"Black October": AI-Found Bugs and a Poisoned AI Gateway Hit at Once
"Black October" is the name going around for a cluster of security disclosures that landed in mid-to-late October 2026: PHP2Shell, a LiteLLM supply-chain attack and weak eMudhra CA keys.
By 1EyeAI Desk ·
"Black October" is the name going around for a cluster of security disclosures that landed in mid-to-late October 2026. Reporting so far says it was a wave of disclosures, not a sudden wave of attacks. Several of the underlying breaches go back months.
The confirmed pieces:
PHP2Shell. On Oct 21, PHP shipped emergency fixes (8.2.35, 8.3.36, 8.4.27, 8.5.12) for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619. Wiz researchers say they found the bugs with help from frontier AI models. They showed attacks working against WordPress, Drupal and Joomla.
LiteLLM supply-chain attack. LiteLLM is a widely used gateway for calling AI models. Its release pipeline was compromised, and a malicious version 1.107.0 was published to PyPI and Docker on Oct 21. The malware stole credentials, including AI API keys. LiteLLM tells affected users to rebuild their environments and rotate their secrets.
eMudhra CA keys. Keys for eight intermediate certificate authorities were found to be weak. Chrome and Firefox pushed out emergency blocks.
Why it matters for AI: The Washington Post says the AI industry expects more disruptive security events as AI speeds up how fast bugs get found. CNBC reports that tech insiders are "sounding fresh alarms."
UNCONFIRMED: Claims spreading on social video that banks were "infiltrated." We found no reputable reporting to support them. The X post said to have coined the label could not be located, according to Yahoo Tech.
If you run PHP or LiteLLM, patch now and rotate your keys.