Black October: what happened in October 2026 and what your company needs to do

Between October 17 and 22, 2026, so many critical vulnerabilities and attacks piled up that the international press called the period “Black October”. The most serious problem for companies in Romania is called PHP2Shell: two flaws in PHP, the language that, by some estimates, runs almost 70% of the world’s websites, including those built with WordPress.

In Romania, the National Cyber Security Directorate (DNSC) issued an alert as early as October 21 and then notified 17,416 public institutions. If your company has a website, an online store, a NAS or a firewall, it’s worth checking a few things now. Below we briefly explain what happened and what needs to be done.

What is Black October?

Black October isn’t a single attack, but a series of incidents and critical vulnerabilities announced within a few days. The most important ones:

• PHP2Shell (October 21): two vulnerabilities in PHP that let an attacker run code on the server without logging in. We explain them below.
• Brotli (October 21): a vulnerability in the Brotli decompression library, used by Node.js, Firefox and Thunderbird, among others. Node.js released updates the same day.
• LiteLLM (October 21): an infected version (1.107.0) of this library, used to connect applications to AI models, was briefly published on PyPI and Docker Hub. The program hidden in it stole passwords saved in the browser, access keys to cloud services and API keys for AI services.
• GitLab (October 21): a vulnerability that, under certain conditions, allows code to run on self-hosted GitLab servers.
• Oracle E-Business Suite (October 20): an SQL injection flaw, exploitable without authentication, that can give access to financial, payroll and human resources data.
• EDK II (October 22): a vulnerability in UEFI firmware, the code that starts the computer before the operating system. It can be exploited when booting from the network (PXE), so it mainly concerns servers; systems that boot only from the local disk aren’t affected.
• eMudhra (October 17): the private keys of eight intermediate certificates from the Indian certificate authority eMudhra turned out to be weak. Chrome and Firefox blocked them, and on October 22 eMudhra announced it was giving up its SSL/TLS certificate business.

The full list, with sources, is on the Wikipedia page about Black October.

What is PHP2Shell and why is it the most serious?

PHP2Shell is the name Wiz researchers gave to the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated critical (CVSS score 9.2). Wiz and the company Calif discovered them in August, with the help of AI models from OpenAI and Google, and reported them to the PHP team.

The problem isn’t in WordPress or in plugins, but in the PHP interpreter, the program that runs the website’s code on the server. In the worst case, an attacker needs a single request, with no password, to run code on the server, even before the website’s code executes. Wiz demonstrated the attack on WordPress, Drupal and Joomla sites. The vulnerabilities can also expose data from the server’s memory, such as passwords, API keys or certificates.

The PHP team released the fixes on October 21, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older are no longer maintained by the PHP team: for them there are only minimal source code fixes (for 7.4, 8.0 and 8.1) or packages from some Linux vendors. And there are plenty of servers running old versions: according to an internet scan cited by Recorded Future, almost 8 out of 10 PHP services that display their version run an unsupported one.

The attacks started before the fixes. Amazon recorded an exploitation attempt as early as October 17, four days before the official announcement. The technical details reached the internet a few hours before the updates came out, and hosting companies reported attacks on the very morning of October 21.

IT security: tell me more →

Is my company affected by PHP2Shell?

Any server that runs an unpatched version of PHP and responds to web requests is vulnerable. And PHP hides in more places than it seems:

• the website and the online store, if they’re built with WordPress, WooCommerce, Joomla, Drupal, PrestaShop, OpenCart or Magento;
• internal web applications, such as a CRM, an intranet, phpMyAdmin or a time-tracking application installed on a company server;
• NAS devices: Synology released PHP updates through Package Center for applications such as Web Station, WordPress, MailStation and Calendar (MailStation is updated manually), and QNAP released updates for QTS, QuTS hero and QuTScloud;
• firewalls and other devices with a web management interface: Palo Alto Networks, for example, announced that the web management interface of its firewalls (PAN-OS) is affected.

Two common traps:

1. Updating WordPress or its plugins doesn’t fix the problem. The PHP on the server has to be updated.
2. The version number can be misleading. Linux distributions patch packages without changing the displayed version: on Ubuntu 24.04, for example, the patched package still reports PHP 8.3.6. You check the package’s changelog for the CVE codes.

What should you do now?

1. Update PHP on all servers, to one of the patched versions or to the distribution’s patched package, then restart the PHP services (PHP-FPM, Apache). Until the restart, the server keeps using the old code.
2. Ask your hosting company or the agency that maintains your website for written confirmation: which PHP version is running now and when it was updated. On shared hosting, the provider does the update.
3. List the devices with a web interface (NAS, firewall, router, cameras, printers) and install the manufacturer’s updates. Until then, don’t leave them reachable from the internet: turn off port forwarding and UPnP on the router, use a VPN for remote access and allow access to the management interface only from the company network.
4. If you can’t update right away, restrict access from the internet, put the website behind a web application firewall (WAF) or take the system offline temporarily, as the UK’s National Cyber Security Centre (NCSC) recommends. Cloudflare turned on protection rules for all accounts, including free ones. Temporary php.ini settings (such as session.upload_progress.enabled=0) block only some attack paths: they don’t replace the update.
5. Check the server logs from at least October 17 onward: unusual requests, PHP errors and processes that stopped suddenly, commands run for no reason, new files in the website folders. If you find signs of compromise, change the passwords and API keys that passed through that server and start the incident response plan.
6. Update browsers, the email client and Node.js applications. For Node.js, the patched versions are 26.12.1, 24.22.1 and 22.23.4.
7. If your team uses LiteLLM, check whether version 1.107.0 was installed on October 21. If so, reinstall the affected environment from scratch and change all exposed passwords and keys.
8. Check your backup: there must be a copy of the data outside the network, one an attacker can’t delete or encrypt, and restoring from it must be tested. Details in the article on the 3-2-1 backup rule.

And, as a general rule: two-step verification on important accounts and a password manager, so that a password stolen from one server doesn’t open other accounts too.

Why did so many flaws pile up in a single month?

The main reason is artificial intelligence. Advanced AI models find vulnerabilities much faster than was possible until recently: PHP2Shell was discovered with the help of AI, the Brotli flaw was reported by the OpenAI Codex Security team, and the EDK II one by researchers from Anthropic and Google. Chris Krebs, the former director of the US Cybersecurity and Infrastructure Security Agency (CISA), told CNBC that 3% of all critical vulnerabilities ever discovered were found in the last month. Jason Clinton, Anthropic’s deputy chief information security officer, expects the situation to get worse before it gets better.

For companies, the conclusion is simple: critical vulnerabilities will appear more often and be exploited faster. Installing updates “when we have time” is no longer enough. What matters is knowing which devices and programs you have, updating them within days, not months, and replacing whatever no longer gets updates (see the article on end-of-life (EOL) technology).

What does Black October mean for companies covered by NIS2?

Companies covered by the NIS2 Directive (in Romania, GEO 155/2024) must manage security risks and report significant incidents to DNSC, with an early warning within 24 hours at most. A server compromised through PHP2Shell can be such an incident. If you don’t know whether your company falls under NIS2 or what you need to do, we can help through IT consulting.

How does RezolvIT help?

• On the Business Unlimited plan, computers and servers are monitored 24/7 and updated automatically, through MspCoreX. Details on the IT maintenance page.
• On request, we run vulnerability scans and IT security tests.
• With #BackupUșor, backups are set up and monitored by our team, locally or in the cloud.
• We respond within 15 minutes by phone, within one hour remotely and within 2 – 4 hours on site, anywhere in Romania.

The takeaway: Black October showed that critical vulnerabilities now appear more often and are exploited within hours. Update PHP and your devices with a web interface, check the logs from October 17 onward and make sure you have a backup you can restart from. If you want to know where your company stands, ask for a free IT audit: you get an inventory of your equipment, a list of risks and concrete recommendations.