AW Dev Rethought Flash: Black October — The Month the Internet Had a Very Bad Time

October 2026 will be remembered in security circles for a while. Not because of one breach, one CVE, or one nation-state campaign — but because of all of them, arriving at once. Researchers started calling it Black October somewhere around the third week, when the count of critical incidents crossed twenty and showed no sign of stopping.

This is not a comprehensive list. It is the list that matters to developers — the things running on your servers, in your pipelines, and in your dependencies right now.

PHP2Shell: The One That Touches Everything

If you run a web server, this is the one to act on first.

Two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619, collectively being called PHP2Shell — were found in the PHP runtime itself. Both scored CVSS 9.2. Both were being actively exploited approximately four days before patches were available.

PHP runs on roughly 70% of the web. WordPress, Laravel, Symfony, Drupal, legacy enterprise apps — all of it. Some governments took public-facing sites offline while they patched.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. If you haven’t updated, that’s the first thing to do after reading this.

GitLab: CVSS 10.0, Unauthenticated RCE

CVE-2026-110264 — an integer overflow in GitLab’s regex compiler engine leading to unauthenticated remote code execution. Maximum severity. Over 2,700 Community Edition instances were exposed at the time of disclosure.

If you’re self-hosting GitLab and haven’t patched, you have a CVSS 10 sitting on your network.

eMudhra: One Private Key Was Literally the Number 4

An Indian certificate authority had eight intermediate CA private keys compromised — not stolen, recovered by a researcher from the public certificates themselves in under a second. One key had the value of 4. Chrome and Firefox blocked the CA within hours of disclosure on October 20.

If your stack uses Node.js, Python certifi, Go’s certificate store, or Ubuntu/Debian system certs, patches are still rolling out. Check them.

LiteLLM: Your AI Gateway Got Poisoned

LiteLLM is one of the most widely used open-source AI gateways — the thing many teams put in front of their LLM API calls to handle routing, rate limiting, and cost tracking. A compromised release was published containing a password stealer and a remote access trojan.

This wasn’t the first time. There was a credential stealer in June, an SSRF flaw in August, a privilege escalation in September. October’s was a supply chain compromise of the published package itself.

If LiteLLM is in your stack, audit what version you’re running and verify the release checksums.

ARTEX + ConnectWise: AI-Assisted APT in Under Three Hours

A Chinese APT group used stolen ConnectWise credentials combined with ARTEX — an open-source AI autonomous pentesting system — to compromise over 2,250 Microsoft 365 tenants. They reached privileged cloud access in under three hours per target.

ARTEX’s original repository was deleted after the attack became public. It had over 800 forks before removal.

This is the first well-documented case of an AI pentesting tool being used at scale in an active nation-state campaign. The original repository is gone. The forks are not.

SharePoint Zero-Day: Unpatched, Under Active Exploitation

An on-premises SharePoint vulnerability is being actively exploited. It was not addressed in October’s Microsoft Patch Tuesday. Microsoft’s current guidance is mitigation controls rather than a patch — because there isn’t one yet.

If you’re running on-premises SharePoint, check Microsoft’s advisory for the current mitigation steps and apply them immediately.

The Rest of the List

Beyond the developer-critical items above, October also brought:

• NGINX — three critical flaws disclosed
• HTTP/3 — a single malformed connection can crash seven out of ten tested web server implementations
• Tor — 333 relay nodes hijacked to intercept login traffic
• WordPress — a plugin vendor’s signing keys stolen and used to push backdoored updates
• SafePay ransomware — FBI warning: 600+ critical infrastructure organisations hit
• Palo Alto firewalls — ransomware groups actively entering through perimeter devices

What This Month Actually Means

Black October isn’t a coordinated campaign. There’s no single threat actor behind all of this. What it is, is a reminder that the attack surface of a modern web application is enormous — your language runtime, your CI/CD platform, your certificate infrastructure, your AI dependencies, your cloud identity layer — and any one of them can be the entry point.

The ARTEX story is the one to watch closely. An AI tool built for offensive security research, published publicly, deleted after it was used in a nation-state campaign, and now living in hundreds of forks. The barrier to running a sophisticated, automated attack campaign just dropped again. It will keep dropping.

Patch PHP. Patch GitLab. Audit your AI dependencies. Check your SharePoint mitigation status. And assume that whatever isn’t patched today is already being scanned.