Black October 2026: Major Cybersecurity Vulnerabilities and Incidents Reported So Far

October 2026 has brought a series of serious cybersecurity disclosures, software vulnerabilities and supply-chain incidents. The concentration of reports between October 19 and 22 has led some people to call the period “Black October.”

The phrase gained attention through a widely shared post on X on October 22. It is an informal label, not the official name of a single cyberattack. Many of the incidents involve separate organizations, and some attacks reportedly began months before they became public.

Scope: October 1–23, 2026. This is a curated list of major reported issues, not a complete list of every CVE published this month

1. Critical vulnerabilities and emergency security patches

Date reported	Vulnerability / product	Severity and impact	Status / remediation
Oct 14	Next.js — GHSA-673q-mjm6-r5xr	Critical; unauthenticated remote code execution under affected use cache configurations	Upgrade to a patched release, including 16.4.1 or the applicable supported branch fix.
Oct 14	Next.js Image Optimization API — GHSA-2464-fhr4-w9xw	Remote code execution risk associated with SVG processing	Upgrade to a patched release; verify the exact advisory and branch guidance.
Oct 14	Next.js App Router — GHSA-p3m5-59mp-jv5r	High; denial of service involving Server Actions	Upgrade to a fixed version.
Oct 21	PHP2Shell — CVE-2026-109618	Critical, CVSS 9.2; unauthenticated remote code execution from memory corruption	Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Oct 21	PHP2Shell — CVE-2026-109619	Critical, CVSS 9.2; remote code execution involving stale global state	Same PHP security releases as above.
Oct 21	Node.js Brotli decoder — CVE-2026-111497	High impact; memory corruption with demonstrated remote code execution in certain application configurations	Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.
Oct 21	Node.js TLS hostname validation — CVE-2026-105483, CVE-2026-106069	High; certificate hostname-validation bypasses	Upgrade to the fixed Node.js release for the affected branch.
Oct 21	GitLab — CVE-2026-110264	Reported critical, CVSS 10.0; unauthenticated remote code execution affecting self-managed instances	Security fixes were reported on October 21; verify the exact affected and fixed versions in GitLab’s official advisory.

Note: The Next.js issues were disclosed earlier in October, so they are not all new incidents from the October 21–23 surge. Their inclusion reflects their significance, not a claim that exploitation has been confirmed for each one.

Also read – PHP2Shell Crisis: Which Major Websites Went Offline, and Why

2. Vulnerabilities with reported exploitation in October

These deserve separate attention because a flaw being exploited in real attacks is different from a vulnerability that has only been disclosed.

Product	CVE / incident	Reported activity
Plex Media Server	CVE-2026-96652, 96654, 96655, 96656	Four chained flaws dubbed Plex2Shell; exploitation reported to deploy cryptominers and proxy malware. Fixed in Plex Media Server 1.43.3.10861.
Palo Alto Networks PAN-OS	CVE-2026-0322	Exploitation reported against the firewall management interface; access restrictions and fixed releases advised.
Cisco Secure Email Gateway	CVE-2026-76519	Active exploitation reported under specific product configurations.
Siemens Software Center	CVE-2026-110936	Exploitation reported in ClickFix attacks involving DLL sideloading.
EG Secure Solutions SiteGuard	CVE-2026-106931	Command-injection vulnerability confirmed as exploited by the vendor, according to reporting.
Edge security appliances	Multiple September–October CVEs	CISA added several exploited NetScaler, Ivanti, PAN-OS and Cisco flaws to its Known Exploited Vulnerabilities catalog during the period.

For the Plex and appliance vulnerabilities, verify current vendor advisories before deploying fixes; the identifiers and patch versions above are not interchangeable across product branches.

3. Supply-chain attacks and compromised credentials

These are not necessarily conventional CVEs, but they can have an equally serious impact.

Date	Incident	What happened
Oct 8	TensorLake npm package	Malicious tensorlake@0.5.144 was published after a maintainer account was compromised. The payload reportedly stole credentials and could propagate. The clean version is 0.5.143.
Oct 21	LiteLLM	Malicious Python and Docker artifacts were distributed through a compromised release process, with credential-stealing and backdoor functionality.
October	eMudhra / emSign certificate keys	Weakly generated intermediate CA private keys triggered emergency certificate distrust measures by browser and runtime vendors.
October	Railway cloud platform	Reports described possible exposure of customer environment variables and secrets; affected users were advised to rotate credentials.
October	ConnectWise-related access	Microsoft reported activity by Storm-0940 involving ConnectWise products and downstream organizations, including cases of privileged cloud access.

Why these matter: patching a vulnerable application does not revoke stolen credentials or remove malware that was installed through a compromised package. Those require separate containment and recovery steps.

Major Cybersecurity Incidents in October 2026

1. PHP2Shell: Critical PHP vulnerabilities

On October 21, the PHP team disclosed two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Under affected configurations, attackers could exploit these flaws to execute code without authentication. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team recommends upgrading immediately. (Official PHP advisory)

2. Critical Next.js vulnerabilities

Next.js disclosed several serious vulnerabilities in October, including flaws that could permit remote code execution under specific conditions and a denial-of-service issue affecting App Router applications. Developers should check the official Next.js security announcements and upgrade to the appropriate patched release.

3. Node.js security flaws

On October 21, Node.js published security updates addressing multiple vulnerabilities. These included a Brotli decoder memory-corruption flaw that could permit remote code execution and issues involving TLS certificate hostname validation. Fixed releases were published for the 22.x, 24.x and 26.x branches. (Official Node.js announcement)

4. LiteLLM supply-chain compromise

A malicious LiteLLM release was distributed through software package channels after a compromise of the release process. The affected artifacts contained credential-stealing functionality and remote-access capabilities. The incident highlights the risks of installing compromised software dependencies, even when they come from familiar repositories.

5. eMudhra certificate security incident

Weak private keys associated with certain intermediate certificate authorities triggered certificate distrust measures by major technology companies. The incident raised concerns about the integrity of digital certificates used to establish trust in secure website connections.

6. Cloud platforms and data exposure

October reporting also included incidents involving cloud platforms, exposed credentials and sensitive data. These cases demonstrate how compromised accounts, trusted vendors and misconfigured systems can create risks beyond traditional software vulnerabilities.

Why Are So Many Incidents Appearing at Once?

Several factors may explain the concentration of reports:

• Faster vulnerability discovery: AI-assisted research and automated testing can help researchers identify flaws more efficiently.
• Rapid exploitation: Once vulnerability details become available, attackers can quickly develop or adapt exploits.
• Software supply-chain risks: A compromised developer account or package can affect many downstream users.
• Delayed disclosure: Some incidents become public weeks or months after the original compromise.
• Increased visibility: A major incident can draw attention to other investigations and security advisories released around the same time.

The clustering of disclosures does not prove that the incidents are connected or that all attacks began in October.

How Can Website Owners Protect Themselves?

Website owners and developers should update affected software, review security logs, rotate potentially exposed credentials and verify that third-party packages are safe. Organizations should also restrict access to administrative interfaces and monitor official vendor advisories for new fixes.

For WordPress website owners, checking the PHP version alone is not enough. They should confirm that the server is running a patched version and that the hosting provider has applied the relevant updates.

Final Thoughts

“Black October” captures a period of heightened cybersecurity concern, rather than a single coordinated global attack. Critical vulnerabilities, compromised software releases and certificate-security problems have highlighted how quickly risks can spread across connected systems.

The key lesson is straightforward: patch promptly, protect credentials and verify security incidents through reliable sources rather than assuming every headline describes the same attack.