Not one attack, but one busy month
The name Black October refers to October 2026, when critical security findings appeared almost at once. It is worth correcting one thing from the start: this was not a single attack by a single actor, but a mix of vulnerability disclosures, supply chain compromises, and trust infrastructure failures, whose timing fell close together so the impact felt like one big event.
The distinction matters. A coordinated attack points at an actor. A wave like this points at a condition: foundations used by many sites turned out to have holes, and those holes were now public knowledge. Some of these findings were even discovered with the help of AI, which speeds up both discovery and disclosure.
PHP on the front line: PHP2Shell
The biggest story of the month was called PHP2Shell: two critical flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, each scoring CVSS 9.2. Both allow unauthenticated remote code execution on web servers running PHP. An attacker needs no account and does not need to pass a login page. A specially crafted request is enough to run commands with the privileges of the server's PHP worker.
What was attacked here is not an application, but how PHP handles web requests. The first flaw abuses out-of-memory handling during request processing, for example while parsing uploaded form data, where the session.upload_progress handler decodes and rewrites a session during upload parsing, before the request's own script runs. When that process runs out of memory and aborts abruptly, PHP's internal state becomes inconsistent and can be corrupted into code execution. The second flaw abuses global state left over from one request, then reused by a later request on the same worker.
The blast radius is wide because PHP sits beneath most of the web: WordPress, Joomla, Drupal, PrestaShop, WooCommerce, Magento, Laravel, Symfony, and countless custom applications. Every way PHP serves web requests was affected, including Apache mod_php, rated the highest risk, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Even internal tools used only by employees were affected if reachable from the internet, because the flaw triggers before the login page. The flaws affected every release back to PHP 5 in 2004 and went undetected for more than a decade.
Details leaked on October 20, ahead of the planned disclosure date, and early attacks were already visible before a fix existed. Emergency fixes shipped on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older received no official fix, leaving older sites the hardest group to protect. The UK's National Cyber Security Centre even advised organisations that could not remediate immediately to consider taking the system offline until it could be fully fixed.
JavaScript: Next.js and Node.js
On October 14, the spotlight fell on Next.js, the framework behind many modern sites. Two critical vulnerabilities exploitable without authentication were announced: GHSA-673q-mjm6-r5xr in the use cache feature, and GHSA-2464-fhr4-w9xw in the image optimisation API, where a specially crafted SVG file could trigger code execution. Around the same time, GHSA-p3m5-59mp-jv5r disclosed a denial-of-service flaw in Server Actions. Fixes were released in versions 16.4.1 and 15.5.28.
A week later, on October 21, it was Node.js, the runtime on which most JavaScript web applications run. Ten CVEs were fixed at once, including remote code execution in the Brotli decoder (CVE-2026-111497) and TLS hostname validation bypasses (CVE-2026-105483 and CVE-2026-106069). The patched runtimes were versions 26.12.1, 24.22.1, and 22.23.4. The pattern matches PHP: what was attacked is a foundation layer, so one fix protects every application above it, and one delay endangers all of them at once.
Python: trust and credentials
Python was hit by Black October from two different directions. The first was trust infrastructure. Eight intermediate keys belonging to the eMudhra certificate authority turned out to be computable by anyone, one of them being just the number 4. Weak keys like these let an attacker forge HTTPS certificates that look legitimate and impersonate sites such as Python.org or the PyPI package index, when connections are intercepted. Browsers blocked those keys within hours, but Python tooling had to be updated: pip version 26.2.2 or newer, together with updated certifi and trust stores.
The second direction was application credentials. CVE-2026-89111, scoring CVSS 10.0, is a server-side request forgery flaw in the SAP Cloud SDK for Python. The SDK builds an OAuth2 token request URL by inserting an application-provided tenant subdomain. An attacker controlling that subdomain could inject URL delimiters and redirect the token request to their own server, so the SDK would send the application's client ID and client secret to the attacker. The flaw was fixed in SDK version 0.45.2, after it emerged that several releases had skipped the validation check that should have been there.
Java: a large update and trust stores
Java entered this wave through two doors. The first was Oracle's October quarterly update, which fixed 55 Java SE vulnerabilities at once. The second was the same as Python: Java trust stores also had to be updated to stop trusting the weak eMudhra keys. In addition, SAP's October security updates included flaws in Java-based applications, including CVE-2026-89108, where a missing authorisation check in an SAP manufacturing component allowed creating an administrator account on the Java application server beneath it, leading to full compromise.
The lesson from the Java side matches the others: what was attacked is not a feature users see, but layers that stay invisible, namely the runtime, the trust store, and platform components that are rarely opened except when a security announcement arrives.
Beyond languages: supply chain and credentials
Some Black October incidents did not attack a programming language at all. What was attacked was the software delivery path and the secrets around it. GitLab disclosed CVE-2026-110264, unauthenticated remote code execution scoring CVSS 10.0 on self-managed instances. The npm package tensorlake version 0.5.144, published from a hijacked account, carried a credential-stealing worm. The LiteLLM 1.107.0 release on PyPI and Docker contained a credential thief. OVHcloud CLI binaries versions 0.11.0 through 0.15.0 were swapped for code that steals cloud credentials and SSH keys. Rank Math PRO 3.0.123, downloaded in an eleven-hour window, carried malware. Stolen UpdraftCentral keys were used to push backdoor plugins to customer sites. Railway reported possible access to encrypted environment variables, some decrypted, and Zeabur reported plaintext admin credentials that allowed reading customer secrets across nine regions.
This list matters because it changes what needs protecting. Patching your own code is not enough if a package you installed has turned hostile, and fixing a vulnerability is not enough if stolen credentials are still valid.
What fixed means
For vulnerabilities like these, fixed means a version upgrade, not a setting that can be switched on. Sites running PHP, Next.js, and Node.js runtimes above the fix lines are on the right side of this line. Sites still below them remain vulnerable, no matter how good their other security layers are. Updates must reach production: PHP workers restarted, containers rebuilt, and the version actually running checked again.
And where credentials were already exposed, a fix is not complete without rotation: stolen keys, tokens, and passwords must be replaced, because closing the hole does not revoke access an attacker already gained. This is the first lesson of Black October, and the simplest one: your software versions, your trust stores, and your credentials are part of your security. Not technical details that can wait until there is time.
