitation in the wild had been reported as of October 22.
eMudhra certificate authority. Eight intermediate certificates, six for website TLS and two for code signing, carried private keys generated with insufficient randomness on April 30, 2025. All eight keys were smaller than 256. One was the number 4. Anyone holding a recovered key could issue certificates browsers would trust for any domain, or sign software that looks like it came from a legitimate publisher. Google blocked the keys through CRLSet, Mozilla through OneCRL, Apple blocked them October 19, Microsoft October 20, and Google is removing the emSign ECC Root CA - G3 from the Chrome Root Store. eMudhra states it found no evidence of key misuse and that the affected intermediates issued no end-user certificates. On October 22 it announced it will withdraw from the global TLS certificate business. The exposure window ran from April 2025 to October 2026, which is the point: software with its own certificate store, or that ignores revocation, may keep trusting these intermediates.
LiteLLM 1.107.0. Attackers used stolen GitHub CLI OAuth tokens from three engineers to push a poisoned release through LiteLLM's own release pipeline on October 21. The PyPI package was live about two hours (11:39 to 13:23 UTC); Docker tags v1.107.0, latest, main-latest, and main-stable carried it until 14:20 UTC. The payload is a credential stealer that runs on Python startup, even if the application never imports LiteLLM, plus a remote code loader. The last safe version is 1.106.2. Any host that ran 1.107.0 should be treated as compromised and every secret it could reach rotated.
Railway. On October 21, Railway disclosed that an unauthorized party may have accessed encrypted environment variables and obtained the decrypted contents of some. Its preliminary report puts the attack from October 20 to October 22, aimed at AI provider API keys, with at most 1.85 percent of workspaces, about 100,000, potentially affected. Railway tells every customer who signed up before October 21 to rotate stored secrets, whether or not they were notified.
Zeabur. The October 14 to 15 breach read 321,810 accounts and 3,218,965 environment variable records from the platform database, took root access on 101 customer servers, and attached 16 customer disk copies to attacker virtual machines. The credentials used were created in January 2024 with no expiry, stored in plaintext in a configuration repository, and missed by the rotation after the August breach. Zeabur will wind down services from December 1 through December 31, 2026. Customers need an exit plan, not just new keys.
UpdraftCentral keys. Attackers broke into TeamUpdraft's website over October 17 to 18 and took the customer database, including the connection keys for UpdraftCentral, the vendor's cloud dashboard for managing many WordPress sites from one place. From October 18, those keys were used to push backdoor plugins onto connected sites. Patchstack logged at least 99 backdoor plugin names in the first 18 hours. This is not a code flaw in UpdraftPlus and has no CVE: the plugin sees a correctly signed instruction and obeys it. About 400,000 sites is an estimate of potential exposure, not a confirmed count of compromised sites. It comes from the vendor's estimate that fewer than 10 percent of 4 million-plus UpdraftPlus installs hold an UpdraftCentral or Migrator key. The fix is UpdraftPlus 1.26.13 or 2.26.13, and the first emergency release (1.26.12) failed to delete the keys because of a bug, so verify the keys are actually gone. Keys created between 12:07 and 22:00 UTC on October 18 must be deleted by hand.
SafePay ransomware. The joint advisory AA26-293A from the FBI, CISA, the US Secret Service, Germany's LKA Rheinland-Pfalz, and the UK NCA and NWROCU, released October 20, puts SafePay at more than 600 victims since August 2024, across critical infrastructure sectors in the Americas, Europe, and Australia. Entry is unglamorous: brute-forced VPN credentials, phished VPN accounts, and known flaws in internet-facing edge devices, including Veeam and SonicWall. The advisory's lesson is the same as the rest of this week: the flaws that hurt are often years old. SafePay was covered in the October 21 brief; it belongs in this briefing because its advisory landed in the same disclosure pileup.
Why it matters in business terms
Three exposures run through the whole week. First, the internet-facing estate. PHP, GitLab, Node.js, and WordPress management channels are all reachable from the internet by design, and the flaws in them need no login. Second, vendor and supply chain exposure. LiteLLM, Railway, Zeabur, and UpdraftCentral are all cases where a supplier's compromise becomes the customer's incident, and where the customer's own patching changes nothing until the supplier's keys are rotated or the supplier is replaced. Third, patch-wave load. Five critical patch drops in one week, plus a certificate trust change that reaches into every browser and trust store, is more than a normal change window absorbs. Organizations that still patch on a monthly cycle, or that cannot produce an inventory of what runs PHP, Node.js, or a given package, felt this week as chaos. Organizations with an inventory, automated updates, and a pre-agreed emergency change path felt it as a busy week. That gap is the business risk.
The AI angle cuts both ways, and the briefing should not overclaim it. Frontier models helped find the PHP flaws: Wiz Research used frontier models including its own Atlas system, and Calif found them independently through an OpenAI audit program. OpenAI Codex Security reported the Node.js Brotli flaw. That is AI-assisted discovery by defenders, confirmed by the researchers and vendors involved. No source confirms attackers used AI to exploit PHP2Shell. The honest version is narrower and still urgent: the same capability that found a 14-year-old flaw in weeks shortens the time attackers need, which is exactly why the NCSC told organizations in May to prepare for a patch wave.
What to do, in priority order
- Patch PHP first, internet-facing first. Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart workers. If you run PHP 8.1 or older with no vendor patch, take those systems offline or put them behind a control you trust until you can move them. A web application firewall buys time; it does not replace the patch.
- Patch self-managed GitLab and Node.js. GitLab to the fixed version for your release line. Node.js to 22.23.4, 24.22.1, or 26.12.1, and move end-of-life lines to a supported line. Finding every Node.js your servers actually run, including bundled copies and containers, is the work; the version bump is the easy part.
- Rotate platform secrets, do not just patch. Railway customers: rotate every secret stored before October 21. Zeabur customers: rotate everything and plan migration before the December 31 shutdown. LiteLLM 1.107.0 users: treat affected hosts as compromised, rebuild, and rotate every secret they could reach.
- Clear UpdraftCentral keys by hand and verify. Update to 1.26.13 or 2.26.13, then check that the keys are actually gone, including keys created between 12:07 and 22:00 UTC on October 18. Do not reconnect until the vendor explains how the keys leaked.
- Fix trust stores that do not update themselves. Browsers handled eMudhra automatically. Anything with its own certificate store, embedded devices, and older Go releases need manual attention. Go fixed the eMudhra trust issue in 1.27.3 and 1.26.10. Node.js removed the compromised intermediates in its October release.
- Build the patch-wave muscle now. Produce an inventory of internet-facing systems and the runtimes they use. Enable automatic updates and hot patching where available. Pre-agree an emergency change path so the next disclosure week does not need a meeting to start.
How to find it
PHP. Inventory every system running PHP, including PHP embedded in other software, where it may not appear in an asset list. Check versions against the fixed releases and restart workers after upgrading. Hunt back to at least October 17: PHP worker processes launching shells or downloading tools, unusual multipart requests followed by memory limit errors or repeated HTTP 500 responses, oversized or malformed session cookies, and unexplained worker churn. CISA's October 23 alert update includes a SIGMA detection rule for suspicious PHP activity; use it as the starting point. A successful PHP2Shell exploit can return a normal HTTP 200 and leave application logs clean, so a clean application log is not evidence of safety.
GitLab. Compare full installed versions against the fixed releases; a major version label alone does not establish exposure. GitLab published two detection rules for exploitation attempts: Onigmo native worker crash and Org mode render error burst. Investigate hits through the normal incident process.
Node.js. Check every runtime, including containers and bundled copies, against 22.23.4, 24.22.1, and 26.12.1. Watch for applications that decompress attacker-controlled Brotli data, including fetch responses from servers you do not control, and monitor for crashes or unusual child processes after decompression.
eMudhra. Check non-browser trust stores for the eight revoked intermediates and the emSign ECC Root CA - G3. Anything that maintains its own store, or ignores revocation, needs manual removal. Watch for certificates chaining to the revoked intermediates.
LiteLLM, Railway, Zeabur, UpdraftCentral. Check install logs for LiteLLM 1.107.0 or the affected Docker tags pulled October 21. Review provider usage and audit logs for keys stored on Railway before October 21 and Zeabur at any point. On WordPress sites, look for unexpected administrator accounts and unfamiliar plugins, including names disguised as maintenance tools, and confirm UpdraftCentral keys are deleted.
CVE table: verified entries only
| CVE | Product | Severity | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-109618 | PHP engine | CVSS 9.2 (PHP security team) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Exploitation attempts observed; no successful exploitation observed by CISA at alert publication; not in CISA KEV as of October 23 |
| CVE-2026-109619 | PHP engine | CVSS 9.2 (PHP security team) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Same as CVE-2026-109618 |
| CVE-2026-110264 | GitLab CE/EE, self-managed | CVSS 10.0 (GitLab) | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | No exploitation reported by GitLab; not in CISA KEV as of October 22 |
| CVE-2026-111497 | Node.js Brotli decoder | High (Node.js advisory) | 22.23.4, 24.22.1, 26.12.1 | Lab proof of concept October 22; no in-the-wild exploitation reported as of October 22 |
| CVE-2026-10795 | UpdraftPlus, UpdraftCentral channel (June flaw) | CVSS 8.1 | 1.26.5, 2.26.5 | Background only. The October incident is stolen keys, not this CVE. Sites on older versions face both problems. |
What is still unverified. Counts of Black October incidents vary by tracker, and this briefing relies on no single total as fact. The widely repeated "worst 48 hours" framing is hype: the reporting clustered in about 72 hours, while the exposures span April 2025 to October 2026. A claim about California public school student records, including statewide scope and disability details, could not be substantiated as stated and is left out. A Quest Diagnostics patient data report was not corroborated by a primary source in this research and is left out. Other viral-list names, including Electrum, had no primary corroboration and are left out. Whether PHP2Shell has caused a confirmed successful compromise, as opposed to attempts, has not been publicly established. How Zeabur's attacker first obtained the credentials, and whether one actor committed both Zeabur breaches, is not established. Railway has not disclosed its entry point or how values were decrypted. LiteLLM has not confirmed how the attacker initially obtained the engineer tokens.
Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com