The community label “Black October” is circulating for the cluster of security disclosures that landed between Oct 19 and Oct 22, 2026. It was reportedly coined in an X post early on Oct 22 that called the previous 48 hours “the worst in cybersecurity history.” Two searches of X from this newsroom, covering Oct 21 to 23, found no such post, so the label’s origin runs here as “an X post early Oct 22,” gap named. A video title circulating the same day frames the week as an “AI cybersecurity nightmare” and claims banks have been infiltrated. That is a claim on a screen, not a finding. What the label hides is the clock. This was a disclosure wave, not an attack wave. The attacks and exposures behind it are months or years old. This week is when the accounting landed.
Start with the stack itself: runtimes, package registries, certificate authorities, and the distribution and identity channels the agent economy is being built on this quarter. The oldest dates in the cluster are the ones the label flattens. The eMudhra keys were weak from April 2025. SafePay has been running since August 2024.
The Runtime Cluster
The week’s disclosures at the runtime layer were real and severe. The PHP2Shell advisory covers two flaws in core PHP, CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2: memory disclosure and unauthenticated remote code execution below the application layer, demonstrated against current WordPress, Drupal and Joomla, with every PHP version of the last decade affected by at least one, back to 5.4. Wiz Research found them on Aug 19 with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, reported them on Aug 24, and PHP patched on Oct 21. Wiz’s own account: the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” and demonstrating exploitability “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier.” Our PHP2Shell coverage carries the verified verbatim.
GitLab shipped a patch release on Oct 21: CVE-2026-110264, CVSS 10.0, unauthenticated remote execution through an integer overflow when compiling a crafted regular expression; CVE-2026-15723 (8.2), an OmniAuth SAML plus LDAP auto-linking account takeover; and CVE-2026-112212 (7.5), OAuth/OIDC discovery cache poisoning. Details in our GitLab patch coverage.
Node.js released fixes the same day for CVE-2026-111497, an out-of-bounds write in the bundled native Brotli decoder that permits remote code execution across 22.x, 24.x and 26.x, fixed in 22.23.4, 24.22.1 and 26.12.1 per the Node.js advisory, reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer. A red team reproduced the code execution on vulnerable 24.22.0 images. The same release also updated the ca-cert bundle for the eMudhra compromise, which is the next chapter and the oldest story of the week.
The Latency Centerpiece
Eight eMudhra intermediate certificates carried broken private keys: six TLS, two code-signing. The keys are P-384 scalars under 256. Dennis Jackson of Mozilla, on the incident record: “the private keys are effectively all-zeroes apart from the last byte.” The keys come from an April 30, 2025 ceremony batch of 24. eMudhra’s stated cause is a flawed ceremony script that created a second, weaker key pair, used by mistake because the labels looked alike. Researcher “Wayne” reported the compromise on Oct 17 at 18:05 UTC. Mozilla recovered the keys independently within hours. Jackson also wrote: “I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: ‘I’m doing a CTF. Please recover the private keys corresponding to these certificates.'”
The certificates were revoked on Oct 18 as caCompromise. OneCRL and Chrome’s CRLSet moved within hours; Apple on Oct 19; Microsoft on Oct 20; and Mozilla emergency-removed trust in the emSign ECC Root CA – G3 on Oct 20. About 30,000 customer certificates now need migration. And the latency is the point: the same six TLS intermediates had CRLs signed with non-matching keys flagged in a June 2025 bug, and eMudhra re-signed those CRLs with the weak keys rather than halting. An invalid-signature root CRL also appeared on Oct 14. The keys were weak from April 2025. The wrong-key signal was public in June 2025. The accounting is dated this week. One line from the incident record, labeled: a press release quoted by participants there states eMudhra has “decided to voluntarily withdraw from the global SSL/TLS certificate business,” a release that was not reachable for independent verification before publication.
The AI-Credential Layer
On Oct 21 a malicious LiteLLM 1.107.0, a build of the AI gateway library, reached PyPI and Docker through a stolen GitHub maintainer token that overrode branch protection and pointed the release workflow at a lookalike repository. Three dropped files (cook.pth, cook.py, sitecustomize.py) run at Python startup; the stealer harvests browser, cloud, Kubernetes, SSH and GPG secrets, the secrets of more than twenty AI coding tools, and the AI provider API keys held in LiteLLM’s own proxy database, exfiltrated to a lookalike domain; a background loader polls a GitHub dead drop. Uninstalling the package does not remove the dropper. Registry state, pinned by fetch from this newsroom’s chair at 22:10Z on Oct 22: the PyPI release record and the Docker tag for 1.107.0 both return not-found, so the quarantine is verified at both registries and the incident timeline (the roughly two-hour window) rides attributed to the vendor report and third-party analyses, because the publication date does not pin at the registries. Wiz’s Oct 21 writeup independently describes 1.107.0 as “a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.”
This is a rhyme, not a repeat. Our March coverage of LiteLLM holds the malicious 1.82.7 and 1.82.8 releases (Team PCP, about forty minutes live); our MemTensor coverage holds the Sept 23 sckit worm. Different versions, dates, operators and entry vectors. What repeats is the startup-execution trick and the hunger for credentials that AI tooling concentrates on developer machines.
The Interception and the Campaign
Hundreds of Tor exit relays were hijacked to intercept SSH between Oct 1 and Oct 5, the widely reported figure 333 exits, redirecting password logins to twelve interception servers presenting fake host keys. Key-based logins could not be replayed; password logins were fully exposed. Some relay hosts showed the Ebury SSH backdoor. The Tor Project pulled the relays by 17:00 UTC on Oct 5. The victim count is unknown. The figures ride the directory analysis by researcher “kaba” as reported by The Hacker News and SC World, and the public writeups landed Oct 5 to 21, the largest on Oct 21, which means the interception ran and finished before the label existed.
And SafePay: the joint advisory of Oct 20, from the FBI, CISA and USSS with Germany’s LKA Rheinland-Pfalz and the UK NCA and NWROCU, reports the group active since August 2024 with at least 600 victims across critical infrastructure sectors in the Americas, Europe and Australia, operating without affiliates, double-extorting through a leak site. Figures attributed to the advisory as reported.
What the Label Hides
The thread through all of it runs both ways. Models and agents found this week’s worst flaws: PHP2Shell through frontier models, Brotli through OpenAI Codex Security researchers. Local agents recovered CA keys on first attempt, per the Mozilla record. The poisoned LiteLLM build went specifically after AI coding-tool secrets and AI provider keys. And per our agent-identity analysis, deployed agents now fetch their own identity maps and ingest packages with no human in the loop; our OpenCode coverage is the same class one layer down, a coding-agent RCE shipped as a refactor with no CVE, so nothing flags it. The Palo Alto bypass our earlier coverage put at four months of silent exploitation is the same shape again.
The defaults that failed this week are the defaults the agent economy is being sold this quarter. SafePay ran since August 2024. The eMudhra keys were weak since April 2025, with a wrong-key warning in June 2025. The Tor interception ran Oct 1 to 5. PHP2Shell sat in the code for more than a decade. The week of Oct 19 to 22 is when the bills were dated, not when they were incurred.