Between 19 and 22 October, a run of serious security disclosures landed in the same few days. Two critical flaws in PHP. A GitLab flaw rated 10.0. A remote-code flaw in Node.js. A poisoned release of LiteLLM, the popular AI gateway library. A certificate authority whose keys had been weak for a year and a half. By 22 October the week had a name: Black October.
It felt like an attack wave. Mostly it was a disclosure wave. Many of these problems were weeks, months or years old. This was the week they were written down.
That is the lesson of Black October. Without a code scanner, you are bound to be more exposed. You learn that your own code is affected when the news does, and then you go looking through every repository by hand. With a scanner, the problem comes to you, with the repository, the file and the line.
| Incident | What it is | What to do |
|---|---|---|
| PHP2Shell CVE-2026-109618, CVE-2026-109619 | Two flaws rated CVSS 9.2 each. At least one affects every PHP version back to 5.4. Patched on 21 October. | Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Rebuild every image that bundles PHP. |
| GitLab CVE-2026-110264 | Remote code execution with no login, rated 10.0, in a patch release on 21 October. An account-takeover flaw rated 8.2 shipped in the same release. | Patch self-managed GitLab now. |
| Node.js CVE-2026-111497 | Remote code execution in the Brotli decoder, across Node 22, 24 and 26. | Upgrade to 22.23.4, 24.22.1 or 26.12.1, and rebuild images. |
| LiteLLM 1.107.0 | A malicious release on PyPI and Docker, live for about two hours by vendor reports. It stole browser, cloud, Kubernetes, SSH, GPG and AI provider secrets. | Search your lockfiles and images. If it was installed anywhere, rotate everything that machine could reach. |
| OVHcloud CLI 0.11.0 to 0.15.0 | Modified for 94 minutes on 19 October after an attacker took over a developer's GitHub account. | Move to 0.16.0. Rotate credentials on any machine that ran a modified version. |
| Railway | On 21 October, Railway said encrypted environment variables may have been accessed, and some decrypted. | Rotate environment variables, API keys and registry credentials kept on the platform. |
| eMudhra | Eight intermediate certificates revoked, six for TLS and two for code signing. About 30,000 customer certificates need to move. | If any of your certificates chain to eMudhra, reissue them. |
Put dates next to each item and the week stops looking sudden. PHP2Shell was found on 19 August and reported on 24 August. The fix shipped on 21 October, two months later, and the flaws themselves had sat in the code for more than a decade. eMudhra's weak keys date from a key ceremony on 30 April 2025. A warning about the wrong signing key was flagged in June 2025.
The breaches tell the same story. Attackers were inside the testing contractor ETS for about 119 days, from 22 May. PingCAP's attackers had access from 9 September to 7 October. Kaspersky traced the Lazarus group's FlashHole operation back to at least July 2025. The SafePay ransomware group, the subject of a joint FBI and CISA advisory on 20 October, has been active since August 2024 with at least 600 victims.
Here is what that means for anyone who writes software. Code you merged in August was vulnerable on the day you merged it. Nobody knew. The danger was already in your code. The disclosure only told you about it. A team with no scanner has no way to connect that headline to its own repositories, except by hand.
Teams that write most of their code with Cursor or Claude Code add dependencies faster than anyone reviews them. An agent asked to "add an LLM gateway" will install the latest LiteLLM without a pause. If it ran in the two hours that 1.107.0 was live, it got the stealer. The same agent will copy a base image tag from an old example and keep shipping an old PHP or Node.js for months.
The secrets angle is just as sharp. The LiteLLM release went after AI provider keys by name. Zeabur, a developer platform breached this month, lost 321,810 accounts and about 3.2 million environment-variable records, and its admin tokens had not been rotated since January 2024. Coding agents need keys to work. Those keys now sit on more machines, in more environment variables, than they did a year ago.
1. Patch runtimes, then rebuild. Upgrade PHP, Node.js and self-managed GitLab. A runtime patch does nothing until the image that ships it is rebuilt and redeployed. Check the base image tags in your Dockerfiles, not just your servers.
2. Search for the bad versions. Look for litellm==1.107.0 and OVHcloud CLI 0.11.0 to 0.15.0 in lockfiles, images and CI caches. If you find either, assume the machine's secrets are gone.
3. Rotate what lives on platforms you cannot inspect. If you used Railway or Zeabur, rotate now. Then shorten the life of every long-lived token you can.
4. Do not take a release in its first days. The LiteLLM release was pulled in about two hours, and the OVHcloud CLI in 94 minutes. Commit lockfiles. Where your package manager supports it, set it to wait a few days before it accepts a new version. Most poisoned releases are gone before that window closes.
5. Re-check old code against new advisories, every day. This is the lesson of the clock. The check on a pull request sees what was known that day. Advisories keep arriving after the merge, so the code you shipped has to be checked again.
Take the same week twice: once with no scanner, once with Vybscan watching your repositories.
| The risk | Without a scanner | With Vybscan |
|---|---|---|
| Poisoned packages LiteLLM 1.107.0, OVHcloud CLI | Someone reads about it, then searches every repository and image by hand, and hopes nothing was missed. | The day an advisory names the release, the daily rescan flags every repository that pinned it, with the file and line. A pull request that tries to add it fails its check, if you set Vybscan to block. |
| Agents adding packages | The agent installs whatever it chose. Nobody looks at the name. | Every new package is screened on the pull request for known malicious releases, typosquats and invented names, before it merges. Each finding comes with a fix brief your coding agent can apply. |
| Keys in code the stealers went after cloud, SSH and AI keys | Keys committed to the code sit in the repository and its history, waiting for a stealer or a breach. | Secrets are flagged on the pull request, before they land. |
| The clock problems months older than the news | You find out when the news does, sometimes months after the merge. | Code you merged months ago is checked again every day against new advisories. The next disclosure reaches you as a finding, not a headline. |
| Your own bugs | Injection, broken access checks and leaked data in your code wait for someone else to find them. | Your code is reviewed on every pull request, by pattern rules and an AI review, before an attacker gets the chance. |
A scanner does not patch your PHP interpreter, your Node.js runtime or your GitLab server. Those upgrades are still yours, and step 1 above is where to start. A package published an hour ago, with no advisory yet, is hard for every scanner, which is why step 4 matters.
But look at what is left once you take those out: the poisoned packages, the agents installing them, the keys they steal, and the months-old problems nobody had connected to their own code. That is most of Black October. A team with a scanner heard about the ones in its own code within a day of each advisory, with a list of exactly where to look. A team without one learned from the news, if at all. That gap is the difference between a scanned codebase and an exposed one.
No. It is an informal name for a run of separate disclosures between 19 and 22 October 2026: PHP2Shell, a GitLab flaw rated 10.0, a Node.js remote-code flaw, a poisoned LiteLLM release, a certificate authority's weak keys, and several platform breaches. Most of the underlying problems were weeks or months old.
Anything that runs a vulnerable runtime or server where an attacker needs no login. That means PHP (fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35), self-managed GitLab (the 10.0 flaw), and Node.js (fixed in 22.23.4, 24.22.1 and 26.12.1). Rebuild your container images after you upgrade, or the old version keeps shipping.
Treat the machine as compromised. That release carried a credential stealer aimed at browser, cloud, Kubernetes, SSH, GPG and AI provider secrets. Rotate every credential the machine could reach, then move to a clean version.
Most of the parts that live in your code, yes. A scanner flags a poisoned package such as litellm==1.107.0 in every repository that pinned it once an advisory names it, catches secrets before they land, and rechecks code you merged months ago against every new advisory. It does not patch a PHP interpreter, a Node.js runtime or a GitLab server; those upgrades are yours. Without a scanner, you find all of it by hand, from the news.
Sources: Black October Is a Disclosure Wave. The Label Hides the Clock. (Forkast, 23 Oct 2026); Black October: Many attacks had been running for months (SecurityToday, 22 Oct 2026); Black October 2026: 14 cyber incidents (CyberNexora). Versions and dates are as reported there on 24 October 2026; check each vendor's advisory before you act.
Dependencies, code and secrets on every pull request, and a daily rescan for advisories that arrive after the merge.
Try Vybscan →