Black October: What Security Teams Should Learn From October 2026

As of October 31, 2026, 04:26 UTC (October 30 Pacific)

“Black October” is circulating in cybersecurity commentary as a label for October 2026’s overlapping security disclosures. It captures the sense of urgency, but it should not substitute for an incident assessment. A shared month does not establish a shared attacker, and a vulnerability announcement does not establish that every affected organization was breached. Contemporary commentary using the label.

For HackWednesday readers, the useful question is straightforward: which developments change what your team needs to check?

Three cases provide a practical starting point: PHP’s critical runtime vulnerabilities, LiteLLM’s compromised release pipeline, and the security updates affecting Node.js and its dependencies.

The timeline matters

The dates below separate observed activity from public announcements:

• October 10: According to LiteLLM’s later investigation, an attacker used a previously exposed administrative key to access its agent platform. The malicious package release came eleven days afterward. LiteLLM investigation.
• October 17: Amazon recorded a PHP2Shell exploitation attempt in its MadPot honeypot telemetry. Amazon published that finding on October 21 and cautioned that successful exploitation of real-world systems had not been established by that analysis. Amazon’s findings.
• October 21: PHP released fixes for two critical vulnerabilities; LiteLLM disclosed its compromised 1.107.0 artifacts; and Node.js published security releases for its 22.x, 24.x, and 26.x lines. These were separate developments requiring different responses. PHP advisory, LiteLLM incident notice, Node.js advisory.
• October 27: Canada’s Cyber Centre reported that CISA had added the Brotli vulnerability, CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. That is a later exploitation-status update, not the original disclosure date. Cyber Centre advisory.

The operational implication: investigation windows should follow evidence of activity, rather than begin automatically on the day an alert reaches the team.

PHP: find the runtime behind the website

PHP’s October 21 advisory identified CVE-2026-109618 and CVE-2026-109619 as flaws allowing unauthenticated remote code execution. Installations serving web requests are at risk; PHP assessed Apache with mod_php as highest risk.

The initial fixed releases were 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Distribution packages may use backports, so check the vendor advisory. PHP’s October 23 follow-up also describes a separate, configuration-specific session-upload-progress issue. Review that guidance before closing the assessment.

On October 26, PHP rebuilt its Windows packages with Brotli 1.2.1 to fix CVE-2026-111497. The packages carry a -1 suffix, while the PHP runtime version remains unchanged. A runtime-number check alone can therefore miss the dependency fix. Verify the installed Windows package as well as the runtime. PHP security notices.

An application inventory alone may miss the underlying runtime. Ask hosting providers which PHP build actually serves requests, who owns its updates, and what evidence confirms deployment.

The NSA recommended inventorying PHP-dependent services, monitoring vendor updates, enhancing logging, and taking systems offline when an immediate update is not feasible until they can be fully mitigated. That deserves a planned service-continuity decision, not an indefinite patch exception. NSA guidance.

LiteLLM: a trusted release can become the attack path

LiteLLM reported malicious PyPI and container artifacts associated with version 1.107.0. Its incident notice says the payload stole credentials and loaded remote-code-execution tools. Some moving container tags were affected too, making historical image digests more useful than a tag’s current destination when investigating exposure. Affected artifacts and response guidance.

The October 23 investigation traced the chain to an administrative key committed publicly in May. Removing the file did not revoke the key. The attacker later obtained an organization-owner GitHub token, extracted additional credentials, changed release workflows, and published malicious artifacts. LiteLLM explicitly identifies this later report as the canonical account, correcting incomplete earlier assumptions. Canonical attack-chain report.

The lesson for teams adopting agents is concrete: review the credentials an agent platform can reach and the organizational authority those credentials carry.

If affected artifacts ran, replacing the dependency is only part of the response. Follow the vendor’s containment and credential-rotation guidance, including credentials accessible to the affected host. LiteLLM remediation instructions.

Node.js: follow the dependency into production

Node.js’s October 21 releases included a fix for CVE-2026-111497, an out-of-bounds write in its bundled Brotli decoder. An application that decompresses attacker-supplied Brotli data through node:zlib could face memory corruption, with consequences including crashes, memory disclosure, or remote code execution.

The project rated the highest severity in that release High, and shipped versions 22.23.4, 24.22.1, and 26.12.1. Use a current supported release containing the fixes and check application compatibility. Node.js security release.

For defenders, the reachability question matters: where does untrusted compressed data enter your application, and which runtime processes it? Updating a developer laptop does not establish that production containers or deployed services were rebuilt.

Where AI fits, and where the evidence stops

OpenAI’s October 21 account says Calif identified a critical PHP flaw using its model within Patch the Planet, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release. This supports a specific claim about AI-assisted defensive discovery. It does not establish that AI caused every incident grouped under Black October. Disclosure and coordination account.

Treat broad forecasts separately from verified incident facts. Defenders can act urgently without claiming that every attack is autonomous or that the internet has experienced its worst month.

Bring one check to your next security meeting

Choose an exposed service and ask its owner to demonstrate:

1. What is running: runtime, dependency versions, and deployed artifact identity.
2. What changed: the applicable advisory and evidence that remediation reached production.
3. What happened earlier: relevant logs and the investigation window.
4. What remains open: exposed credentials, exceptions, and a named decision-maker.

Black October should leave teams with a better response process: a clear path from advisory, to affected asset, to verified remediation, with investigation continuing wherever the evidence requires it.