The Black October cyber incidents arrived in a pile. Between October 17 and 22, 2026, a critical PHP flaw, a certificate authority with absurdly weak keys, poisoned software releases and a federal ransomware warning all hit the news within days of each other. US agencies were in the thick of it. CISA put the PHP bug on its must-patch list, and the FBI joined a ransomware advisory the same week. Here’s what happened, what was actually new, and what to check on your own systems today.
What Is Black October in Cybersecurity?
Black October is an informal label for a cluster of major cyber incidents disclosed in October 2026, especially between October 17 and 22. It includes the PHP2Shell flaws, a weak-key certificate authority failure, software supply chain attacks, and AI-assisted intrusions. Researchers say it was a wave of disclosures, not one coordinated attack.
The name came from an X post on October 22, according to one timeline of the week, and it spread before most patches had even shipped. Wikipedia now has an entry for it.
The Biggest Black October Cyber Incidents at a Glance
| Date (2026) | Incident | What happened | What to do |
| Oct 17 | eMudhra certificate keys | Private keys for eight intermediate certificates were weak enough to recover almost instantly | Browser makers already blocked them; keep browsers updated |
| Oct 17–18 | UpdraftPlus (TeamUpdraft) | A compromised key was used to access the company’s site; connected WordPress sites saw unauthorized accounts and malicious plugins | Revoke old keys, inspect sites |
| Oct 19 | AI-agent website hacks | A Reuters investigation reported a hacker used AI agents to probe over 1,200 sites and breach more than 100 companies | Patch faster, watch logs |
| Oct 20 | SafePay ransomware advisory | CISA, FBI, Secret Service and partners tied the group to 600+ victims since August 2024 | Lock down VPN and credentials, keep offline backups |
| Oct 20 | Oracle E-Business Suite | Oracle patched CVE-2026-101767, an unauthenticated SQL injection flaw | Apply the Oracle patch |
| Oct 21 | PHP2Shell | Two critical PHP flaws, both rated CVSS 9.2 | Upgrade to a fixed PHP version |
| Oct 21 | LiteLLM | Release infrastructure for the open-source LLM gateway was compromised | Remove malicious builds, rotate secrets |
| Oct 21 | Storm-0940 and ARTEX | Microsoft said a China-aligned group used an AI pentest tool against 2,250+ Microsoft 365 tenants | Review sign-in logs, enforce MFA |
This isn’t a full census. Dozens of smaller disclosures landed the same month, and some of the incidents above began before October.
PHP2Shell: The Flaw Behind Most Black October Headlines
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution bugs in PHP. Each scores 9.2 on the CVSS scale. PHP runs an estimated 70% of websites, which is why this one got everyone’s attention. Researchers found the flaws with help from AI models, according to Fortune.
PHP shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 26, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog and gave federal civilian agencies until October 29 to patch. Three days is the shortest window CISA uses. The agency had said days earlier that it hadn’t seen exploitation yet.
That deadline only binds federal agencies. CISA still urged every other organization to patch.
It didn’t end with PHP. On October 28, CISA also added a Linux kernel flaw, CVE-2026-46300 (nicknamed Fragnesia), to KEV and warned that it can be chained with PHP2Shell to plant webshells and run commands as root. Delft University’s threat intelligence lab also reportedly tracked more than 50,000 exploitation requests from over 600 IP addresses across 70 countries.
Need the patch steps? Our PHP2Shell patch guide walks through them.
How AI Made the Black October Attacks Faster
Picture a login page getting hit 2,900 times a minute. No human team does that. ARTEX, an agentic penetration-testing tool developed in China, did exactly that.
CrowdStrike linked ARTEX to attacks on South Korean financial institutions in late September and early October, and its developer pulled the previously open-source tool private on October 8. It resurfaced days later. Microsoft reported that Storm-0940 used it after compromising ConnectWise’s Cloud Backup service, trying stolen credentials against more than 2,250 Microsoft 365 tenants. Most attempts failed. Some didn’t: the attackers reached privileged access at several organizations, in multiple cases under three hours after first targeting them.
Then there’s the Reuters report from October 19, which described a hacker using AI agents to do most of the work of probing 1,200 sites.
Columbia professor Junfeng Yang told Fortune the problem is an imbalance. AI makes old bugs cheaper to find and exploit, but a patch still needs human review, testing and coordination before it reaches every system. Attackers get the speedup first.
AI agents also misbehaved on their own. In a July UK AI Security Institute test, a Claude Mythos 5 agent tried to slip malicious code into an unrelated open-source project; AISI said no real-world harm resulted. And an OpenAI research agent moved crypto from a wallet it didn’t own to pay fees, though the tokens sat on a test network.
Not Everything in Black October Involved AI
Some of the worst incidents were plain mistakes.
The eMudhra failure is the best example. A researcher reported on October 17 that the private keys behind eight intermediate certificates were so weak they could be recovered almost instantly. One key was literally the number 4. Anyone holding those keys could have forged certificates for banks or government portals. Browser makers blocked the certificates, eMudhra revoked them and said it found no sign of misuse, and the company is now exiting the global SSL/TLS certificate business.
SafePay needed no AI either. The October 20 advisory (AA26-293A) says the group favors exposed credentials, brute force attacks and VPN access, and that it has hit at least 600 organizations across North America, Europe, Australia and other regions since August 2024. That’s from CISA, the FBI and partner agencies, not a vendor’s marketing deck.
And the supply chain incidents, from LiteLLM to UpdraftPlus, mostly came down to stolen or leaked keys. Old problem, new volume.
Was Black October the Worst Month for US Cybersecurity?
Nobody has proven that, and you should be skeptical of anyone who says they have. “Black October” is a label people gave a dense cluster of disclosures. No one has published a month-by-month count of US incidents that ranks October 2026 first.
What the evidence does support is narrower. A CYFIRMA analysis found at least six unrelated actor sets behind the incidents, plus a certificate authority failure with no attacker at all. About a third of the October disclosures with a known start date had begun earlier. CYFIRMA rates a coordinated attack as very unlikely, with high confidence, though it admits its sample leans heavily toward October and many root causes were never disclosed.
The US part is real, though. CISA’s KEV listing, the three-day federal deadline and the FBI-backed SafePay advisory all landed in one week, and ConnectWise-linked attacks targeted Microsoft 365 tenants. But most Black October incidents were global.
Security consultant Joseph Steinberg offered a useful counterweight. He told Fortune that for people who’ve worked in the field for decades, this fits an old pattern, and Black October may look unremarkable in hindsight. Our read: it wasn’t the worst month ever, but it was among the worst-timed, because defenders had almost no gap between disclosure and exploitation.
How to Protect Your Website and Business After Black October
You don’t need a security team to cover the basics. Work through these in order.
- Check your PHP version: If you run anything on PHP, including WordPress, upgrade to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later release in your branch.
- Treat the KEV catalog as a deadline: Check CISA’s KEV list against the software you run, even if you’re not a federal agency.
- Rotate secrets if you pulled affected builds: If your team installed LiteLLM or OVHcloud CLI releases during the compromise window, remove them and replace every credential they could reach.
- Audit WordPress backup tooling: If you use UpdraftPlus or UpdraftCentral, revoke old management keys and look for unknown admin accounts or plugins.
- Harden VPN and login credentials: Turn on MFA, kill reused or exposed passwords, and keep offline, immutable backups. Test a restore before you need one.
- Review Microsoft 365 sign-in logs: Bursts of failed logins from one source are the signature of tools like ARTEX.
Black October FAQ
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Each is rated CVSS 9.2. PHP released fixes on October 21, 2026, and CISA confirmed active exploitation on October 26.
Was Black October a coordinated cyberattack?
Very likely not. CYFIRMA’s analysis found at least six unrelated actor sets, plus a certificate authority failure with no attacker behind it. Researchers describe Black October as a wave of overlapping disclosures rather than a single campaign.
Did Black October affect US organizations?
Yes, though the incidents were global. CISA added PHP2Shell and a related Linux kernel flaw to its KEV catalog with federal deadlines, and CISA, the FBI and the Secret Service issued the SafePay ransomware advisory on October 20.
What should I do if my site runs on PHP?
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer version in your branch. Then check your web server logs for suspicious requests and make sure your hosting provider has applied the same fixes.
Will another Black October happen?
Probably. CYFIRMA argues disclosure waves like this will repeat, since AI tools are finding and exploiting vulnerabilities faster than defenders can patch them. The practical answer is shorter patch cycles and fewer long-lived keys.
For more on how AI is changing security and the web, browse our Artificial Intelligence coverage. We’ll update this page as new details land.
