Vulnerabilities and security incidents during Black October 2026

On 21 October 2026, PHP released fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), GitLab patched a critical unauthenticated code execution flaw (CVE-2026-110264), and Node.js addressed a Brotli vulnerability (CVE-2026-111497). These advisories coincided with other incidents disclosed during the period referred to as cybersecurity’s Black October.

Mozilla blocked eight eMudhra intermediate certificates following the compromise of their private keys. GoDaddy revoked certificates affected by discrepancies in its certificate issuance documentation. LiteLLM removed version 1.107.0, which contained malicious code. Railway and PingCAP confirmed unauthorized access to systems holding customer information. In PingCAP’s case, the access had begun in September.

Patches for PHP, GitLab and Node.js are available, and LiteLLM removed the compromised artifacts. Microsoft confirmed active exploitation of PHP2Shell and Brotli, while PingCAP was still assessing the impact on individual customers. AI was used in the PHP2Shell investigation.