Black October: What a Week of Critical Disclosures Taught Us

"Black October" is an informal name, not an official one. It describes a cluster of critical vulnerability disclosures and incidents in October 2026, most of them between 17 and 22 October. It's worth being precise about what it was: a disclosure wave, not a single coordinated attack. Most of the bugs were years old. What was new was how many surfaced at once, and how many were found with AI-assisted research.

What Happened

• eMudhra weak CA keys (17 October). Private keys for eight intermediate certificate authorities had been generated with insufficient randomness in 2025 and were recoverable. Chrome blocked them through CRLSet and Firefox through OneCRL. eMudhra said none had issued end-entity certificates, then exited the public TLS business on 22 October.
• Oracle E-Business Suite (20 October). CVE-2026-101767, an unauthenticated SQL injection exposing financial, payroll and HR data.
• PHP2Shell (21 October). CVE-2026-109618 and CVE-2026-109619, RCE in the PHP interpreter itself. See the PHP2Shell playbook.
• HTTP2Shell (21 October). CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by Node.js, Python, .NET, Envoy and browsers. See the HTTP2Shell write-up.
• LiteLLM supply-chain compromise (21 October). A malicious 1.107.0 release reached PyPI and Docker images for a few hours. See the LiteLLM post.
• GitLab (21 October). CVE-2026-110264, RCE on self-managed instances under conditions GitLab hasn't fully detailed.
• EDK II PXE (22 October). CVE-2026-97631, a pre-boot buffer overflow in UEFI network-boot firmware, CVSS 4.0 score 9.5.
• Linux kernel. Six vulnerabilities posted publicly to the kernel mailing list without patches, outside the normal security process, plus a separate network-stack RCE (CVE-2026-98432).

Five Lessons

1. AI changed the economics of finding bugs, not of fixing them

PHP2Shell was found with large language models' help. One of its root causes had been flagged in 2024 and parked because nobody could show it was exploitable. That defence ("theoretical, no known exploit") is getting weaker fast. Memory-safety bugs in old C codebases that were "probably fine" now need a fix plan.

2. Patch velocity is the control that mattered

Exploitation of PHP2Shell was seen before the patch. Proof-of-concept code circulated during the embargo once early patched builds let attackers diff the changes. For internet-facing critical CVEs, the useful window is now hours. Measure your mean time to patch for criticals honestly, from advisory to running process.

3. Inventory decides who wins

Every item on the list above asked the same question: where do we run this? PHP inside appliances, Brotli inside runtimes and proxies, LiteLLM inside AI side projects, EDK II inside firmware. Teams with SBOMs and image inventories answered in minutes. Everyone else answered by grepping servers.

4. "Offline" is a legitimate response

Governments across Europe, Wikimedia and the Internet Archive took services down while they patched. Pre-authorize that decision in your incident runbooks, with an owner and criteria, so it isn't debated mid-incident.

5. Trust infrastructure is part of your attack surface

A CA with weak keys and a release pipeline publishing malware both turn trusted channels against you. Pin dependency versions, verify provenance where it's available, and keep your trust stores and revocation data current.

A Short Checklist

• Inventory PHP, Brotli, LiteLLM, GitLab and Oracle EBS across hosts, images and appliances
• Patch to fixed versions, then rebuild and redeploy every container image
• Move anything on end-of-life runtimes (Node.js 20, PHP 8.1 and older) to a supported line
• Hunt for web shells, unexpected child processes and new outbound connections from 17 October onward
• Rotate credentials that were reachable from anything exposed or compromised
• Track each CVE's status in CISA's Known Exploited Vulnerabilities catalog, which changes after initial coverage

Sources

• Black October (Wikipedia)
• The Guardian on AI-enabled hacking
• Google Security Blog: eMudhra intermediates
• TianoCore EDK II PXE advisory
• CISA Known Exploited Vulnerabilities