From Staff
"Black October" is a label for a run of unrelated but overlapping cyber incidents disclosed around October 21, 2026, not a single attack. The most urgent item is PHP2Shell, two critical PHP flaws (CVSS 9.2 each) that allow unauthenticated remote code execution in affected configurations.
- Active exploitation: Cloudflare reported early PHP2Shell attack attempts. Palo Alto GlobalProtect (CVE-2026-0257) and Plex servers (Plex2Shell) are also under active attack.
- Poisoned software: LiteLLM 1.107.0, the OVHcloud CLI (0.11.0 through 0.15.0) and the UpdraftCentral keys at TeamUpdraft were compromised to deliver credential theft or malicious code.
- Trust infrastructure: Eight eMudhra intermediate signing keys were recoverable from public certificates, creating a risk of forged certificates.
- Patching is not enough: Where credentials or backdoors were already planted, installing the update leaves the attacker's access in place. Rotate secrets and rebuild from clean systems.
Web platform vulnerabilities
Four web stacks need patches now, and PHP comes first because exploitation attempts are already under way.
Product | Flaw | Impact | Fixed versions |
|---|---|---|---|
PHP (PHP2Shell) | CVE-2026-109618, CVE-2026-109619 (CVSS 9.2 each) | Unauthenticated remote code execution; one flaw corrupts memory when an operation runs out of memory, the other exposes invalid data left by earlier requests | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Node.js | Ten vulnerabilities, four high severity, including CVE-2026-111497 (Brotli decompression) | Code execution via an out-of-bounds memory write; weaker TLS hostname checks; DNS name mishandling | 26.12.1, 24.22.1, 22.23.4 |
Next.js | Two critical RCE flaws fixed October 14 (React Server Components caching, SVG image processing on glibc Linux) | Remote code execution | 16.4.1, 15.5.28 |
Apache Tomcat | Eight fixes, including CVE-2026-101296 (JNDIRealm) | Login without the correct password; mixed responses between users; AJP data leaks | 11.0.27, 10.1.61, 9.0.123 |
- PHP: Researchers demonstrated code execution against Apache mod_php before application code ran. After patching, restart services and confirm the web workers use the patched build.
- Node.js: The releases also refresh certificate trust after the eMudhra incident. Rebuild container images so deployments pick up the new runtime.
- Next.js: Updating Node.js does not update application dependencies, so Next.js must be upgraded separately.
- Tomcat: Apache disclosed the flaws on October 20. Exposure depends on configuration.
Supply chain compromises
Three trusted distribution channels delivered malicious code, so a normal update or download was not a safe signal.
Target | What happened | Window | Action |
|---|---|---|---|
LiteLLM | Version 1.107.0 reached PyPI and container registries carrying a credential stealer and remote code loader. All seven Python wheels and the latest and main-stable container tags were affected. Stolen GitHub credentials let attackers redirect a release workflow to a lookalike repository. | Reported October 21 | Pin to 1.106.2, rebuild cleanly, rotate credentials |
UpdraftPlus (TeamUpdraft) | Attackers accessed the TeamUpdraft website and used UpdraftCentral connection keys to install malicious plugins on connected WordPress sites. The UpdraftPlus download packages were unchanged. | October 17–18 | Install 1.26.13 Free or 2.26.13 Premium, remove exposed keys, check for backdoors and unexpected admins |
OVHcloud CLI | A compromised developer account was used to replace binaries for versions 0.11.0 through 0.15.0. Earlier clean downloads were unaffected. | 94 minutes on October 19 | Upgrade to 0.16.0, replace secrets stored on affected machines |
- LiteLLM is the most dangerous for cloud and AI environments. Malicious Python startup hooks could run when any Python command started, even if the application never imported LiteLLM. Targets included cloud credentials, SSH keys and AI service secrets. Wiz observed stolen AWS credentials in use about four and a half hours after theft.
- Do not simply downgrade. Running pip inside a contaminated environment can trigger the hooks again.
- Updating does not remove malware already installed on WordPress sites reached through UpdraftCentral.
Trust and access infrastructure
The eMudhra key compromise is the one with the widest potential reach, but public evidence has not shown attacks on users through those keys.
- eMudhra certificate authority: Eight intermediate signing keys were compromised. Incorrect key generation made them recoverable from public certificates, creating a risk of forged certificates. Mozilla found all eight affected P-384 private keys were integers below 256, so recovery was almost instant. Browser vendors issued blocks, but applications with separate certificate bundles or that skip revocation checks may remain exposed. Update browsers, operating systems, runtimes and trust stores.
- Palo Alto GlobalProtect (CVE-2026-0257): Attackers can bypass authentication, including MFA, in affected configurations. Exploitation requires authentication override cookies and a vulnerable certificate setup. Unit 42 described attackers moving on to VMware vCenter, weakening ESXi controls and extracting credentials from a domain controller's virtual disk, which avoided its endpoint monitoring. Patch gateways and investigate suspicious successful VPN sessions.
- Plex2Shell: Four flaws chain together to run code without authentication: internal request abuse, an exposed owner token, a file write and a malicious codec load. Attackers have deployed cryptocurrency miners and proxy software. Fixes are in Plex 1.43.3.10861 and later. Check NAS installations and containers, and rebuild any system where compromise is found or cannot be ruled out.
Data exposure and operational impact
The State Bank of India disclosure is smaller than the headline number suggests: 3,897 customer records were identified within roughly 375,000 reviewed dark-web records, and the larger figure is not a confirmed count of affected customers.
- State Bank of India: Reported fields include names, mobile numbers, addresses and loan-related details. The bank said services remained operational while it examined the data's authenticity and source. The disclosure did not establish a breach of core banking systems or theft of customer funds.
- French supermarkets: Hackers gained control of refrigeration software at hundreds of stores. Coopérative U said more than 100 of its supermarkets were targeted, and 180 Intermarché and Netto stores were affected, with some units reaching 50°C overnight and spoiling food worth millions of euros.
- Other reports from roundups: Aggregator and social media summaries also mention theft of California public school student data since 2023, a Zeabur breach of 321,810 accounts, and an outage at Ahold Delhaize. I did not verify these against primary sources.
Response priorities
Work in this order: exposed systems under active attack first, then vulnerable runtimes and dependencies, then clean-up of anything an attacker may already have reached.
- Patch internet-facing PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart services and confirm workers run the patched build
- Patch Palo Alto GlobalProtect gateways and review successful VPN sessions for misuse
- Update Plex to 1.43.3.10861 or later, check NAS installs and containers, and rebuild any suspect system
- Check whether LiteLLM 1.107.0 was ever installed or pulled; if so, rebuild clean and rotate cloud credentials, SSH keys and AI service secrets
- Check OVHcloud CLI use between versions 0.11.0 and 0.15.0 and move to 0.16.0, replacing stored secrets
- Check WordPress sites using UpdraftCentral: install 1.26.13 or 2.26.13, remove exposed keys, look for backdoors and unexpected administrators
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 and rebuild container images
- Upgrade Next.js to 16.4.1 or 15.5.28 and Tomcat to 11.0.27, 10.1.61 or 9.0.123
- Update browsers, operating systems, runtimes and trust stores for the eMudhra block
- Review cloud activity, VPN sessions and administrator changes for signs of misuse
- Revoke and reissue secrets from clean systems, not from the ones that may be compromised
Caveats and sources
The technical detail comes from one detailed incident roundup, so treat it as a single source until vendor advisories confirm each item.
- "Black October" is an informal label coined by commentators; it is not an official designation, and describing it as the most serious 48 hours in cybersecurity history is an opinion.
- Most roundup claims are unverified here. The Zeabur, Ahold Delhaize and California items come from aggregator posts and are not confirmed against primary sources.
- An unverified claim on social media says a group called CyberCartel used Claude and Grok to automate attacks on 400+ Latin American banks. I found nothing beyond that post.
- Exposure varies by configuration, especially for PHP2Shell, Tomcat and GlobalProtect. Confirm against each vendor's advisory.
Sources:
No comments:
Post a Comment