Swansenreport

‘Black October’: What Happened, What Didn’t, and What It Means for Wisconsin
Oct 26, 2026 · @Paul W. Swansen
“Black October” is not one attack. It is a nickname, spread on social media last week, for a pile-up of serious security disclosures that went public between Oct. 19 and Oct. 22.
The worst of them was real. Two critical flaws in PHP, the programming language that runs WordPress and much of the web, sent governments and companies scrambling to patch. Some pulled websites offline while they did.
But much of the panic outran the facts. Most of what surfaced that week had been building for months, some of it for years. What changed was that it all became public at once. And several of the scariest claims circulating online, from bank runs to internet lockdowns, have not been confirmed by anyone in a position to know.

The core of it: PHP2Shell
PHP shipped fixes on Oct. 21 for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10. They let an attacker with no account run code on a web server.
The flaws sit in PHP itself, not in WordPress or any plugin. That is the part site owners need to understand. Updating WordPress does nothing here. The fix has to come from whoever runs the server: the hosting company, the Linux distribution, or the person who administers the machine.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get regular updates. The PHP team issued limited emergency backports for 7.4 through 8.1.
Artificial intelligence found the bugs. Researchers at Wiz reported them to PHP in August after using frontier models from Google and OpenAI. The disclosure did not go as planned. A working proof-of-concept leaked early through an anonymous post, and PHP abandoned its schedule to rush the patches out, according to Techzine.
The NSA and CISA urged immediate patching on Oct. 22. Both agencies said systems that cannot be updated right away should come offline until they can. At the time, CISA said it had not seen the flaws exploited.
That changed over the weekend. A security lead at Perplexity, Adel Karimi, reported that his honeypot servers caught a confirmed remote code execution against an unpatched Apache server. A separate researcher broke into a server baited with a bitcoin wallet key in about 19 hours. Neither case means every unpatched server will fall. Experts noted the published exploit is tuned to specific PHP builds. But the argument that nobody could make it work is gone.
One more item: on Friday, PHP published a workaround for a third flaw, CVE-2026-115560, which has no patch yet. PHP says it affects only unusual configurations.

What else landed that week
PHP2Shell was the headline. It was not alone. Several unrelated problems went public within days of each other, and the timing is what gave the week its name.
Date made public
Incident
What happened
Oct. 21
LiteLLM
A poisoned release of this AI developer library reached PyPI and Docker through a stolen maintainer token. It stole cloud credentials and AI service keys. The release has been pulled.
Oct. 21
GitLab
Patch release for a flaw rated 10.0 that allowed remote code execution, plus two lesser account-takeover and cache-poisoning bugs.
Oct. 21
Node.js
Fix for a remote code execution flaw in its bundled compression decoder, reported by OpenAI security researchers.
Oct. 20
SafePay ransomware
FBI, CISA, Secret Service and British and German partners warned the group has hit at least 600 organizations since August 2024.
Oct. 17–20
eMudhra certificates
Eight intermediate certificates from an Indian certificate authority had private keys so weak anyone could recover them. Revoked and blocked by Mozilla, Google, Apple and Microsoft.
Oct. 5–21
Tor exit relays
Hundreds of hijacked relays intercepted password-based SSH logins Oct. 1–5. Tor removed them Oct. 5. Victim count unknown.
The eMudhra case unsettled security people most. Certificate authorities vouch for which websites are real. A stolen key could let someone fake a bank’s or government’s site. eMudhra blamed an error in a script used during an April 2025 key ceremony. The company said it found no evidence the certificates were used to issue anything to end users, BleepingComputer reported. As of Oct. 21, public reports had not established widespread attacks using the keys, according to Business Today. Chrome is scheduled to drop eMudhra’s affected root on Oct. 27.

Confirmed, and not
The nickname did a lot of work online. Some of what it carried holds up. Some does not.
Claim
Status
Two critical PHP flaws put most web servers at risk
Confirmed. PHP, NSA and CISA all say so.
AI found the flaws
Confirmed. Defensive researchers used AI models to find them. Claims that attackers used AI to find them are not supported.
Attackers are using PHP2Shell
Confirmed in at least one case, a honeypot reported Oct. 25. Not established as widespread.
Government sites went offline
Confirmed, as a precaution, in the Netherlands, Australia, Japan, Finland and elsewhere. Taking a site down to patch it is not the same as being hacked.
Banks were “infiltrated”
Not confirmed. Axios reported that some U.S. banks found unvetted third-party AI agents in customer accounts. It did not report money taken. Big banks had already been restricting outside agents earlier in October.
A bank run or internet lockdown is coming
Speculation from commentators. No regulator or bank has said so.
It was one coordinated global attack
No. It was separate incidents, most of them months or years old, made public in the same week.
The label came from a viral X post calling it “the worst in cybersecurity history”
Unverified. At least one outlet searched for the original post and could not find it.
The most useful framing came from analysts who called it a disclosure wave, not an attack wave. The weak eMudhra keys dated to April 2025. SafePay has operated since August 2024. The PHP flaws sat in the code for more than a decade. What happened in late October was the accounting.

What it means here
No Wisconsin agency, county or school district has been publicly reported as breached through PHP2Shell. But the exposure is local by nature. Small businesses, resorts, churches, chambers of commerce and town governments across the South Shore run websites on WordPress and shared hosting. That is exactly the setup these flaws hit.
For anyone who runs a website, the steps are short:
1. Find out who controls your PHP. On shared or managed hosting, that is the host, not you. In WordPress, Tools > Site Health > Info shows the PHP version.
2. Ask your host directly whether PHP has been patched to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distribution build with the fix.
3. If your site runs PHP 8.1 or older, plan to move. CISA says unpatched and unsupported systems should come offline until fixed.
4. Don’t ignore old staging copies and forgotten subdomains. They run PHP too.
Regular readers don’t need to do anything about PHP itself. The eMudhra fix arrives through normal browser and phone updates, so keeping those current is the main step.
Open questions for local officials:
• Did Bayfield County, area municipalities, school districts and hospitals check and patch their PHP-based systems?
• Did any local public website go offline during the week of Oct. 19?
• Has the state’s Division of Enterprise Technology issued guidance to counties and municipalities?
Sources
• NSA, CISA Urge Immediate Patching of Critical ‘PHP2Shell’ Vulnerabilities — ExecutiveGov, Oct. 22, 2026
• A PHP2Shell exploit cracked a server baited with $2,000 in bitcoin in 19 hours — Martin Cid Magazine, Oct. 26, 2026
• PHP shuts the internet: Why PHP2Shell affects every company — Techzine
• AI’s ‘Black October’: Critical PHP flaws set off global security scramble — CNBC, Oct. 23, 2026
• Mozilla, Google, Apple block compromised eMudhra CA certificates — BleepingComputer, Oct. 20, 2026
• BT Explainer: Why Google, Apple and Mozilla took action against eMudhra certificates — Business Today, Oct. 21, 2026
• eMudhra’s Security Key Flaw — Inc42
• CISA: SafePay ransomware hit over 600 critical infrastructure orgs — BleepingComputer, Oct. 21, 2026
• Mass ‘Black October’ panic — Raw Story (summarizing Axios on bank AI agents)
• Big US banks tighten agent account access — summarizing Financial Times, Oct. 16, 2026
• Black October Is a Disclosure Wave. The Label Hides the Clock. — Forkast, Oct. 23, 2026 (AI-authored outlet; used for LiteLLM, GitLab, Node.js and Tor details)