Summary

“Black October” is an informal industry label, not an official designation, for an unusually concentrated cluster of high-impact cybersecurity disclosures and incidents in mid-to-late October 2026. The best-documented events are two critical PHP vulnerabilities (“PHP2Shell”), a compromised LiteLLM software release, weak eMudhra certificate-authority keys, and security updates for Node.js and GitLab.

The evidence supports a real and serious series of security events. It does not yet support claims of a single coordinated campaign, a confirmed global mass-breach event, or a precise count of “several dozen major cyberattacks.” Some claims, especially the scale of AI’s role and the attribution of PHP exploitation, are contested or still developing.

What Happened?

PHP2Shell

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both were rated CVSS v4.0 9.2 out of 10 and could permit unauthenticated remote code execution on affected web servers.

CVE-2026-109618 involved improper handling of an out-of-memory condition.
CVE-2026-109619 involved stale global state after memory had been freed.
Fixed releases were PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older received no upstream fix because they are end-of-life.
Technical details leaked publicly on October 20, before coordinated disclosure; PHP said no functional exploits were known at the time of release.

The vulnerability was in the PHP runtime itself, not necessarily in the websites or applications running on it. This meant organisations could be exposed even where PHP was used indirectly through hosting platforms, plug-ins, appliances or third-party components.

LiteLLM supply-chain compromise

On October 21, LiteLLM’s release pipeline published a compromised version of litellm==1.107.0 to PyPI and its container registries. LiteLLM said the release contained compiled malware that stole credentials and loaded remote-code-execution tools; affected Docker images were available from 11:46 UTC to 14:20 UTC.

Microsoft’s independent analysis found that the malicious package added files executed during Python interpreter startup, meaning an application did not need to import LiteLLM for the payload to run.

LiteLLM later said the intrusion chain began with an administrative key inadvertently committed to a public repository on May 27, 2026. It said the attacker used that key on October 10 to access an internal LiteLLM Agent Platform deployment, ultimately obtaining GitHub tokens and compromising the release process.

eMudhra certificate-key weakness

India’s CERT-In reported that private keys for eight eMudhra intermediate certificate authorities—six TLS and two code-signing—were compromised because they were generated with insufficient cryptographic randomness. The affected P-384 elliptic-curve keys had exceptionally small values and could be recovered from public keys.

The practical risk was that an attacker could potentially issue fraudulent TLS certificates, impersonate websites, intercept or alter encrypted traffic, or create fraudulent code-signing certificates.

Important mitigating facts:

eMudhra said none of the affected intermediates had issued end-entity certificates.
eMudhra revoked the eight certificates on October 18.
Mozilla and Google blocked affected TLS intermediates on October 17; Google reported no certificates chaining to the affected TLS intermediates in Certificate Transparency logs before its blocking action.
As of CERT-In’s October 21 advisory, public disclosures did not establish confirmed malicious exploitation.

Node.js and GitLab

On October 21, Node.js released security updates for the 22.x, 24.x and 26.x release lines. The most serious issue was CVE-2026-111497, an out-of-bounds write in the built-in Brotli decompressor; the releases also addressed TLS and DNS-related issues and updated CA certificates in response to the eMudhra incident.

GitLab shipped an out-of-band critical patch release on October 21, covering versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, addressing 12 security vulnerabilities.

Historical Context

October 2026 followed a period of unusually high vulnerability volume. The Wall Street Journal reported that September had recorded an unprecedented number of vulnerabilities, contributing to experts’ use of the “Black October” label for the following month.

The episode also occurred amid growing concern that AI systems can accelerate both defensive and offensive security work. Wiz said its researchers used AI-assisted analysis to identify and combine the PHP flaws into an exploit demonstration; Axios reported that OpenAI’s agents discovered critical flaws in PHP and Brotli.

That does not establish that AI autonomously caused the crisis. The verified point is narrower: AI tools were reported to have accelerated vulnerability discovery, exploit development and public attention, while AI-adjacent infrastructure—including LiteLLM, an AI gateway—was itself targeted.

Timeline

Date	Event	Source
May 27, 2026	LiteLLM says an administrative key was committed to a public repository.	https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
Oct. 10, 2026	LiteLLM says a threat actor used that key to access an internal deployment.	https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
Oct. 17, 2026	Mozilla and Google blocked affected eMudhra TLS intermediates.	https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0050
Oct. 18, 2026	eMudhra revoked the eight affected intermediate certificates.	https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0050
Oct. 20, 2026	PHP2Shell technical details became public before coordinated disclosure; Microsoft blocked affected eMudhra CAs in Windows.	https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys
Oct. 21, 2026	PHP released PHP2Shell fixes; LiteLLM’s compromised 1.107.0 release was published; Node.js issued security releases; GitLab issued an out-of-band critical patch.	https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/
Oct. 21, 2026	CERT-In issued an advisory on eMudhra intermediate-CA key compromise.	https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0050
Oct. 23, 2026	Singapore’s Cyber Security Agency and Microsoft published PHP2Shell and LiteLLM analyses.	https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/
Oct. 26, 2026	BleepingComputer reported confirmed in-the-wild PHP2Shell exploitation; Microsoft removed seven affected eMudhra-related certificates from the Edge trust list.	https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys
Oct. 28, 2026	Axios and other outlets used the term “Black October”; CrowdStrike reported it had not observed successful PHP2Shell exploitation.	https://www.axios.com/2026/10/28/cybersecurity-black-october-ai-hacks?ref=upstract.com

Evidence and Verified Facts

PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, both critical unauthenticated remote-code-execution vulnerabilities with CVSS v4.0 scores of 9.2.
PHP released fixes on October 21, 2026, at about 14:00 UTC.
The fixed PHP versions were 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Apache mod_php deployments were identified by multiple vendors as at highest risk; PHP-FPM, PHP-CGI, LiteSpeed and FrankenPHP were also affected.
LiteLLM confirmed that litellm==1.107.0 published on October 21 was compromised and that affected PyPI and Docker artifacts were pulled.
Microsoft independently confirmed that the compromised LiteLLM package could execute through Python startup hooks and was designed to steal credentials and enable remote code execution.
Eight eMudhra intermediate-CA private keys—six TLS and two code-signing—were compromised because of insufficient randomness during key generation.
eMudhra revoked the affected certificates on October 18, and major browser vendors deployed blocking or distrust measures.
Node.js issued October security releases for the 22.x, 24.x and 26.x lines, including a Brotli decoder flaw and CA-certificate updates.
GitLab issued an out-of-band release on October 21 addressing 12 vulnerabilities.

Competing Explanations

A cluster, not one campaign

The strongest evidence-based interpretation is that “Black October” describes a concentration of separate incidents and disclosures, not a proven single attack campaign. PHP, LiteLLM, eMudhra, Node.js and GitLab involved different products, vendors and failure modes.

AI as accelerant

Some reporting frames AI as the defining feature of the month. Axios described “AI-discovered software flaws and attacks on the platforms powering the AI boom,” while Wiz described AI-assisted discovery of the PHP flaws.

However, evidence is currently insufficient to quantify how much AI increased overall attacker success, how many incidents were AI-discovered, or whether AI materially changed the severity of the month compared with prior vulnerability clusters. The claim should be treated as an emerging industry assessment, not an established causal finding.

PHP exploitation: conflicting signals

There is a direct conflict in public reporting:

BleepingComputer reported on October 26 that PHP2Shell had been successfully exploited in the wild, citing honeypot evidence of confirmed remote code execution against Apache mod_php running PHP 8.4.26.
CrowdStrike reported on October 28 that it had not observed successful exploitation in the wild or in its honeypots, and said it had not identified a fully weaponised or widely applicable exploit.

Both statements can be technically true if exploitation was limited, targeted, or observed by only some monitoring systems. But the overall extent of exploitation remains uncertain.

DPRK attribution

CYFIRMA published an advisory describing a “suspected DPRK campaign staging PHP2Shell targeting.” This is an attribution claim, not a confirmed fact. Evidence is currently insufficient in the available public reporting to independently verify North Korean responsibility or the campaign’s scale.

Expert Opinions

ENISA, the European Commission, CERT-EU, Europol EC3 and EU national CSIRTs urged organisations to identify PHP-based systems, prioritise internet-facing services, apply patches, and isolate exposed applications where immediate remediation was not possible.
The U.S. National Security Agency recommended immediate inventory of PHP-dependent systems and prioritisation of vendor patches, warning that exploitation could enable data theft, disruption or further network access.
Singapore’s Cyber Security Agency advised administrators to update PHP immediately and to check for PHP embedded in third-party products.
CERT-In emphasised that the eMudhra issue arose from weak key generation, not a flaw in the P-384 cryptographic algorithm itself, and urged stronger randomness, hardware-security-module controls and independent verification in CA key-generation processes.
CrowdStrike cautioned that obstacles to weaponising PHP2Shell might constrain immediate widespread exploitation, while still urging patching.

Risks and Uncertainties

Established risks

Unpatched PHP servers remained exposed to remote code execution, particularly Apache mod_php deployments.
Organisations that installed LiteLLM 1.107.0 from PyPI or affected Docker images may have exposed API keys, cloud credentials, application secrets and systems to remote-code-execution tooling.
The eMudhra incident created a risk of fraudulent TLS and code-signing certificates, although there was no confirmed malicious exploitation in the public advisories reviewed.
Removing affected certificate chains from trust stores could disrupt legitimate services that depended on them, creating a trade-off between security and availability.

Uncertain or evolving points

The total number of organisations compromised is unknown.
The full extent of PHP2Shell exploitation is disputed or incomplete.
Attribution of PHP2Shell targeting to DPRK is unverified in the available public evidence.
The claim that AI “caused” Black October is not established; AI’s role as a discovery and reporting accelerant is better supported than any claim of direct causation.
Long-term systemic effects—including insurance losses, regulatory responses and changes to software supply-chain controls—remain predictions rather than verified outcomes.

Conclusion

“Black October” is best understood as a convenient label for a severe, simultaneous security week, not as a formally defined incident or proven unified attack. The PHP2Shell flaws, LiteLLM compromise and eMudhra certificate-key weakness were independently serious and are supported by primary or authoritative sources.

The month does highlight two durable lessons: internet-facing software dependencies can create systemic risk, and software supply chains remain a high-value target. Claims that AI transformed the threat landscape are plausible but should be stated cautiously until more incident data and independent analyses become available.

What it means for you personally

At work

If your employer’s systems are managed by an IT team, your practical role is usually to follow security instructions: install approved updates, avoid suspicious links or attachments, use multi-factor authentication, and report anything unusual.

The headlines matter most to people who run or maintain websites, servers, developer tools, or AI systems. PHP2Shell, for example, affects the PHP runtime beneath websites and applications—not something most employees can fix from their own laptop.fortinet+1

As a customer

You should not assume your bank, email, or favourite retailer has been breached merely because these stories appeared. The verified incidents were specific: PHP2Shell affected unpatched PHP servers; LiteLLM 1.107.0 affected people who installed that compromised package; eMudhra’s issue concerned certificate keys in a limited customer ecosystem.

Reasonable personal precautions are the same as good routine security:

Use unique passwords and a password manager.
Turn on multi-factor authentication for email, banking, shopping and work accounts.
Be cautious with unexpected password-reset emails, invoices, delivery notices or “security alert” messages.
Keep your phone, computer and browser updated.
Monitor bank and card statements; report unfamiliar transactions promptly.

What it means for your online shop

If your site runs PHP

This is the issue most likely to affect a typical small-business website or online shop, especially one built on WordPress, WooCommerce, Drupal, Joomla, Magento or custom PHP code. The flaw is in PHP itself, so updating a WordPress plugin or theme alone does not fix it.fortinet+2

Your website should be running a patched PHP version:

PHP 8.5.12 or newer
PHP 8.4.27 or newer
PHP 8.3.36 or newer
PHP 8.2.35 or newer
Or a hosting-provider or Linux-distribution package that explicitly includes fixes for CVE-2026-109618 and CVE-2026-109619.fortinet+2

Ask your host or developer a direct question: “Which PHP version is my production website running, has it been patched for PHP2Shell, and has the web server or PHP service been restarted so the fix is active?” Installing an update without restarting the relevant service may leave the old vulnerable process running.fortinet+2

If your site does not run PHP

You are not exposed to PHP2Shell, but the broader lesson still applies: keep your platform, plug-ins, dependencies, hosting environment and payment integrations updated. The LiteLLM incident shows why supply-chain security matters: a trusted package or container image can become the delivery mechanism for malware.

Should you be worried?

Concerned and proactive: yes. Panicked or expecting shutdown: no.

The risk is real because attackers reportedly began exploiting PHP2Shell before the fix was publicly released, and some security researchers reported confirmed exploitation. However, other researchers reported they had not observed successful exploitation, so the scale remains uncertain.

For a business whose income depends on its website, the sensible posture is:

Assume your site may be affected until your host or developer confirms otherwise.
Patch promptly, prioritising the live customer-facing shop.
Do not rely on hope or on a plugin claiming to “fix PHP2Shell.”
Prepare for a short, planned maintenance window if necessary—but only take the site offline if it cannot be patched or safely protected.blog.nviso+1

An online shutdown is not inevitable. It is a last-resort risk-control measure for a system that cannot be patched quickly, not the normal outcome.blog.nviso+1

Safeguards for your business

Immediate actions

Identify every public-facing system. Include the shop, blog, staging site, customer portal, booking system, API and anything your web agency manages for you.fortinet+1
Confirm PHP patch status in writing. Ask for the exact PHP version, patch date, restart confirmation and evidence that the production service is using the patched runtime.uhy-us+1
Update the shop platform and extensions. Apply updates for WordPress/WooCommerce or your e-commerce platform, themes and plug-ins from official sources only.uschamber+1
Check backups. Ensure you have recent, tested backups stored separately from the live website. A backup you have never restored is not yet a proven backup.uhy-us+1
Rotate sensitive credentials if exposure is possible. This includes admin passwords, database passwords, hosting credentials, API keys, payment-gateway keys, SMTP credentials and any secrets stored on the server.
Review access logs and unusual activity. Look for unexpected administrator accounts, modified files, strange outbound connections, new cron jobs, or unfamiliar login locations—especially activity before the patch was applied.fortinet+1

Medium-term protections

Move off unsupported PHP versions; PHP 8.1 and older do not receive standard upstream security fixes, and PHP 8.2 support ends on December 31, 2026.blog.nviso+1
Use multi-factor authentication for hosting, domain registrar, DNS, CMS and payment accounts.
Limit administrator access to people who genuinely need it.
Use a reputable web application firewall or managed-hosting security layer as an additional control, not as a substitute for patching.fortinet+1
Keep an incident contact list: host, developer, payment provider, domain registrar and backup provider.
Ask suppliers to notify you promptly when they patch security issues affecting your site.

If you find signs of compromise

Do not simply delete suspicious files and continue trading. Preserve logs, take advice from your host or a security professional, change all credentials from a clean device, restore from a known-good backup if needed, and review whether customer or payment data may have been accessed.fortinet+1

If customer personal information may have been exposed, South African organisations should assess their obligations under the Protection of Personal Information Act (POPIA), including notification duties where applicable. This is legal/compliance territory, so obtain advice from a qualified South African privacy or cyber-law professional rather than relying on general online guidance.

Source List

Wiz, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet,” October 21, 2026.
ENISA, “Joint statement on critical PHP vulnerabilities,” October 21, 2026.
Cyber Security Agency of Singapore, “Critical Vulnerabilities in PHP (PHP2Shell),” October 23, 2026.
NSA, “Critical Patches Recommended for PHP Vulnerabilities,” October 21, 2026.
Fastly, “How Fastly Detected and Built a Coordinated Response to PHP2Shell,” October 23, 2026.
Sophos, “PHP2Shell Vulnerabilities,” advisory.
BleepingComputer, “PHP2Shell security flaws now successfully exploited in the wild,” October 26, 2026.
CrowdStrike, “Obstacles to Weaponizing Likely Constrain Immediate Exploitation,” October 28, 2026.
Microsoft Security Blog, “Inside the LiteLLM 1.107.0 supply chain compromise,” October 23, 2026.
LiteLLM, “Contained: Oct 21, 2026 LiteLLM release v1.107.0,” October 21, 2026.
LiteLLM, “The attack chain behind the v1.107.0 LiteLLM release,” October 23, 2026.
Microsoft MSRC, “Microsoft’s response to compromised eMudhra certificate authority keys,” October 26–27, 2026.
CERT-In, “Compromise of eMudhra Intermediate CA Certificates,” October 21, 2026.
Palo Alto Networks Unit 42, “eMudhra Intermediate CA Certificates Compromised,” October 22, 2026.
ESET WeLiveSecurity, “Lessons from cybersecurity Black Week,” October 28, 2026.
Axios, “Inside ‘Black October’: AI’s cyber scare delivers a Y2K lesson,” October 28, 2026.
CYFIRMA, “Suspected DPRK Campaign staging PHP2Shell Targeting,” October 25, 2026.
The Wall Street Journal, “America Needs a 911 Line for Cybersecurity,” October 28, 2026.

Known facts

PHP2Shell consists of CVE-2026-109618 and CVE-2026-109619, both critical unauthenticated RCE vulnerabilities rated CVSS v4.0 9.2.
PHP released fixes on October 21, 2026, for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
LiteLLM confirmed that its 1.107.0 PyPI and Docker release was compromised and contained credential-stealing and remote-code-execution functionality.
Eight eMudhra intermediate-CA private keys were compromised due to insufficient randomness; six related to TLS and two to code signing.
eMudhra revoked the affected certificates on October 18, and browser vendors deployed protective trust-store changes.
Node.js and GitLab both issued security updates on October 21.

Disputed claims

The extent of PHP2Shell exploitation: BleepingComputer reported confirmed in-the-wild exploitation, while CrowdStrike reported no successful exploitation observed in its telemetry or honeypots.
The precise role and scale of AI in causing or accelerating the incidents.
Whether “Black October” represents a distinct, coordinated campaign rather than a coincidental cluster. Evidence supports the latter, more limited interpretation.

Unverified claims

DPRK attribution for PHP2Shell targeting.
Claims of “several dozen major cyberattacks” during October 2026; evidence is currently insufficient to verify that count.
Any assertion that AI autonomously discovered or exploited the PHP flaws without substantial human involvement.
Any precise estimate of organisations breached, credentials stolen, or financial losses attributable to the October events.