Black October
Black October is a name given to October 2026, when a cluster of major security incidents and vulnerability disclosures hit core internet infrastructure within a few days. They included critical flaws in the PHP programming language, a supply-chain attack on the AI software LiteLLM, and the revocation of compromised certificate authority keys. Coming as AI tools were increasingly being used to find software flaws, the episode prompted warnings that AI had tipped the balance toward attackers.[1]
Name
The name began circulating on social media around October 22, 2026, in posts describing the previous 48 hours as among the most serious in cybersecurity history; its exact origin is unclear. Major outlets including The Guardian, The Washington Post and CNBC adopted it the following day.[1][2]
Incidents
eMudhra certificates
On October 20, Mozilla and Google announced that the private keys of several intermediate certificates operated by the Indian certificate authority eMudhra had been compromised. Google said the keys had been "generated with insufficient randomness", and both browsers blocked the certificates within hours.[3][4] Two days later, eMudhra announced it was leaving the global web-certificate business.
PHP2Shell
On October 21, the PHP project released emergency patches for a set of memory-safety flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), found by researchers at the cloud-security firm Wiz with the help of AI models. Wiz reported that "every PHP version released in the last decade is affected by at least one of these vulnerabilities", and demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla.[5] Governments in Finland, Japan and the Netherlands took public websites offline as a precaution.[6]
LiteLLM
The same day, attackers published a malicious release of LiteLLM, a widely used open-source gateway for AI models, to the Python Package Index and Docker registries. According to the project, the release "contained compiled malware which steals credentials and loads remote-code execution tools"; the attackers had used leaked access tokens to override the project's release protections.[7]
Other disclosures
In the same period, a maximum-severity remote code execution flaw was patched in GitLab, and an out-of-bounds write in Google's Brotli compression library (CVE-2026-111497) was patched in Node.js and other software.[8] Researchers at Trend Micro's Zero Day Initiative accidentally posted reports of several unpatched Linux kernel vulnerabilities to the public kernel mailing list instead of its private security list.[9]
Interpretation
Commentators presented Black October as a sign that AI was accelerating the discovery of old, unpatched vulnerabilities faster than defenders could fix them. "Humans don't work at the speed of AI. That is the asymmetry right now," the Columbia computer scientist Junfeng Yang told Fortune.[10] Others cautioned that the incidents were largely unrelated, with several having nothing to do with AI, and described the month as a coincidental "disclosure wave" rather than a coordinated campaign.[10][11]
See also
References
- ↑ 1.0 1.1 Bhuiyan, Johana (October 23, 2026). "'Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking". The Guardian. Retrieved November 12, 2026.
- ↑ Capoot, Ashley (October 23, 2026). "PHP vulnerabilities and AI cybersecurity". CNBC. Retrieved November 12, 2026.
- ↑ October 20, 2026. "Protecting Firefox users following the compromise of eMudhra intermediate certificates". Mozilla Security Blog. Retrieved November 12, 2026.
- ↑ October 20, 2026. "Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates". Google. Retrieved November 12, 2026.
- ↑ Sagi Tzadik et al. (October 21, 2026). "PHP2Shell". Wiz. Retrieved November 12, 2026.
- ↑ October 23, 2026. "Governments, companies take websites offline over PHP flaws". The Korea Times. Retrieved November 12, 2026.
- ↑ Krrish Dholakia et al. (October 21, 2026). "Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised". LiteLLM. Retrieved November 12, 2026.
- ↑ October 26, 2026. "RHSB-2026-015". Red Hat. Retrieved November 12, 2026.
- ↑ October 22, 2026. "Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List". Phoronix. Retrieved November 12, 2026.
- ↑ 10.0 10.1 Lake, Shae (October 29, 2026). "Black October: AI cyberattacks". Fortune. Retrieved November 12, 2026.
- ↑ Callahan, Heath (October 23, 2026). "Black October is a disclosure wave; the label hides the clock". Forkast. Retrieved November 12, 2026.