In information security, October 2026 has been referred to as Black October due to several major security incidents and vulnerability disclosures. The events drew attention to the growing use of artificial intelligence in vulnerability research and the potential consequences for widely deployed software and internet infrastructure. [1] [2]
The events included the disclosure of the PHP2Shell vulnerabilities, a software supply chain attack affecting LiteLLM, and the compromise of intermediate certificate authority keys operated by eMudhra. A separate security release for Node.js addressed several vulnerabilities, including a potentially exploitable flaw in its Brotli decompression implementation. Additionally, a severe vulnerability in GitLab was fixed and made public.
On 17 October 2026, a security researcher reported that the private keys associated with eight intermediate certificate authority (CA) certificates operated by the Indian digital trust provider eMudhra were cryptographically weak. The keys had been generated with insufficient randomness during a key-generation ceremony in April 2025, making it possible to recover them and create fraudulent certificates trusted by vulnerable clients. [3]
The discovery prompted emergency responses from major browser vendors. Google Chrome blocked the affected public keys through its CRLSet mechanism, while Mozilla distributed revocations to Firefox users through OneCRL. These protections were deployed without requiring an immediate browser restart. [4]
eMudhra stated that none of the affected intermediate authorities had issued end-entity certificates and that it had found no evidence of a breach of its infrastructure or customer data. [5]
On 22 October, eMudhra announced that it would withdraw from the global SSL/TLS certificate business following the incident and the resulting loss of trust from major technology companies. [6] [7]
On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The vulnerabilities affected the core PHP interpreter and could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. [8]
Researchers from Wiz reported that the vulnerabilities involved memory-management errors in PHP, including the reuse of freed memory and the persistence of invalid internal state between requests. The researchers demonstrated remote code execution against installations of WordPress, Drupal, and Joomla, as well as the disclosure of sensitive process memory. [9]
The widespread deployment of PHP raised concerns about the potential exposure of websites and web applications. [10]
The PHP project released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October. The United States National Security Agency also issued an advisory recommending urgent patching of affected systems. [11] [12]
On 21 October 2026, the release infrastructure of LiteLLM, an open-source gateway for accessing multiple large language model providers, was compromised in a software supply chain attack. Attackers published a malicious version, 1.107.0, to the Python Package Index (PyPI) and distributed compromised container images through Docker registries. [13]
The malicious release contained credential-stealing software and remote-access functionality. Researchers reported that the malware targeted browser credentials, cloud service secrets, developer authentication tokens and API keys used by AI services.
According to LiteLLM's incident report, the compromised PyPI packages were available between 11:39 and 13:23 UTC on 21 October. Affected Docker Hub images were distributed between approximately 11:46 and 14:20 UTC. The compromised packages were subsequently withdrawn or replaced. [14]
A subsequent investigation found that the attackers had obtained developer credentials and manipulated the project's release workflow to publish malicious artifacts. LiteLLM advised affected users to rebuild compromised environments and rotate potentially exposed credentials. [15]
On October 21, GitLab Inc. released fixes for a flaw that, under certain conditions, allows an attacker to carry out remote code execution on self-managed instances of GitLab. GitLab Inc. has not specified what those conditions are. [16]
On 21 October 2026, security patches were released to address an out-of-bounds write vulnerability in Google's open-source Brotli data compression library. [17] The vulnerability, tracked as CVE-2026-111497, affected multiple versions of the Brotli decoder and could allow an unauthenticated remote attacker to corrupt adjacent decoder state memory by supplying a specially crafted compressed data stream. Potential consequences include information disclosure, denial of service, and arbitrary code execution. [18] The vulnerability also affected software incorporating the Brotli decoder, including Node.js [19] , Firefox, and Thunderbird. [20]