Black October 2026: The Latest Cybersecurity Research Findings

October 2026 has become one of the busiest months on record for security researchers, and AI is a big reason why. In a single week, researchers disclosed critical flaws in PHP and Node.js, a mass campaign against enterprise firewalls, new iPhone spyware delivery methods, and several supply chain attacks. Some in the industry now call it "Black October".

This article rounds up the most important findings, explains who is affected, and lists what to do about each one. It is current as of 25 October 2026.

October 2026 findings at a glance

PHP2Shell: the flaw that took websites offline

PHP2Shell is the month's headline: two critical PHP flaws that let an attacker run code on a web server without logging in. Both are rated 9.2 on CVSS v4.0, and they were found with AI by researchers from Calif, OpenAI and Wiz, according to The Hacker News.

The impact was immediate. Governments and companies took websites offline on 21 October to apply the fix, and both the NSA and Europe's cybersecurity agency went on alert. Wiz described the bugs as among the most severe ever found in PHP.

The disclosure did not go to plan. Details leaked on social media before the patch, and Amazon's honeypots caught an exploit attempt on 17 October, four days early. The exposure is huge: Modat counted 4.38 million internet-facing PHP services, about 79% of them on branches PHP no longer supports.

What to do: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every PHP worker. The official PHP security advisory lists the fixed releases, and our PHP2Shell analysis covers who is exposed and how to check your systems.

Why so many bugs at once? AI is finding them

AI tools are now finding software flaws faster than defenders can fix them. Forthcoming research from VulnCheck says AI helped double the number of vulnerabilities discovered compared with last year, Reuters reports. Cloudflare's CEO told Reuters he expects a couple of years in which every week feels like a crisis.

The PHP flaws went unnoticed for more than a decade because exploiting them took complex work that AI helped researchers do, according to Wiz via Axios. NPR notes that AI systems can persistently try new ways into code until something works, which is why researchers are logging record numbers of flaws.

There is a hopeful side. In PHP2Shell's case, researchers found the bugs before attackers did. And not every disclosed flaw leads to a successful attack: an ArmorCode engineer told Reuters that more disclosures do not automatically mean more breaches. The race is now about how fast organizations can patch.

Node2Shell: a Brotli bug in Node.js

Node.js also needs urgent patching. CVE-2026-111497 is an out-of-bounds write in the Brotli decompression library that Node.js bundles, and Node.js says it can allow remote code execution, per Konfirmity's advisory summary. Imperva researchers then showed code running on an unpatched build using crafted Brotli data, an exploit nicknamed Node2Shell.

The bug sits in Google's Brotli library itself, so it reaches beyond Node.js. Debian's tracker lists Brotli 1.0.3 through 1.2.0 as affected, with fixes in 1.0.10, 1.1.1 and 1.2.1.

What to do: Node.js released fixes for its 22.x, 24.x and 26.x lines on 21 October, including v24.22.1, v22.23.4 and v26.12.1. Node.js 20 reached end of life in April and gets no fix. Rebuild container images too, and update system Brotli packages.

k0t: mass attacks on enterprise firewalls and VPNs

A threat actor called k0t has broken into organizations worldwide through exposed network edge devices, exposing more than 70,000 credentials. The joint investigation by Group-IB and NyxLab, reported by The Hacker News, found targets included Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

k0t does not pick victims by industry. Instead it scans the internet for exposed appliances at scale, so the product and its location matter more than who runs it. In some cases the attackers set up persistent remote access and stole data using Rclone, a common file-sync tool.

What to do: patch every internet-facing firewall and VPN, restrict management interfaces from the internet, rotate VPN and LDAP credentials, and look for unexpected Rclone activity or outbound transfers.

iPhone spyware delivered through ads and expired domains

Attackers are infecting iPhones with spyware through ordinary web browsing, sometimes without the victim clicking anything. Researchers at iVerify and Report URI uncovered two campaigns by criminal groups with suspected ties to China, Axios reports.

One campaign abused online advertising infrastructure. The other was quieter: attackers bought about 630 expired domains that once hosted features like chatbots and analytics, which nearly 8,000 legitimate websites still loaded. That let them serve malicious code through trusted sites.

This follows research from the University of Toronto's Citizen Lab, which confirmed zero-click spyware delivered through targeted ads against at least 45 devices at Al Jazeera.

What to do: keep iPhones updated and consider Lockdown Mode for high-risk users. Website owners should audit every third-party script and remove any that point to domains they no longer control.

Lazarus Group adopts post-quantum cryptography

North Korea's Lazarus Group is now using post-quantum encryption to hide its malware deliveries. Kaspersky named the operation FlashHole and found it uses ML-KEM, a standardized post-quantum algorithm, to talk to its command-and-control server, BleepingComputer reports.

The campaign targets South Korean organizations and has run since July 2025. Victims land on phishing pages that send them to crafted GitHub pages. The attackers then abuse a legitimate Windows file, fsquirt.exe, to run a new downloader called TechHub, which fetches more malware from private GitHub repositories. Another new loader, ClientHub, can communicate through Dropbox.

What to do: treat downloads and links pointing to unfamiliar GitHub repositories with suspicion, and alert on fsquirt.exe launching unusual child processes.

ROMULUS: a ClickFix platform exploiting a Siemens flaw

Attackers are exploiting a Siemens Software Center flaw in an active malware campaign tied to ROMULUS, a reusable ClickFix delivery platform, Help Net Security reports. Siemens published its advisory for the flaw, CVE-2026-110936, on 15 October with a CVSS v4.0 score of 8.4; Huntress Labs reported it.

ClickFix tricks people into pasting and running a malicious command themselves, which slips past email and endpoint security. Forescout's Vedere Labs found the ROMULUS panel during an incident and traced it to six IP addresses. One matches the address Siemens lists for distributing a trojanized installer, AllMyBasic.msi. Who runs ROMULUS is still unknown.

What to do: apply Siemens' fix, install software only from official channels, and teach staff never to paste commands from websites or pop-ups into Run, PowerShell or Terminal. Security awareness training that covers ClickFix lures helps here.

Supply chain attacks on developers and AI tools

Developers remain a prime target, with three supply chain campaigns reported this month.

LiteLLM 1.107.0. On 21 October, a malicious LiteLLM release was published to PyPI and Docker carrying a credential stealer and remote access tools, according to Rescana's incident summary. LiteLLM is a widely used proxy for AI model APIs. BerriAI, its maker, says the attacker used three engineers' GitHub accounts through apparently stolen GitHub CLI tokens and has paused releases, Runtime Wire reports. It is LiteLLM's second supply chain compromise this year, after a March attack via the Trivy scanner.

GhostAction. This credential-theft campaign has hit about 1,900 GitHub accounts and targeted more than 30,000 repositories, The Hacker News reports. Attackers push malicious workflow files with harmless-sounding names like "security-audit.yml" to steal CI secrets; new waves hit on 8 to 12 October.

MALFEX. CloudSEK and Checkmarx found eight malicious npm packages, downloaded 40,767 times, that install information stealers and a remote access trojan on Windows, per The Hacker News.

What to do: if you installed LiteLLM 1.107.0, remove it and rotate every secret on that system, including AI provider keys, cloud keys and GitHub tokens. Pin dependency versions, pin GitHub Actions by commit SHA, and review new workflow files before they run.

Plex2Shell: home media servers under attack

Attackers are exploiting exposed Plex Media Servers through Plex2Shell, a chain of four known vulnerabilities that together allow remote code execution without logging in, Shattered reports. Real-world attacks began within about a day of a public proof of concept.

Compromised servers are being loaded with the XMRig cryptocurrency miner and a reverse proxy tool, which can turn a home server into a relay for other attacks. Plex has not publicly confirmed the campaign, which independent researchers documented.

What to do: update Plex Media Server to the latest version, and avoid exposing it directly to the internet. Check for unexplained high CPU use, a common sign of cryptomining.

What defenders should do now

The common thread is speed: flaws are being found, leaked and exploited within days. This checklist covers this month's findings, in priority order.

• Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all PHP workers
• Update Node.js to the October 2026 releases and rebuild container images
• Patch internet-facing firewalls and VPNs; rotate VPN and LDAP credentials
• Check for LiteLLM 1.107.0 and rotate all secrets on any system that ran it
• Review GitHub workflow files for unexpected changes; rotate CI secrets
• Apply the Siemens Software Center fix and update Plex Media Server
• Audit third-party scripts on your websites for expired or unowned domains
• Remind staff never to paste commands from websites into a terminal
• Build an inventory of every runtime and dependency version you run, so the next emergency patch takes hours, not days

For the latest exploited flaws, track CISA's Known Exploited Vulnerabilities catalog, or browse it with exploit likelihood and ransomware links in Seraph's KEV catalogue.

FAQ

What is Black October in cybersecurity?

"Black October" is the name some researchers have given October 2026 because of how many major vulnerabilities and attacks surfaced in a few weeks, many found with the help of AI tools.

What is the most serious vulnerability this month?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is the most widespread, because PHP runs a large share of the web and attackers began exploiting it before the patch.

How is AI changing vulnerability research?

AI tools can test code persistently and find complex bugs humans missed, which has roughly doubled yearly vulnerability discoveries, according to VulnCheck. Defenders benefit too, but patching must speed up to keep pace.

Are small websites at risk?

Yes. Campaigns like k0t and PHP2Shell scan the whole internet for vulnerable systems rather than picking targets, so any exposed, unpatched server can be hit.

How do I protect my iPhone from spyware?

Install iOS updates promptly, restart your phone regularly, and consider Lockdown Mode if your work makes you a likely target.

Need help acting on these findings? Talk to our team about an exposure review, or if you suspect a compromise, get incident response help now.

Sources

• The Hacker News: PHP2Shell exploited 4 days before disclosure
• Axios: The internet's hidden security nightmare
• NPR: The race to save PHP2SHELL
• Reuters via US News: AI-discovered bugs may trigger fresh disruptions
• Help Net Security: PHP2Shell patched
• Konfirmity: Node.js October 2026 security releases
• OSV: Debian CVE-2026-111497 (Brotli)
• The Hacker News: Hackers breach enterprise firewalls and VPNs
• Axios: Hackers turning web browsing into an iPhone trap
• BleepingComputer: Lazarus uses post-quantum cryptography
• Help Net Security: Siemens Software Center ClickFix campaign
• Rescana: LiteLLM 1.107.0 supply chain compromise
• Runtime Wire: BerriAI on stolen GitHub tokens
• The Hacker News: GhostAction compromises 1,900 GitHub accounts
• The Hacker News: Eight malicious npm packages deliver Overlord RAT
• Shattered: Plex2Shell hits live servers

Header photo: FlyD on Unsplash. Seraph Cyber — Empowering Businesses. Building Resilience.