These incidents have not only raised serious concerns, but many cybersecurity experts are calling, and observers are describing the period as “Black October”. A X post reveals that more than 25 such incidents of different severity and scale were reported. However, there are some of the prominent cases which has shaken the entire world.
Must read: AI uncovers critical PHP security flaws: Why website owners must patch servers immediately
Critical PHP vulnerabilities
On October 21, two critical vulnerabilities in PHP were reported, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to as “PHP2Shell”, which triggered urgent warnings around the world. For this reason, several government, educational, and hospital websites in several European countries were taken offline, according to Reuters, as a precaution while organisations assessed the vulnerabilities and applied fixes.
This is the most serious 48 hours in cybersecurity history. "Black October" they're calling it It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year* SUMMARY OF THE LAST 48 HOURS: YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year): 1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline. 2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4. 3. California: data on every public school student since 2023 stolen, including disability status 4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers 5. Zeabur: 321,810 accounts breached. The company is shutting down. 6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer 7. GitLab: a 10-out-of-10 severity hole in every version since 2014 8. Cairn: criminals used an AI hacking tool to break into 100+ companies 9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline 10. Onamae: malware planted on up to 26,739 customer servers in Japan MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents): 11. Signal: a bug could leave your mic and camera on after you hang up 12. NGINX: 3 critical holes in software running ~1/3 of websites 13. HTTP/3: a single connection can crash 7 of the 10 web server types tested 14. Plex: hackers breaking into home media servers 15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations 16. Palo Alto: ransomware gangs breaking in through company firewalls 17. Bullhorn: platform used by 10,000+ companies knocked offline 18. Medi-Cal: 970,000 patients' data stolen 19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites 20. AOMEI: backup software's update server handed out a backdoor 21. Meta Muse: Meta's AI agent exposed users' personal and business secrets 22. Tor: 333 relays hijacked to steal logins 23. TiDB Cloud: database company's cloud breached Also serious: 24. State Bank of India: India's biggest bank confirms a data breach 25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool 26. Siemens: a software hole being used to spread malware 27. North Korea: state hackers launch a new attack campaign on South Korea
— AI Notkilleveryoneism Memes ⏸️ (@AISafetyMemes) October 22, 2026
Experts suggest that the flaws could allow attackers to execute arbitrary code remotely on affected systems, raising concerns about data theft, server compromise, and service disruption. This highlights how vulnerabilities in widely used software can disrupt essential online services within hours, even before any confirmed attack is reported.
The incident caught the attention of the Prime Minister of Japan,the US government, major tech giants, and others in less than 24 hours.
eMudhra certificate incident
In a separate case, Indian digital trust company eMudhra exposed weaknesses in its digital certificates that verify websites. These certificates come with a private key, which is only accessible to the owners of the website. However, eight of these certificates consisted of weak cryptographic keys, leading to a major scare.
Must read: What is eMudhra certificates? What to know about the security scare and could your data be at risk?
Google and Mozilla blocked the affected website-certificate authorities. However, the incident raised questions about applications that rely on their own certificate trust stores rather than browser protections, including server-side software that may not receive the same updates.
Its potential consequences could include fraudulent website impersonation and interception of encrypted communications. However, no reports of data breaches or confirmed exploitation linked to the incident have emerged so far.
Apart from this, several other incidents were reported in the month of October. In one incident, a breach involving the California Department of Education's contractor Educational Testing Service exposed personal information of millions of students enrolled over three school years. On October 21, LiteLLM reported that its release pipeline had been compromised, resulting in a malicious version of its software being published to public package registries.
Developer-hosting platform Zeabur disclosed a breach in which over 321,810 account records and more than 3.2 million environment-variable records were affected.
This incident raises concerns over vulnerabilities in widely deployed software, weaknesses in credential storage, compromised software-release pipelines, and the difficulty of distributing security protections consistently across different systems.