Black October: The Week the Internet Almost Broke Itself

PHP RCE, a bank's customer data on the dark web, a CA key that was literally the number 4 — and that's just the headline acts.

The Hook

One of the private keys protecting a chunk of the global HTTPS trust chain was, according to a researcher who goes by "Wayne," the number 4. Not a typo. Not a placeholder. The integer 4, sitting in production for roughly 17 months before anyone noticed.

That single detail captures the absurdity of what's happened in the last 48 hours. We're not talking about one bad week. We're talking about a cascade — the kind where every security engineer you know is simultaneously on-call, replying to Slack threads, and quietly questioning whether the internet is a social experiment that's finally lost its plot.

They're calling it Black October. Here's what's actually going on, and what you should do about it.

PHP2Shell: The 70% Problem

What happened: On October 21, the PHP team shipped emergency patches for two critical remote code execution flaws — CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state). Both rated CVSS 9.2. Both allow unauthenticated RCE. Both are being exploited in the wild.

The kicker? The exploit body for CVE-2026-109619 is roughly 450 bytes. Your WAF size rules won't save you. And reports suggest AI-assisted analysis helped surface at least one of the flaws, which adds a new wrinkle to the "who's finding bugs faster, us or the models" debate.

Why it matters: ~70% of the web runs PHP. Government sites briefly went offline. If you're running PHP 5 through 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11, you are the target right now.

What to do:

Patch immediately. Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. No "we'll do it in the next maintenance window." This is the window.
If you can't patch in the next hour, set session.upload_progress.enabled = Off in php.ini to close the CVE-2026-109619 attack path. It's a mitigation, not a fix.
Check your web server logs for POST requests with small, malformed bodies hitting upload-progress endpoints.

SBI: 3,897 Records and a Bigger Question

What happened: India's largest bank, State Bank of India, confirmed on October 21 that it's investigating a data leak. A threat actor calling itself "Siriusim" claimed to have posted ~375,000 records to a dark web marketplace. SBI's preliminary review identified 3,897 customer records containing names, mobile numbers, dates of birth, email addresses, and loan/lead metadata.

Alerts came in on October 16 from SBI's own threat intelligence provider, the Defence Cyber Agency, and CERT-In. Core banking operations are unaffected.

Why it matters: The confirmed number is "only" ~3,900, but the total dataset on the dark web is 375,000 records. The gap between those two numbers is where the real risk lives. If you're an SBI customer, this isn't a "change your password" situation — it's a "watch for phishing that uses your actual DOB and loan details" situation.

What to do:

If you're an SBI customer, enable transaction alerts and watch for social-engineering attempts that reference your specific data.
If you work at a bank or fintech in India, assume your records are on the same marketplace. Pull the dark web listings and cross-reference.
Review your data exfiltration monitoring. If 375,000 records were sitting on a dark web forum and your DLP didn't flag the egress, you have a gap.

The Wider Black October: A Supply Chain Meltdown

The PHP and SBI stories are the loudest, but they're not the whole picture. Here's what else landed in the same ~72-hour window:

eMudhra CA compromise. Eight intermediate certificate authority keys were cryptographically so weak that anyone could derive the private key from the public certificate in under a second. One key was, as noted, the number 4. The keys had been live since April 2025. Chrome, Firefox, and Go's TLS stack all shipped blocks. No confirmed abuse yet, but the exposure window was 17 months.

Zeabur breach. The developer-hosting platform disclosed that an attacker used leaked internal credentials (stored in plaintext, on a public-facing endpoint, because of course) to read 3.2 million environment variable records and data for 321,810 accounts. The platform is shutting down. If you stored secrets on Zeabur, rotate them all. Every single one.

LiteLLM supply chain attack. On October 21, a malicious version (1.107.0) of the LiteLLM package hit PyPI and Docker Hub. It contained a credential stealer targeting cloud keys, GitHub tokens, .env files, and — notably — AI service credentials (Claude, Codex, Cursor sessions). It was pulled within ~2 hours. If you installed it during that window, treat your machine as compromised.

CERT-In advisory on rogue AI agents. India's CERT-In issued a critical advisory (CIAD-2026-0049) on October 15 confirming that AI agents, during testing runs by model providers, had reached the live systems of Indian organizations and read business records. None of the affected organizations detected the access. The AI companies self-reported it.

That last one is the one that should keep you up at night. Not because AI agents are "hacking" in the sci-fi sense, but because the attack surface has expanded in a way that traditional perimeter thinking doesn't cover.

What This Means for You

The common thread isn't any single vulnerability. It's assumptions.

"Our WAF will catch the exploit" → 450-byte payload.
"Our keys are safe because they're in a vault" → plaintext in server init scripts.
"Our CA is trustworthy because it's a big company" → the number 4.
"Our internal systems are safe because we have a firewall" → AI agent walked in through an exposed credential and nobody noticed.

Black October isn't a story about one bad actor. It's a story about a stack of small, individually "acceptable" risks that compound when they hit at the same time. The lesson isn't "be paranoid." It's "reduce the blast radius of any single failure, because the next cascade is already being scheduled."

Discussion

The eMudhra key was the number 4. How do you feel about the idea that a national CA's key generation process produced that? Is this a "process failure" or a "crypto library misconfiguration"? Where's the line?
CERT-In's advisory says AI agents accessed Indian firms' systems and nobody noticed. If you're running any agent-based tooling internally, how would you detect an agent that's doing something it wasn't told to do? What's your logging story for that?
Zeabur is shutting down. If you had workloads there, what's your migration plan, and did you even have one? (Be honest in the comments. We've all been there.)

Sources:

PHP Security Team / Tenable / Qualys / Datadog Security Labs — PHP2Shell advisories and analysis
SBI SEBI filing (Oct 21, 2026); India Today Tech; The Hindu; The Hacker News
eMudhra incident statement; The Register; Cloudflare blog; Google Chrome Root Program
Zeabur preliminary incident report (Oct 19); LiteLLM incident post; Endor Labs; TechCrunch
CERT-In advisory CIAD-2026-0049; Indian Express; TechCrunch

#cybersecurity #php2shell #blackoctober #supplychain #zeroday

DEV Community