Black October (information security)

On 17 October 2026, a security researcher reported that the private keys associated with eight intermediate certificate authority (CA) certificates operated by the Indian digital trust provider eMudhra were cryptographically weak. The keys had been generated with insufficient randomness during a key-generation ceremony in April 2025, making it possible to recover them and create fraudulent certificates trusted by vulnerable clients.^[3]

The discovery prompted emergency responses from major browser vendors. Google Chrome blocked the affected public keys through its CRLSet mechanism, while Mozilla distributed revocations to Firefox users through OneCRL. These protections were deployed without requiring an immediate browser restart.^[4]

eMudhra stated that none of the affected intermediate authorities had issued end-entity certificates and that it had found no evidence of a breach of its infrastructure or customer data.^[5]

On 22 October, eMudhra announced that it would withdraw from the global SSL/TLS certificate business following the incident and the resulting loss of trust from major technology companies.^[6][7]

On October 20, 2026, Oracle released a security patch for a security flaw in E-Business Suite. The issue CVE-2026-101767, an unauthenticated SQL injection vulnerability, could allow remote code execution and access to sensitive financial, payroll, and HR data.^[8]

On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The vulnerabilities affected the core PHP interpreter and could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers.^[9]

Researchers from Wiz reported that the vulnerabilities involved memory-management errors in PHP, including the reuse of freed memory and the persistence of invalid internal state between requests. The researchers demonstrated remote code execution against installations of WordPress, Drupal, and Joomla, as well as the disclosure of sensitive process memory.^[10]

The widespread deployment of PHP raised concerns about the potential exposure of websites and web applications.^[11]

The PHP project released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October. The United States National Security Agency also issued an advisory recommending urgent patching of affected systems.^[12][13]

On 21 October 2026, the release infrastructure of LiteLLM, an open-source gateway for accessing multiple large language model providers, was compromised in a software supply chain attack. Attackers published a malicious version, 1.107.0, to the Python Package Index (PyPI) and distributed compromised container images through Docker registries.^[14]

The malicious release contained credential-stealing software and remote-access functionality. Researchers reported that the malware targeted browser credentials, cloud service secrets, developer authentication tokens and API keys used by AI services.

According to LiteLLM's incident report, the compromised PyPI packages were available between 11:39 and 13:23 UTC on 21 October. Affected Docker Hub images were distributed between approximately 11:46 and 14:20 UTC. The compromised packages were subsequently withdrawn or replaced.^[15]

A subsequent investigation found that the attackers had obtained developer credentials and manipulated the project's release workflow to publish malicious artifacts. LiteLLM advised affected users to rebuild compromised environments and rotate potentially exposed credentials.^[16]

On October 21, GitLab Inc. released fixes for a flaw that, under certain conditions, allows an attacker to carry out remote code execution on self-managed instances of GitLab. GitLab Inc. has not specified what those conditions are. The flaw got the designation CVE-2026-110264.^[17]

On 21 October 2026, security patches were released to address an out-of-bounds write vulnerability in Google's open-source Brotli data compression library.^[18] The vulnerability, tracked as CVE-2026-111497, affected multiple versions of the Brotli decoder and could allow an unauthenticated remote attacker to corrupt adjacent decoder state memory by supplying a specially crafted compressed data stream. Potential consequences include information disclosure, denial of service, and arbitrary code execution.^[19] The vulnerability also affected software incorporating the Brotli decoder, including Node.js,^[20] Firefox, and Thunderbird.^[21]

On 22 October 2026, the TianoCore project publicly disclosed CVE-2026-97631, a critical vulnerability in the EDK II firmware implementation's network boot driver. The flaw could allow an attacker to execute arbitrary code during the pre-boot phase of a system using affected firmware and network boot functionality.^[22][23]

The vulnerability is a buffer overflow in the PXE Base Code driver, which handles network booting over IPv4 and IPv6. Incorrect bounds handling when copying Internet Control Message Protocol (ICMP) error messages into a fixed-size buffer can cause an out-of-bounds memory write. Under suitable conditions, an unauthenticated attacker able to deliver a crafted message while a vulnerable system is network-booting could cause a denial of service or execute code before the operating system loads.^[22][23]

The issue was assigned a CVSS 4.0 base score of 9.5 out of 10, classified as critical. Researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google were credited with discovering the vulnerability.^[24]

The vulnerability affects systems that use the vulnerable EDK II network boot implementation; it does not affect devices that boot exclusively from local storage. Remediation requires firmware updates incorporating a fix for the affected driver. At the time of the public advisory, the upstream project had not listed a patched version.^[22][23]