Black October 2026: every attack and flaw of the month, who is affected and how to protect yourself
Between 5 and 21 October 2026, critical flaws in widely used software, attacks on packages and platforms that thousands of projects depend on, and leaks of people's data all came together. We have reviewed it case by case in reliable sources: what happened, who it affects and what to do, in plain language and without alarmism.
In one sentence: in three weeks more than a dozen incidents piled up. The most important thing for almost everyone is to update software, change the keys stored on affected platforms and turn on two-step verification.
3.2Menvironment-variable records read at Zeabur
49 000downloads of the malicious LiteLLM version
≈100 000Railway workspaces with possibly affected variables
3 897SBI customers with data on the dark web
The timeline
- 5 OctAn npm package from SubQuery with hidden code that steals credentials is detected.
- 12 OctGitLab fixes a first critical flaw with the maximum score.
- 14-15 OctZeabur suffers an intrusion into its infrastructure.
- 15-16 OctA version of Rank Math PRO for WordPress is distributed with a backdoor.
- 16-17 OctAttack on the OpenCode console: AI API keys are exposed.
- 17-20 OctMozilla, Google, Apple and Microsoft block eMudhra certificates.
- 19 OctOVHcloud's command-line tool is distributed with tampered files. ConnectWise's cloud backup remains suspended after unauthorized access to Microsoft 365 accounts.
- 20-21 OctPlex2Shell enters CISA's catalog of exploited vulnerabilities.
- 21 OctThe big day: emergency patches for PHP, Node.js, Oracle Java and GitLab, Railway detects access to environment variables, LiteLLM publishes a malicious version and SBI reports the leak of customer data.
What we correct from the infographic:
- eMudhra: the keys were not literally "4" and no forged websites have been seen. They were weak, and no certificates issued with them have been found.
- Railway: it happened on 21 October and affected at most 1.85% of workspaces.
- PHP2Shell: official agencies don't all say the same thing, and the "70% of the web" figure is an approximation.
- Rajasthan Police: we have not been able to confirm it, so we do not treat it as true.
What to update or check
| If you use… | Do this |
|---|---|
| A website with PHP or WordPress | PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later) and Rank Math PRO 3.0.124 if you have it. |
| Node.js applications | Node.js 22.23.4, 24.22.1 or 26.12.1 (or later). |
| Your own GitLab server | The version released on 21 October. |
| Oracle Java or GraalVM | The patch from Oracle's alert of 21 October. |
| A Plex server | Plex Media Server 1.43.3.10861 or later. |
| Railway, Zeabur or OpenCode | Change all the keys stored there. |
| LiteLLM, OVHcloud CLI, Tensorlake or SubQuery | LiteLLM 1.106.2 or earlier, OVHcloud CLI 0.16.0, and review your dependencies. |
| Accounts and passwords in general | Turn on two-step verification and distrust messages that mention a leak. |
The cases, one by one
Each card says what happened, who it affects and what to do. The colored label sums up the main point: Update, Rotate keys or Watch.
1. Critical flaws in widely used software
PHP2Shell (PHP)
Refresh21 October · severity 9.2 out of 10 · CVE-2026-109618 and CVE-2026-109619
- What happened
- Two critical flaws in the PHP core allow code to run on a server without logging in. PHP released the patches a day earlier than planned because the identifiers were already circulating. According to The Hacker News, there was an exploitation attempt four days before the details became known.
- Who it affects
- Any website running PHP earlier than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, such as those built with WordPress, Drupal or Laravel. The risk is higher with Apache and mod_php. PHP 8.1 and earlier no longer receive patches from the project.
- What to do
- Update PHP or ask your hosting provider whether it has already done so. If you can't patch yet, isolate that server.
Node.js
Refresh21 October · 10 vulnerabilities · CVE-2026-111497 ("Node2Shell")
- What happened
- Node.js fixed 10 flaws at once. The most serious is an error in the Brotli decompressor that, in some cases, allows code to run. Another (CVE-2026-106069) allowed bypassing the hostname check in TLS certificates. Cloudflare added emergency rules to its web firewall against the Brotli flaw.
- Who it affects
- Applications running Node.js 22, 24 or 26 earlier than the fixed versions, especially if they decompress Brotli data that an attacker controls. Node.js 20 and earlier no longer receive patches.
- What to do
- Update to Node.js 22.23.4, 24.22.1 or 26.12.1 (or later) and rebuild your containers.
GitLab
Refresh12 and 21 October · severity 10 out of 10 · CVE-2026-97229 and CVE-2026-110264
- What happened
- GitLab fixed two flaws with the maximum score. Both stem from an error when processing regular expressions and allow code to run on the server; the second even without logging in. Anyone who updated on the 12th had to do it again. We have not found reports of real attacks using either of them.
- Who it affects
- Self-managed installations of GitLab, in its CE and EE editions.
- What to do
- Install the version released on 21 October even if you already updated on the 12th, and don't expose GitLab to the internet unless necessary.
Oracle Java and GraalVM
Refresh21 October · severity 9.1 out of 10 · CVE-2026-91403
- What happened
- Oracle published an emergency alert, outside its quarterly schedule, for a flaw in JSSE, the part of Java that handles secure connections. It can be exploited remotely, with no credentials or user interaction. As of 22 October there was no public exploit and no known attacks.
- Who it affects
- Oracle Java SE (8, 11, 17, 21, 25 and 27) and GraalVM, in the versions Oracle lists.
- What to do
- Apply Oracle's patch from 21 October. If you can't do it yet, limit network access to the affected Java services.
Plex2Shell (Plex Media Server)
Refresh20-21 October · real attacks under way
- What happened
- Four Plex flaws that, chained together, allow code to run without logging in. CISA added them to its catalog of exploited vulnerabilities: they are already being used to install cryptocurrency miners and a proxy-type backdoor. The fix has existed since August.
- Who it affects
- Anyone with a Plex server earlier than version 1.43.3.10861 reachable from the internet. In September more than 36,000 were still not updated.
- What to do
- Update Plex and look for strange processes or abnormal processor usage.
2. Attacks on packages and development tools
LiteLLM 1.107.0
Rotate keys21 October · PyPI and Docker Hub
- What happened
- Attackers slipped a malicious version of this AI library out for less than two hours. It stole passwords and keys, and left a backdoor that ran downloaded code every hour. About 49,000 downloads are estimated.
- Who it affects
- Anyone who installed or updated LiteLLM that day, including with "latest" Docker images. Earlier versions are safe.
- What to do
- Pin version 1.106.2 or earlier. If you installed 1.107.0, treat that machine as compromised and rotate all the keys and passwords it had access to.
OVHcloud CLI
Rotate keys19 October · versions 0.11.0 to 0.15.0
- What happened
- An attacker used a developer's GitHub account to swap the files of OVHcloud's command-line tool for a program that hunts for secrets on disk. They were available for 1 hour and 33 minutes and were downloaded about 250 times.
- Who it affects
- Anyone who downloaded those versions during that time.
- What to do
- Move to version 0.16.0 and change the secrets stored on that machine, starting with the OVHcloud credentials.
Rank Math PRO (WordPress)
Refresh15-16 October · severity 9.8 out of 10 · CVE-2026-111862
- What happened
- For about 11 hours, some downloads of the premium plugin Rank Math PRO (version 3.0.123) contained malicious code. They were withdrawn and the clean version 3.0.124 was published.
- Who it affects
- WordPress sites that downloaded and activated 3.0.123 during those hours. The free plugin does not appear among those affected in the vendor's notice.
- What to do
- If you installed it, treat the site as compromised: restore a clean copy and change passwords, database keys and the wp-config keys.
npm packages: Tensorlake and SubQuery
Rotate keysEarly and mid October
- What happened
- Two npm packages were published with code that steals credentials on install: a version of Tensorlake, tied to the "Shai-Hulud" worm wave, and SubQuery's @subql/common 5.8.3, which also allowed remote access.
- Who it affects
- Developers and continuous-integration systems, such as GitHub Actions, that installed those versions.
- What to do
- Check your dependency lock file, remove those versions and rotate the npm, GitHub and cloud tokens that were on that machine.
ConnectWise Cloud Backup
WatchUntil 19 October · more than 170 organizations
- What happened
- Attackers used a credential belonging to the vendor itself to get into Microsoft 365 accounts without going through a password or two-step verification. ConnectWise suspended the service and says the stored backups remain encrypted with no known access.
- Who it affects
- Companies and service providers that connected ConnectWise Cloud Backup to Microsoft 365.
- What to do
- Disable, without deleting, the ConnectWise applications in Microsoft 365 and review any added with credentials since 13 October.
3. Platforms and cloud services
Railway
Rotate keys21 October
- What happened
- Railway detected anomalous activity in the systems that store its customers' environment variables. A third party was able to access encrypted variables and, in some cases, see their contents. It paused deployments and asked everyone to rotate their secrets. At most 1.85% of workspaces, about 100,000, had possibly affected variables. Railway believes this is part of a series of attacks on platforms to reach AI providers.
- Who it affects
- Any project hosted on Railway that stored API keys, database passwords or registry credentials as variables.
- What to do
- Rotate all the secrets stored on the platform, check the logs for unusual activity and change the keys of connected services.
Zeabur
Rotate keys14-15 October · shutdown on 31 December
- What happened
- An attacker got into the shared cluster, dedicated servers and internal systems using leaked internal credentials. They read about 3.2 million environment-variable records and data from 321,810 accounts, and had root access to 101 servers. The company will shut down all its services on 31 December 2026.
- Who it affects
- Zeabur customers.
- What to do
- Rotate all secrets, close sessions and move your projects to another provider before the end of the year.
OpenCode Console
Rotate keys16-17 October · 1.4% of users
- What happened
- An attack on OpenCode's web console, not on the app or the command-line program, exposed OpenAI, Anthropic and Google API keys. There were unauthorized charges of more than 1,700 dollars in at least one case. Anthropic and Google blocked the keys and OpenAI refunded credits.
- Who it affects
- OpenCode Console users who stored keys from external providers.
- What to do
- Rotate those keys from each provider's dashboard, review usage and bills since 16 October and look for the email "Action Required: Potential provider key breach".
4. Certificates and people's data
eMudhra (trust certificates)
Watch17-20 October · 8 intermediate certificates
- What happened
- eMudhra, an Indian digital-trust provider, mistakenly generated weak keys for eight of its intermediate certificates: they were numbers smaller than 256, so anyone could recover them by trying only 256 possibilities and, in theory, forge trusted certificates. Mozilla and Google blocked them on 17 October, and Apple and Microsoft on the 19th and 20th.
- Who it affects
- Apparently nobody directly: the company says those authorities did not issue certificates to users, and no fake certificates have been seen in the public logs. The risk remains in old software and devices that still trust them.
- What to do
- Keep browsers, operating systems and devices updated so they include the block.
SBI (State Bank of India)
Watch21 October · 3,897 customers
- What happened
- India's largest public-sector bank told the stock exchange that, out of about 375,000 records circulating on the dark web, it identified 3,897 with customers' personal data: name, mobile number, date of birth, address, identifiers and loan data. It is investigating the source.
- Who it affects
- Those 3,897 customers. An Indian digital-rights organization criticizes that there is no record of them being notified.
- What to do
- If you are a customer, distrust calls, texts and messages that mention your data or your loans, and don't share codes or passwords.
What we could not confirm: other cases are going around social media, such as an alleged hack of Rajasthan Police (a group says it has 70,000 records), a Tailscale incident related to eMudhra or a TeamUpdraft leak. We have not found reliable sources that confirm them, so we do not treat them as true. We also see no evidence in the sources for viral claims such as "AI finds and exploits the flaws faster than we can patch them".
What they have in common
- Secrets stored in the cloud. Railway, Zeabur and OpenCode held other people's API keys and passwords. If the platform falls, your keys fall.
- Official software that stops being trustworthy. LiteLLM, OVHcloud CLI, Rank Math PRO and Tensorlake were official downloads tampered with for just a few hours. That was enough.
- Patches piling up. On 21 October those for PHP, Node.js, Oracle and GitLab all arrived at once. Anyone who doesn't update quickly is left exposed.
- AI keys are loot. Railway, OpenCode and LiteLLM have in common that attackers were after keys from artificial-intelligence providers, which can be spent instantly.
How to protect yourself
If you are a user
- Turn on two-step verification on your email and your important accounts, preferably with an authenticator app or a passkey.
- Use a different password for every service, with a password manager.
- Keep your browser, system, apps and router updated.
- After a leak, expect fake messages that mention the incident to steal your data, and don't click links or give out codes.
- Check on Have I Been Pwned whether your email appears in leaks.
If you have a website or a server
- Patch anything exposed to the internet within 24 or 48 hours, starting with PHP, Node.js, GitLab, Java and Plex.
- On WordPress, download plugins only from official sources, turn on security updates and keep backups off the server.
- Don't expose admin panels or services to the whole internet: put them behind a VPN or an allowlist of IPs.
If you develop software
- Pin your dependency versions and use lock files. Wait a few days before adopting a newly published version.
- Use short-lived tokens with minimal permissions, and don't leave secrets in repositories.
- Protect your GitHub account with two-step verification and review the workflows (Actions) added to your repositories.
- Verify the signatures or checksums of the binaries you download.
If you use cloud platforms
- Rotate keys after any provider incident, even if they say your account is not among those affected.
- Set spending limits and billing alerts on your AI and cloud API keys.
- Use different keys per environment and per project, so one leak doesn't open everything.
What to do if you were affected
- From a clean device, change your passwords, starting with your email, and close all open sessions.
- Rotate the API keys, tokens and secrets that were on the affected system or platform, and revoke the old ones.
- Check bills, usage and logs for spending or access you don't recognize.
- If you installed affected software, reinstall from scratch or restore a copy from before the incident.
- Turn on two-step verification on everything you can.
- Notify your team, your customers or your hosting provider and, if personal data is involved, the data protection authority (in Spain, the AEPD).
How we lived it at FireFighter
On 21 October Railway, where our website's backend is hosted, warned that a third party may have accessed some customers' environment variables. We revoked and renewed all the credentials we had there, checked the logs without finding unusual activity and published an incident report. Railway later said our workspace was not among those at highest risk. We have also pinned a fixed version of Node.js in the code and required the fixed version of Brotli in the bot. FireFighter has never had anyone's Discord password.
Sources
- Tech Fusionist (@techyoutbe) on X
- Dark Web Informer on X
- Help Net Security: eMudhra security blunder left trusted CA signing keys exposed to anyone
- SecurityWeek: Browsers block eMudhra intermediate CAs over recoverable private keys
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- Node.js: October 2026 security releases
- Rapid7: CVE-2026-111497, critical out-of-bounds write in the Node.js Brotli decoder
- eSecurity Planet: GitLab patches second 10.0 RCE flaw in October
- Oracle: Security Alert Advisory CVE-2026-91403
- BleepingComputer: CISA says hackers chain Plex flaws in Plex2Shell attacks to breach servers
- Wiz: LiteLLM compromised, steals credentials
- Dark Reading: OVHcloud GitHub compromise tied to GlassWorm threat actors
- BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites
- The Hacker News: Tensorlake npm package compromised
- BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack
- Railway: Preliminary report on the October 21st security incident
- BleepingComputer: Zeabur shutting down after second security breach in two months
- TechCrunch: Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts
- YourStory: SBI finds 3,897 customer records on dark web after hacker's claim
- Internet Freedom Foundation: SBI told investors its data breach doesn't matter
FireFighter Bot Security and administration bot for Discord. Invite it to your server for free.