Black October 2026: The Cyberattack Wave That Shook the Internet

On 22 October 2026 a widely shared post described the previous 48 hours as the worst in cybersecurity history and gave the moment a name: Black October. The label stuck because a lot of serious news arrived at once: a critical flaw in PHP, a trojanised release of the popular LiteLLM package, a maximum-severity GitLab bug, and breaches at several developer platforms.

It is worth being precise about what the name means. Black October is not one coordinated attack. It is an informal label for a cluster of unrelated incidents that were disclosed in the same week. Some analysts point out that this was mainly a wave of disclosures, and that many of the underlying intrusions had been running for weeks or months before anyone announced them.

Date (Oct 2026)	Target	What happened
12-13	French supermarkets	Refrigeration systems manipulated; about 700 of 10,000 stores affected, per the minister
14-15	Zeabur	Platform breached; 321,810 account records and about 3.2M environment-variable records read
15-16	ConnectWise Cloud Backup	Stolen credentials used to reach customers' Microsoft 365; 162 tenants confirmed by 16 Oct
17-18	UpdraftPlus / TeamUpdraft	Compromised key used to push malicious plugins to connected WordPress sites
19	OVHcloud CLI	Malicious binaries published for about 94 minutes
21	PHP	PHP2Shell: CVE-2026-109618 and CVE-2026-109619, unauthenticated code execution
21	LiteLLM	Version 1.107.0 on PyPI carried a credential stealer
21	Railway	Encrypted environment variables may have been accessed, some decrypted
21	GitLab	CVE-2026-110264, a regex-handling flaw rated 10/10

Secrets are the real target. Zeabur, Railway, LiteLLM, OVHcloud CLI and ConnectWise all come down to the same thing: attackers want the API keys, tokens and environment variables that unlock everything else.
The supply chain is the delivery route. A package, a plugin or a CLI that you already trust is a better entry point than a firewall you have to break.
AI is shortening the clock. AI models helped find the PHP bugs, and AI agents were reportedly used to exploit sites at scale. Both shrink the time between "bug exists" and "bug is abused".

A fair reading of the coverage means holding a few caveats in mind:

Much of the early reporting came from social media and secondary trackers, not primary disclosures.
Severity scores conflict. PHP2Shell was cited as a perfect 10 in some posts and 9.2 in others. NGINX bugs fixed on 14 October were rated 9.2 by F5 but "medium" by the NGINX project.
Claims about attackers using AI agents, including a claim by ConnectWise about a state-aligned group, are not all independently confirmed.
Reaching a Microsoft 365 tenant, or finding a bug, does not mean a tenant was compromised.

Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and see our PHP2Shell breakdown.
Rotate secrets held in Railway, Zeabur or any platform that stored environment variables for you.
Audit dependencies: check whether LiteLLM 1.107.0 was ever installed, and pin to a known-good version (1.106.2).
Review WordPress admin accounts and plugins if you used UpdraftCentral.
Review Microsoft 365 sign-ins for any backup or third-party integration.

The lesson of Black October is less "everything is on fire" and more "the gap between disclosure and exploitation is now measured in minutes".

What is "Black October"?

The incidents at a glance

Share this page

Three themes behind the noise

The evidence is messier than the headlines

What defenders should do this week