Black October 2026: Verified Incident Tracker — What Is Real, What to Patch Today

Between 13 and 22 October 2026 the incidents arrived faster than most teams could read them: two pre-auth PHP RCEs, a CVSS 10 in GitLab, a poisoned LiteLLM release, environment variables read out of two hosting platforms, eight certificate-authority keys anyone could compute. Observers started calling it "Black October" (Business Today uses the name, as do several roundups), and a viral thread listing 27 incidents passed a million views. This page does one thing: it checks each incident against a primary source, says what is confirmed and what is not, and puts the fixes in the order that matters for an internet-facing estate.

Developing story — first published 13:55 CEST (11:55 UTC), 22 October 2026. Updated as vendors and CISA publish more. Status as of catalog version 2026.10.21 of CISA KEV.

Patch today: the five that come first

Ordered by exposure and exploitation: internet-facing and already exploited first.

1. PHP2Shell (CVE-2026-109618, CVE-2026-109619) — unauthenticated RCE in the PHP interpreter, exploited in the wild since 21 October. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12; the PHP advisory says updating is the only complete mitigation. Our analysis, with the stopgaps for 8.1 and older: PHP2Shell.
2. GitLab CVE-2026-110264 — CVSS 10 unauthenticated RCE on self-managed instances, every version from 7.0. Update to 19.5.1, 19.4.3 or 19.3.6 (or the backports listed in the GitLab release); the 12 October versions are still vulnerable. Our analysis.
3. LiteLLM 1.107.0 — if any host installed it from PyPI or pulled the Docker latest/main-* tags on 21 October, treat the host as compromised: rebuild on 1.106.2 and rotate every credential it could reach (LiteLLM incident report).
4. Cisco Expressway CVE-2026-76466 — CVSS 9.8 unauthenticated command execution as root in clustered deployments, no workaround. Update to X15.5.20 (Cisco advisory, our analysis).
5. Plex Media Server — four CVEs added to CISA KEV on 20 October, chained to unauthenticated RCE and used to drop cryptominers. Update to 1.43.3.10861 or later (Plex notice, our analysis). Plex runs in more offices and on more NAS boxes than its "home media" label suggests.

If you run any of the hosting platforms or tools in the secrets section below, that rotation belongs on today's list too.

Verified incident tracker

Status: ✅ confirmed by a primary source · ⚠️ partly confirmed (the unconfirmed part is stated) · ❌ no source supports it.

Incident	What happened	Status	Fix or action	Source	Our analysis
PHP2Shell, CVE-2026-109618 and -109619	Two pre-auth RCEs in PHP core, CVSS v4.0 9.2; exploited from 21 Oct; public exploit tool	✅	PHP 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12	PHP GHSA	Read
GitLab CVE-2026-110264	Unauth RCE via a crafted Org-mode file, CVSS 10, all versions from 7.0	✅	19.5.1 · 19.4.3 · 19.3.6 + backports	GitLab release	Read
LiteLLM 1.107.0	Release pipeline hijacked; PyPI wheels live 11:39–13:23 UTC, Docker tags until 14:20 UTC, carrying a credential stealer and RAT loader	✅	Rebuild on 1.106.2; rotate everything the host reached	LiteLLM	—
Railway	Unauthorized access to systems storing customer environment variables, some decrypted; deployments paused	✅	Rotate all env vars and registry credentials now	Railway disclosure	—
Zeabur	3,218,965 env-var records of 321,810 accounts read on 14-15 Oct; shutdown on 31 Dec 2026	✅	Replace every secret, rebuild GCP dedicated servers	Zeabur report	—
OpenCode Console	Legacy system breached; provider API keys of 1.4% of Console users exposed and abused	✅	Affected users: revoke keys at each AI provider	TechCrunch	—
eMudhra CA keys	8 intermediate CA keys with values below 256 (one was 4); revoked, root distrusted	✅	Update browsers, Go, Node.js CA bundles	eMudhra, BleepingComputer	—
ConnectWise Cloud Backup (SkyKick)	App credential abused to sign in to Microsoft 365 tenants from 15 Oct; service shut down	✅	MSPs: disable the apps, audit Entra sign-ins and app credentials since 13 Oct	BleepingComputer	—
Rank Math PRO 3.0.123	Trojanized plugin served 15 Oct 20:02 to 16 Oct 07:12 UTC	✅	Clean up in the vendor's order, then 3.0.124	Rank Math	—
Node.js October release	10 CVEs incl. Brotli decoder out-of-bounds write (RCE) and TLS hostname bypasses	✅	22.23.4 · 24.22.1 · 26.12.1	Node.js	—
Cisco Expressway CVE-2026-76466	Unauth command execution as root, CVSS 9.8	✅	X15.5.20	Cisco	Read
Plex Media Server	4 CVEs in KEV on 20 Oct, chained to RCE, exploited	✅	1.43.3.10861+	Plex	Read
SiteGuard Server Edition CVE-2026-106931	OS command injection with root or SYSTEM privileges, exploited; KEV 20 Oct, due 23 Oct, forensic triage	✅	Vendor mitigation, then CISA forensic triage	CISA KEV	—
Siemens Software Center CVE-2026-110936	DLL search-path flaw (local code execution), exploited; KEV 20 Oct, due 3 Nov	✅	Vendor update	CISA KEV	—
Earlier KEV additions in the window	Ivanti Connect Secure (13 Oct), PAN-OS CVE-2026-0322 (14 Oct), BeyondTrust Remote Support (16 Oct), all with forensic triage	✅	Patch and hunt; due dates already passed	CISA KEV	Ivanti · PAN-OS · BeyondTrust
California student data (ETS)	Compromised login used to copy files from an ETS SFTP site, 22 May to 18 Sep; students of the last three school years	✅	Families: identity protection offered; no SSNs involved	Malwarebytes	—
Ahold Delhaize	Cyber incident; systems taken offline in the US, Netherlands and Belgium from 11-12 Oct	✅	Nature of the attack not disclosed	The Record	—
Cairn	One operator used an open-source AI agent platform against 100+ companies	✅	See our analysis	—	Read
TiDB Cloud	Reported theft of source code and encrypted API-key values via service-account credentials	⚠️	No PingCAP statement found; attacker volume claims unverified	daily.dev roundup	—
AI agents against 400+ Latin American banks	One report of a group using AI agents at that scale	⚠️	Single source; no bank or regulator confirmation found	daily.dev roundup	—
"AI agent swarms hacking half the internet"	Claim circulating with the viral lists	❌	No source; Cairn is the documented case	—	—

Also reported in the viral lists and not verified by us yet: Signal, NGINX, HTTP/3 servers, SafePay ransomware, Bullhorn, Medi-Cal, AOMEI, Meta Muse, Tor relays, State Bank of India, OVHcloud, Onamae, a North Korean campaign. They will move into the table, or out of it, as primary sources appear.

Rotate these secrets

Five of the incidents are the same problem: secrets kept by a platform or tool you trusted were read by someone else. Patching does nothing for a key that already left. Do the rotation in this order, because each step stops the next one from being reused:

• Revoke at the issuer first, then replace. For AI provider keys (OpenAI, Anthropic, Google), cloud keys and registry tokens, create the new key, deploy it, then revoke the old one at the provider. Changing the value in a platform's dashboard does not revoke anything.
• LiteLLM 1.107.0 hosts: follow the vendor's order. Do not run pip first (any Python start re-runs the malicious .pth), remove cook.pth, cook.py and sitecustomize.py, kill the process holding /tmp/remote_code_loader.lock, rebuild on 1.106.2, then rotate the instance role, every provider key in the proxy database, master and virtual keys and the DATABASE_URL password (LiteLLM). If the host had outbound internet, assume the exfiltration succeeded.
• Railway projects: rotate every environment variable and private registry credential without waiting for an email, and review the logs of the services those keys open (Railway).
• Zeabur projects: replace every secret, including those you replaced after the August incident; change passwords inside databases (changing the env var does not), treat backups in tpe1 and hkg1 as leaked, and rebuild GCP dedicated servers (Zeabur). Plan the migration: the service ends on 31 December.
• OpenCode Console users who got the notice: revoke the provider keys stored in workspaces and check provider billing.
• MSPs with ConnectWise Cloud Backup / SkyKick: disable the implicated applications, review Entra service-principal sign-ins and any credentials added to applications since 13 October; disabling an app stops new tokens, not the ones already issued.
• WordPress sites that activated Rank Math PRO 3.0.123: restore a backup from before 15 October 20:02 UTC, or clean up in the vendor's order, then rotate WordPress, database, salts, SMTP, API and hosting credentials (Rank Math).

Then look for use: AWS CloudTrail GetCallerIdentity calls from unexpected IPs, new IAM users or access keys, provider bills, GitHub audit logs for apps and tokens you did not create.

What the viral lists got wrong (and what they got right)

The thread that spread the "Black October" name mixed confirmed incidents with claims nobody has sourced. Some of the lines that sounded like exaggeration hold up:

• "Every GitLab version since 2014" is close to right: GitLab's advisory says all versions from 7.0, a 2014 release.
• "Zeabur shutting down" is right: Zeabur's own report says the service shuts down on 31 December 2026.
• "One eMudhra key was the number 4" is right: BleepingComputer verified a published key with value 4, and all eight keys were below 256. What is not established is misuse: eMudhra and the browser programs report no evidence the keys were recovered or used before disclosure, and seven of the eight intermediates never issued a certificate.

Others need correcting:

• "PHP2Shell hits ~70% of websites." PHP's share of server-side sites says nothing about exposure. What matters is the PHP version, the SAPI (mod_php carries the highest risk) and whether the vulnerable paths are reachable; see our analysis.
• ConnectWise "2,250+ tenants." The figures from investigators are smaller and partial: Huntress counted at least 162 compromised tenants in its own environment; nobody has published a total.
• "AI agent swarms hacking half the internet." No source. The documented AI-offensive case of the month is Cairn, one operator and an open-source agent platform against 100+ companies. That is serious enough without inflating it.

The useful question in a week like this is not "is this the worst week ever?" It is "which of these touches something we run, and can someone reach it?"

How to prioritize when everything is critical

CISA's own deadlines show the problem. Under BOD 26-04, 111 of the 137 vulnerabilities CISA added to KEV between 10 June and 21 October 2026 got a three-day deadline. When almost everything is a three-day fire, the order has to come from your own estate:

1. Inventory match. Which of these products and versions do you actually run? The vendor hubs list every KEV entry per vendor (GitLab, Cisco, Ivanti) and the CISA KEV tracker shows the federal due dates.
2. Reachability. Internet-facing first: PHP front ends, GitLab, Expressway, Plex. An internal-only instance can wait hours, not weeks.
3. Exploitability in your configuration. PHP2Shell depends on the SAPI and the upload-progress setting; GitLab CVE-2026-110264 needs one public project. A scanner that only reads version strings cannot tell you that; a test that tries the path can, which is the difference between automated penetration testing and a version check.
4. Assume-breach where the vendor says so. Forensic triage entries in KEV (SiteGuard, BeyondTrust, Ivanti, PAN-OS) and every secrets incident above need a hunt, not just a fix.

Where Zero Hunt fits

The bottleneck in a week like this is step 3: proving, per asset, which of twenty advisories is actually exploitable in your network before the next one lands. Zero Hunt is an autonomous AI red team on an on-premise appliance running private AI: its agents write and run a per-target check of the exploit path, black-box or gray-box, and every step that touches production waits for a human approval at the autonomy level you set. The AI Remediation Advisor then ranks the fixes by real exploitability (CISA KEV first, then what the campaign proved), gives the exact patch or compensating control and re-verifies it with the same proof. This week also made the on-premise argument plainly: the secrets that leaked sat in hosted platforms and AI gateways, and an appliance that keeps findings and credentials on hardware you own removes one more place they can be read from. Every record it writes is signed at write time (Ed25519, hash-chained), which is the evidence your auditor asks for after a month like this.