Black October 2026: Every Major Cyberattack So Far This Cybersecurity Awareness Month

Image courtesy of Help Net Security.

When Awareness Month Turned Black

Every October, the security industry runs the same ritual: webinars on phishing, posters about strong passwords, LinkedIn posts reminding everyone that "cybersecurity is everyone's responsibility." This October, the industry stopped reciting the ritual and started living through it.

Security practitioners on X started calling it "Black October" after a post on 22 October described the previous 48 hours as the worst in cybersecurity history (SecurityToday). The post wasn't hyperbole. The headline event — PHP2Shell, a pair of critical remote-code-execution flaws in a language that runs close to 70% of the web (CNBC) — landed in the same stretch as a compromised certificate authority, a hijacked AI gateway's release pipeline, and a bank disclosing customer records already sitting on the dark web.

Two things tie this month together, and I think they matter more than any single incident on the list below:

AI is now finding bugs faster than defenders can patch them. Researchers at Wiz and Calif found the PHP flaws using frontier models from OpenAI and Google (CNBC). PostgreSQL 19 was delayed for the same reason — AI-assisted code review surfaced more bugs than the maintainers could fix in time. That's a genuinely new failure mode: the tools meant to help us are now outpacing our ability to respond to what they find.

Most of what "broke" this month didn't actually break this month. Several of the attacks disclosed in October began weeks or months earlier. What spiked wasn't the attacks — it was the disclosures (SecurityToday). That distinction matters if you're trying to learn the right lesson from all this: the problem isn't just "attacks are accelerating," it's "we're finding out about them too late."

What follows is a roundup of everything disclosed between 1 and 25 October 2026, what each incident actually means for you, and a dedicated section on what hit India specifically.

Black October at a Glance

A quick-reference table of the incidents covered below, newest first. Dates are when each incident was disclosed or confirmed — not necessarily when the attack began.

The Headline Incidents

PHP2Shell: the flaw at the heart of the internet

On 21 October, the PHP team shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619 — together nicknamed PHP2Shell. Both score 9.2 on CVSS v4.0, which in plain terms means: an attacker doesn't need a password, a login, or any access to your systems at all. They just need your server to be reachable, and they can run their own code on it.

The disclosure didn't go to plan. Details leaked on 20 October, two days ahead of the coordinated release date, forcing the PHP team to scramble out an advance notice that same evening (SOCRadar). Exploitation followed within hours, not days — Cloudflare recorded hundreds of thousands of exploit attempts within two hours of the news spreading (MindStudio). The UK's NCSC told organizations to take unpatched systems offline if they couldn't patch immediately, and sites from Berlin to Rotterdam went dark as a precaution rather than risk it (SecurityToday).

If you run PHP anywhere — and if you've ever deployed WordPress, Laravel, or a dozen other frameworks, you do — the fix is: upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Today, not this sprint.

(DKCISSP covered the technical breakdown of PHP2Shell as it broke — see our earlier PHP2Shell coverage.)

eMudhra: when a certificate authority's private key was the number 4

This is the one that should unsettle you more than PHP2Shell, honestly. On 17 October, a researcher discovered that the private keys behind eight intermediate CA certificates issued by Bengaluru-based eMudhra were weak enough to recover almost instantly. One of them — the key securing the "EM OV TLS CA – G3C" certificate — turned out to have a value of literally 4 (BleepingComputer).

Think about what that means. A certificate authority's entire job is to be the thing browsers trust so that when you see the padlock icon, you believe the site is who it says it is. With a key like that, anyone could forge a trusted HTTPS certificate for any website they wanted, or sign malicious software so it looks legitimate.

The keys were generated during a key ceremony on 30 April 2025 and sat undetected for roughly 18 months — through two separate audit cycles (The South First). Chrome, Mozilla, Apple, and Microsoft moved to block the certificates between 17 and 20 October, with Chrome's removal of the emSign ECC Root CA – G3 reaching all devices by 27 October (SOCRadar). As of 21 October, no confirmed malicious use had surfaced — which is the one piece of good news in this story, and possibly just a matter of time.

(DKCISSP has separate coverage of the eMudhra CA incident with more technical detail.)

Image courtesy of The Hacker News.

LiteLLM, OVHcloud, AOMEI: when the supply chain itself is the attack

On 21 October, the release pipeline for LiteLLM — a popular open-source gateway developers use to call multiple AI model providers through one interface — was compromised. Every copy of version 1.107.0 published to PyPI carried a credential stealer (SecurityToday). If your AI project pulled that version, assume your credentials are gone.

It wasn't alone. The OVHcloud CLI was hit the same way two days earlier: a hijacked developer GitHub account was used to publish a backdoored release build. AOMEI Backupper's update servers were briefly tampered with — just minutes at a time — to drop a backdoor onto anyone who happened to update during that window.

(See DKCISSP's LiteLLM supply-chain coverage.)

Image courtesy of The Hacker News.

The pattern across all three: attackers aren't breaking into your systems anymore. They're breaking into the systems that build and ship the software you already trust, then waiting for you to update normally.

Railway and Zeabur: when your hosting platform leaks your secrets

On 21 October, hosting platform Railway disclosed that an unauthorized party may have accessed encrypted environment variables — and decrypted some of them. Environment variables are where developers routinely store API keys, database passwords, and other secrets, so this is about as bad as a platform breach gets. Railway paused all deployments and told every customer to rotate every variable, API key, and registry credential.

Rival platform Zeabur had it worse: this was its second breach in two months, exposing 321,810 accounts and roughly 3.2 million environment-variable records. The company is shutting down. One detail stands out — Zeabur's admin tokens apparently never expired. If yours don't either, that's worth fixing this week, independent of anything else in this article.

UpdraftCentral: 400,000 WordPress sites exposed

Over the weekend of 17–18 October, an attacker used stolen TeamUpdraft connection keys to create admin accounts and install malicious plugins on customer WordPress sites. An estimated 400,000 sites using UpdraftCentral or Migrator keys were exposed. Versions 1.26.13 and 2.26.13 revoke the compromised keys — if you run WordPress with this plugin, update now and audit your admin user list for anything unfamiliar.

Image courtesy of BleepingComputer.

Data Breaches: Millions of Records, One Pattern

Look across every breach disclosed this month and you'll find the same shape: a single stolen login or a single compromised key opened the door to a platform serving millions of people.

• California public-school students (ETS): A testing contractor for the California Department of Education lost data on every child who attended a public school in the state over the last three years — including disability status. Attackers copied the data between 22 May and 18 September through one compromised SFTP login. Families only started hearing about it on 16 October.
• Capcom: The Japanese game publisher reported a major breach of its ID service, linked to more than 11.7 million accounts.
• Nikkei: Attackers used previously stolen credentials on 7 October to reach a cloud development service, exposing about 1.83 million records — Nikkei's third breach in a month.
• Quest Diagnostics: On 21 October, the US lab giant disclosed unauthorized access to Quanum LSM, the system clients use to order tests.
• GMO Onamae.com Desktop Cloud: Unauthorized programs were installed on customer servers; up to 26,739 servers may be affected. GMO is shutting the service down in stages.
• PingCAP (TiDB): Stolen service-account credentials gave an attacker access to internal systems — including source code — between 9 September and 7 October.
• Paradigm Healthcare (US): Over 970,000 Medi-Cal members affected by an intrusion that actually happened back in October 2025. Worth sitting with that for a second: over a year passed between the breach and the disclosure.
• Also reported this month: Asos (customer names, addresses and dates of birth, 6 Oct), Live Nation (a limited breach, 1 Oct), and a Japanese restaurant chain whose app exposed roughly 11.18 million member records.

Ransomware and Nation-State Activity

Ransomware gangs claimed 672 victims on their leak sites in just the first 19 days of October, against 891 for the entire month of September. These numbers come from the gangs' own claims, not independent verification, but directionally the pace is unmistakable.

• IDC Frontier (Japan): A ransomware attack on a cloud region knocked virtual servers offline, affecting 495 companies and local governments — including East Japan Railway (JR East).
• Ahold Delhaize: After an incident reported on 12 October, the grocery group took most of its brands' websites and apps offline across Europe and the US. Physical stores stayed open.
• Bullhorn: The staffing-software provider, serving over 10,000 customers, took its recruiting platform offline to contain an attack.
• Schools, cities, hospitals: The University of Illinois Chicago's College of Medicine, the City of Vicksburg (Mississippi), and New York's Oneonta City School District — which closed schools entirely after an attack on 23 October.
• SafePay advisory: On 20 October, the FBI, CISA, and international partners jointly warned that SafePay ransomware has hit roughly 600 organizations, getting in through stolen passwords, phishing, and VPN flaws.
• Palo Alto GlobalProtect: Qilin and Inc ransomware groups are still exploiting CVE-2026-0257 — a VPN flaw that was patched back in May. Five months later, it's still working for them.

On the state-sponsored side: Kaspersky linked a cyber-espionage campaign against South Korean construction, software, and telecom-equipment firms — dubbed Operation FlashHole — to the Lazarus group. Separately, a Chinese-speaking threat cluster used Cairn, an open-source platform built to coordinate AI agents, to automate intrusions against more than 100 companies. And from 2 October, 333 compromised Tor exit relays — about 10% of all exits on the network — redirected SSH connections to steal passwords, before being shut down by 5 October.

The India Angle

India wasn't a bystander in Black October. Two of the month's most-discussed incidents involve Indian institutions directly, and both deserve more than a passing mention.

State Bank of India: 3,897 customer records on the dark web

On 21 October, SBI told the BSE and NSE that 3,897 customer records containing personal information had been found on the dark web. The bank learned of this on 16 October — through alerts from its threat-intelligence provider, the Defence Cyber Agency, and CERT-In — meaning the data had already been published before SBI even knew.

The attacker's own claim was larger than SBI's confirmed figure: a post on BreachForums claimed 3.75 lakh customer records and 2,722 PDF documents. SBI's preliminary review covered roughly 375,000 records, but — and this is an important distinction — that doesn't mean 375,000 customers were actually exposed. Reports describe the leaked data as including names, phone numbers, ID details, and loan records. SBI maintains that core operations are unaffected and has engaged a CERT-In empanelled agency to trace the source.

One detail worth flagging for anyone following India's data-protection landscape: the Internet Freedom Foundation pointed out that SBI informed the stock exchanges but not the affected customers directly, and has urged MeitY to bring the breach-notification duties of the DPDP Act, 2023 into force immediately. If you bank with SBI, this is worth watching — not because your specific data is necessarily in the leaked set, but because how this plays out will likely shape how every Indian bank handles breach disclosure going forward.

eMudhra: India's chain of digital trust, tested

The eMudhra certificate failure described above is fundamentally an Indian story with global consequences. MeitY has said the impact was very limited and that Indian DSC and eSign services were not affected. eMudhra itself says its root CA private keys and other intermediates were not touched. Still — a certificate authority headquartered in Bengaluru being actively distrusted by Chrome is a hard lesson for India's public-key infrastructure ecosystem, audit processes included.

What Indian organizations should take from this

• CERT-In's 2022 directions still require reporting cyber incidents within six hours — not six days.
• If your organization runs PHP websites, WordPress with UpdraftPlus, or LiteLLM anywhere in an AI pipeline, you're exposed to the exact same incidents covered above. "Global" doesn't mean "elsewhere."

What Black October Teaches Us — and What to Do Now

The gap between a vulnerability being disclosed and someone exploiting it has essentially collapsed. Rapid7 measured an average of three days in Q3 2026; with PHP2Shell, it was a matter of hours. The UK's NCSC has been warning since May that AI would drive a "patch wave" of this kind. October is what that warning looks like in practice.

If you're responsible for an organization's security, here's where I'd start:

1. Patch PHP now. Find every PHP installation — including the ones hiding inside appliances and containers you forgot about — and upgrade to the fixed versions. If you genuinely can't patch immediately, take internet-facing systems offline or put them behind a WAF. Don't wait for the next change window.
2. Rotate your secrets, and put expiry dates on them. If you used Railway, Zeabur, LiteLLM 1.107.0, or the affected OVHcloud CLI builds, assume your keys are already in someone else's hands. Zeabur's admin tokens never expired — don't let that be true of yours either.
3. Audit your WordPress sites. Update UpdraftPlus/UpdraftCentral, revoke old keys, and actually look through your admin account list for anything you don't recognize.
4. Update your trust stores. Confirm browsers, OS images, language runtimes, and CA bundles across your environment have picked up the eMudhra blocks.
5. Lock down your release pipeline. Immutable releases, MFA enforced on every developer account, dependencies pinned rather than floating. This is the single control that would have blunted LiteLLM, OVHcloud, and AOMEI all at once.
6. Honestly measure your patch time against real exploit time. If your patch cycle is still measured in weeks, this month is the evidence that it's too slow for the threats you're actually facing.

If you're an individual reading this, here's what actually matters for you:

1. SBI customers: Be skeptical of any call, SMS, or email that quotes your loan or account details back to you — leaked data makes scams far more convincing than a generic phishing attempt. SBI will never ask for your OTP, PIN, or password, full stop.
2. Stop reusing passwords, and turn on two-factor authentication — yes, even for the accounts that feel low-stakes, like gaming or shopping logins. Those are exactly the ones attackers go after first.
3. Update your browser and devices so the eMudhra certificate blocks and the latest security fixes actually reach you.
4. Report fraud fast. In India, that's 1930 or cybercrime.gov.in. Don't sit on it.

A Final Word

Black October isn't really one attack — it's a pattern repeating itself across a dozen different companies and platforms: AI accelerating bug discovery faster than defenders can respond, stolen credentials opening doors that should have been locked, poisoned software updates, and trusted platforms holding thousands of customers' secrets in places that turned out not to be as secure as everyone assumed.

Awareness Month was supposed to remind us to be careful. This October reminded us why that matters — speed of patching, discipline around secrets, and real supply-chain controls are no longer optional extras. They're the difference between being a footnote in next year's "Black October" roundup or not.

The month isn't over, and neither is the fallout. I'll keep updating this piece as new incidents are confirmed.

— Deepak Kumar, CISSP