Black October: five incidents in one week

Key takeaways

• The week. Black October is what reporters called 17 to 23 October 2026, when five unrelated failures landed together: a certificate company, the language behind much of the web, a popular AI library, GitLab, and Node.js.
• eMudhra. On 17 October a researcher showed that eight of its certificate keys were weak enough to copy. The company cancelled them the next day. Browsers blocked them. Software that keeps its own trust list still needs an update.
• PHP. Two bugs in PHP itself can let an outsider run commands on the server. The fix shipped on 21 October. Updating WordPress or Drupal does not fix it.
• LiteLLM. For about two hours on 21 October, version 1.107.0 was a malicious copy. It runs as soon as Python starts. The last clean release before that was v1.106.2.
• GitLab and Node. The same day, GitLab patched a critical hole in servers people run themselves, and Node.js fixed ten vulnerabilities, including one in how it unpacks compressed data.
• What to do. The version numbers are in the table at the end. If you cannot update PHP, take the site offline until you can.

On the evening of 17 October 2026, a researcher told the Indian company eMudhra that eight of its certificate keys were so weak they could be rebuilt. Those keys are part of how a browser decides a website is genuine.

Four days later, on a single Wednesday, four more stories broke at once. PHP, the language under a huge share of the web, shipped an emergency fix. A popular library for connecting apps to AI models spent about two hours on the public shelf as a malicious release. GitLab patched a critical hole in the servers companies run themselves. Node.js, which runs a lot of modern sites and APIs, published a security release of its own.

By Friday, The Guardian and The Indian Express were calling the stretch Black October.

This is that week, for anyone who runs a site, ships software, or wondered why security people were loud. The version numbers sit in one table at the end.

What was Black October?

Black October is the name reporters gave the incidents of 17 to 23 October 2026. They were not one attack. The bad days simply overlapped.

A few words, once. A CVE is a public serial number for a known flaw. You do not need the numbers to follow this. They are in the table. RCE means someone on the internet can run commands on your server. A certificate authority is a company browsers trust to vouch for a website. Its private keys are the stamp, and anyone holding the stamp can forge the voucher. A supply-chain attack is when the thing you meant to install has been swapped for a malicious copy.

The Indian Express put eMudhra, PHP, LiteLLM, and GitLab in those few days. Node.js shipped the same Wednesday, and write-ups of the week include it. Other companies had bad news that month too. This piece stays with these five.

What happened to eMudhra's certificate keys?

eMudhra sells trust. The padlock in a browser means a company like eMudhra has signed the site and said this is real.

On the evening of 17 October, a researcher reported that eight of its middle-layer keys could be rebuilt from the public certificates. Rebuild one, and you can sign a certificate for almost any name. A computer that still trusts eMudhra will believe you.

The company cancelled all eight the next day. Reuters reported that Google, Mozilla, Apple, and Microsoft blocked the certificates, and that India's computer emergency team had warned the keys were compromised. Chrome blocked them the same evening, on phones as well as desktops.

The keys were made on 30 April 2025. eMudhra says a step in the ceremony produced a second, weaker pair by mistake, and that weaker pair is what got published. Two audits missed it. Seven of the keys were never used. The one that was used had issued zero certificates. The company says its systems were not broken into, and it knows of nobody using the keys before the report.

Browsers caught up fast. Other software is slower. Servers, containers, and some languages ship their own list of trusted companies, and the list changes only when you update them. Go's note is the plain version: a rebuilt key can vouch for any name, and a program that still trusts eMudhra will accept it.

On 22 October the board said eMudhra would leave the global website-certificate business. It was about 1 percent of revenue. Affected customers would get replacement certificates through partners. The company's Indian digital-signature and eSign services were a separate business, and they kept running.

What to do: update the trust list your servers and apps actually load, and replace any certificate that came from the cancelled keys.

What is PHP2Shell, in plain English?

PHP is the language under a large share of the web. The Indian Express noted that around 70 percent of websites are reported to run some version of it, including a lot of WordPress, Drupal, and Joomla sites. The bugs were not in those products. Those products were just where researchers showed the bugs off.

Wiz called the pair PHP2Shell. An early leak scored them a perfect 10. That number was wrong. The PHP Foundation scored both 9.2. Still an emergency.

Here is the whole idea. A request arrives and fails in a particular way. That failure leaves the PHP process confused, and the next request it handles can be treated as instructions. When PHP is built into the Apache web server, one of the bugs can be hit before a line of your own code runs. Wiz says at least one of them has been in PHP for more than a decade. A one-page script is enough. Updating WordPress does not touch the language underneath it.

The fix shipped on 21 October. CISA, the US cyber agency, added both bugs on 26 October to its list of flaws already used in real attacks. If you cannot update, or you are on a PHP version the project no longer supports, take the system offline. A firewall rule buys time. It is not the repair.

The Guardian quoted Cloudflare's chief executive, Matthew Prince, on the pace once the news was out: thousands of attempts in the ten hours before the announcement, tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions after that. The same piece said an NSA alert went out, and that some government and company sites in the US and UK took themselves offline to patch.

What to do: install a fixed PHP and restart it, so the running process actually picks up the fix. If you cannot, take the site down. For old versions the official release no longer covers, the Indian Express highlighted Czech programmer Ondřej Surý, who shipped updates anyway.

Was a LiteLLM release hijacked?

Yes. LiteLLM is an open-source library teams use so one application can talk to many AI models. On 21 October, LiteLLM says, version 1.107.0 on the public Python package shelf was malicious for about two hours. The official install images pointed at a bad build across an overlapping stretch. The label in the project's own code was clean. The files people downloaded were built somewhere else, from a repository an attacker controlled. Wiz counted roughly 49,000 downloads. LiteLLM said its private enterprise release was untouched. The last clean open-source release before the incident was v1.106.2.

You asked for a package you trusted. For a short time, the file on the shelf was someone else's.

Microsoft's write-up changes what you do next. The malicious code runs when Python starts, even if your application never uses LiteLLM. Starting Python on a suspect machine, just to look, is one way to run it. Look from a clean machine.

What to do: if you installed 1.107.0 that day, or pulled the image tags named in the table, change every password and key that machine could see, then install v1.106.2 or a later clean release.

What did GitLab patch on the same day?

GitLab is where a lot of companies keep their source code, the keys that deploy it, and the secrets that build it. On 21 October GitLab shipped an emergency patch for a flaw it scored 10 out of 10, the top of the scale.

GitLab's description is careful, and the care matters. In some situations, a person who was not logged in could run commands on the server. The bug is in the code that reads search patterns, and it reaches back through very old versions. GitLab has not spelled the exact conditions out in the public note. GitLab.com, the service GitLab hosts, was already running the fix. So were the dedicated-hosting customers on the internal builds GitLab named. Anyone running GitLab on their own machines was not.

The Indian Express grouped this release with the rest of the week. A hole that needs no password, on the server that holds the code, is why it belonged in the same Wednesday as PHP.

What to do: if you run GitLab yourself, upgrade to a version in the table. If you use GitLab.com, it is already patched.

What did the Node.js security release fix?

Node.js runs APIs, dashboards, and a lot of the glue behind modern sites. The same Wednesday, the Node.js project shipped fixes for the three lines it still supports. Ten vulnerabilities in one release. Node rates four of them high. Not every one applies to every line.

The one that made headlines sits in Brotli, a way of shrinking data, in the same family of idea as zip. Node unpacks that data as a normal part of handling the web. Give it a broken compressed file and, Node says, an attacker can crash the process, see into its memory, or run commands. Akamai, which studied the bug, notes that this can happen on ordinary paths. Fetching a web page can do it. So can Express, a very common toolkit for building Node sites, even when your own code never mentions compression. Older Node lines, already out of support, got no fix.

The same release also refreshes the trust list Node ships, because of eMudhra. One upgrade covers both. The compression bug was reported by OpenAI's Codex Security team, Khai Tran and Sylvie Mayer. On 27 October, CISA added it to the catalog of flaws already used in attacks.

What to do: move to one of the three versions in the table. If you are on an older line, move onto one of those.

Why did so much land in one week?

Not because one attacker picked five targets. The dates piled up.

The argument was about how some of the bugs were found. The Indian Express, in a piece by IIT Delhi professor Vaishnavi Sundararajan, traced PHP2Shell to two groups using AI models: Calif, with OpenAI's models under a program called Patch the Planet, and Wiz, with its own. The PHP bug was old. A 2024 audit paid for by the Sovereign Tech Agency had already seen the first signs, and then the fix stalled. Wiz says the bad code had sat there for more than a decade, and that a leading AI model let one researcher finish in about a week what used to take a specialist team months.

Cheap discovery has a bill. Since July, the PHP Foundation says, the security team has published 15 real vulnerabilities and thrown out more than 100 reports as wrong, duplicated, or impossible to reproduce, many of them written with a model's help. Finding bugs got cheaper. Telling the real ones from the noise did not.

An OpenAI team also reported the Node compression bug. That is a second find that week from people who hunt bugs with models. It is not a claim that every Node issue was found that way. eMudhra was a ceremony mistake from April 2025. LiteLLM was a shelf that briefly held the wrong file.

The next day Anthropic said it had proved properties of more than 100 open-source libraries, and found bugs that years of automated testing had missed. The proofs hold for a simplified model of each program, not automatically for the copy you run. Sundararajan's caution is the right companion to that announcement. A proof answers the question someone wrote down. A person still has to check it was the right question.

Jason Clinton at Anthropic wrote that things would get worse before they got better, and told leaders to ask their boards for the basics, not for more AI, with about 18 months of hard going ahead. Sam Altman, quoted by the Guardian, said he no longer thinks every bug can be patched. The week was plainer than either sentence. The fixes still depended on people.

What should you patch?

Install from the table, then restart the process that is actually serving traffic. A file saved on disk is not a fix until that process has loaded it.

What	Install	The detail
PHP	8.5.12, 8.4.27, 8.3.36, or 8.2.35	CVE-2026-109618 and CVE-2026-109619, both scored 9.2. Fixes shipped 21 October 2026. CISA listed both as exploited on 26 October. On PHP 8.1 or older, take the system offline until it is upgraded.
LiteLLM	v1.106.2, or a later clean release	1.107.0 was malicious on the Python package index from 11:39 UTC to about 13:23 UTC on 21 October. Docker Hub tags v1.107.0, latest, main-latest, and main-stable pointed at a bad image until 14:20 UTC.
GitLab, if you run it yourself	19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13	CVE-2026-110264, scored 10.0. Released 21 October 2026. GitLab.com was already patched.
Node.js	22.23.4, 24.22.1, or 26.12.1	Ten fixes, led by CVE-2026-111497 in the bundled Brotli decoder. Released 21 October 2026. Older lines got no fix. CISA listed the Brotli bug as exploited on 27 October.
Trust list	The current bundle from your operating system, container base, and language	eMudhra cancelled eight intermediate keys on 18 October. Browsers blocked them that evening. The Node release also refreshes the list Node ships.

What should a team take from Black October?

Three questions separated the teams that moved on Wednesday from the teams still looking on Friday. Which language is actually answering requests. Which list of certificate companies that process trusts. Which package version is pinned, and whether a person or an agent can install a newer one with nobody looking.

If you cannot patch PHP, take it offline. If you are not sure you installed the bad LiteLLM release, do not start Python on that machine to find out.

The model sits on top of all of this. A swapped library and an instruction file an agent will follow unread are the same kind of surprise, which is why agent skills are code written in English belongs in the same week as LiteLLM. Testing that layer is AI red teaming. AgentBreaker probes a running agent. None of it replaces the table above.

KageX's take. Five separate failures, one week. Models made some old bugs cheaper to finish. The repair still depended on a few people, and on operators who knew what they were running. Name the runtime, the trust list, and the version. If you cannot patch it, turn it off.