Black October: the day people discovered Internet is a dangerous place this week. And what a week... It was absurdly hard days for the security world, and it's probably not done yet (because this note has been updated a lot). A huge amount of security issues and other crazy discoveries were announced in few hours/days. Good luck to all my sysadmin friends working to make their infrastructure safer.
One of the very first big issue was due to a certificate authority problem. Many certificates generated by eMudhra (an Indian company) were totally unsafe. Indeed, their private keys were all an unique integer between 0 and 255 (uint8), instead of a long integer encoded on 384 bits. All started on 17th October, when "Wayne" (a security guy playing with new tools), discovered 8 odd certificates. A ticket was opened on Mozilla's Bugzilla. The thread is still very active. The consequences are concerning. Python is impacted and many packages must be updated. The Erlang Ecosystem Foundation did also a post about this issue explaining which modules must be upgraded as soon as possible. All Operating Systems are also impacted by this issue, and the certificates must be upgraded locally as well. The mitmproxy project already includes on its last version those certificates. More information below.
- eMudhra emSign PKI Services: CP/CPS documents not updated for current requirements from Mozilla's Bugzilla thread;
- eMudhra: Private key compromise of Intermediate Certificates from Mozilla's Bugzilla thread;
- Information for Python users regarding eMudhra / emSign CA certificate security incident from Python's Discuss thread;
- eMudhra CA Intermediate Certificates have been compromised, CA updates needed on all TLS components from the Erlang Ecosystem Foundation;
- Alpine Linux 3.24.3 from Alpine Linux website;
- OpenBSD 8.0 Errata 005 from the OpenBSD website;
- FreeBSD -- TLS certificate store update due to eMudhra compromise from FreeBSD VuXML;
- eMudhra TLS/SSL CA compromise from the NetBSD blog;
- Debian ca-certificates security update, from the Debian mailing-list;
- Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software from The Hacker News;
- India's eMudhra exits website security business after flaws trigger global alarm from Reuters;
- Oracle Security Alert Advisory - CVE-2026-91403 from Oracle/Java website.
PHP is well known for Wikimedia, Drupal, Wordpress, Symphony and many other frameworks/projects widely used around the world. Unfortunately, PHP design is not the best, and during the past decades, many critical issues have been impacted it. This week, 2 huge security issues have been released with a CVE score greater than 9 and allowing remote code executions. What's crazy here is those vulnerabilities have been discovered in 2024 (!) during an audit.
PHP was my first "real" language, like probably many of the developers and sysadmin of my generation. This language was - and still is - a big joke regarding design and consistency. During the week, PHP was also impacted by 2 big security issues with a score greater than 9 on the CVE scale. The whole story is just a pure mess. Called php2shell, the bug can execute arbitrary code on a remote server. Those bugs have been discovered in 2024 (!) during an audit. The PHP Foundation published a post on their blog explaining the whole process. Another crazy thing is, someone published an exploit few days before the official release, without any consideration of the companies being impacted by this news.
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge on The Hacker News;
- PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't on the Hacker News;
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert on The Hacker News;
- Two Critical PHP Flaws Leaked Ahead of the October 21 Security Release on WebHosting.today;
- Today's PHP Security Release, and How We're Strengthening PHP Security on the Official PHP Foundation blog;
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619 exploits on Abraxas Labs;
- php2shell/php2dos - php-stale-global-uaf exploit on Github;
- php2shell - php-oom-longjmp exploits on Github;
- Jesus Christ patch your shit now on xeiaso.net.
A second breach in PHP has also been announced, not related to PHP2Shell, linked to the Session process.
- Informational advisory: Session upload progress from PHP official website;
- CVE-2026-115560 — PHP session upload progress mitigation
At the same time, QUIC/HTTP/3 was also impacted by another 0day vulnerability called quiche, causing a DoS and eventually an OOM on many implementation of this protocol.
- Header Accordions: QPACK amplification attacks against HTTP/3 servers on Foxio.io;
- headeraccordions exploit/poc on Github.
It's not over... Gitlab also released emergency patches for Gitlab Community and Enterprise Edition containing 12 fixes, including one critical vulnerability allowing an unauthenticated user to execute arbitrary code remotely.
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 on Official Gitlab Documentation:
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases on The Hacker News.
Signal released also a series of patch to fix a critical security issue, allowing someone to keep the micro and the camera active after a call.
- Signal bug could keep your mic - and camera - on after hangup
- Signal v2.72.0 on Gitlab;
- CWE-754: Improper Check for Unusual or Exceptional Conditions on Common Weakness Enumeration website.
NodeJs, as usual, is always there to offer us more vulnerabilities, even when we don't need them. Nodejs team released a long series of patches fixing dangerous security issues, 4 of them with high level risks.
- Wednesday, October 21, 2026 Security Releases on NodeJS official blog;
- Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) on Vercel;
- "No way to prevent this" say users of only language where this regularly happens on Xeiaso.net.
Do you think it's over? Not at all! Apache traffic HTTP server released a new released to fix 15 vulnerabilities, including remote code execution and many other crazy holes.
- "No way to prevent this" say users of only language where this regularly happens on xeiaso.net;
- [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1 on apache traffic mailing-list.
A dangerous memory corruption bug on Bind9 can lead an attacker to execute remote code. Again, high severity issue, needs to be patched as soon as possible.
- CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory on ISC.org;
- "No way to prevent this" say users of only language where this regularly happens on Xeiaso.net.
Tor - which is becoming less and less trusted due to many design flaws and unfixed security issues - has also been impacted by a serious attack. 333 exit nodes on the tor network have been compromised and were used to do man in the middle attack on SSH connections. In case of success, the attackers were able to watch the commands and install backdoors.
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections from the Hacker News;
- [tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions from the Tor project mailing list.
The French provider OVH has been victim of a supply chain attack, replacing the binaries of many versions of their CLI tool.
- OVH supply chain compromise on Twitter.
The LiteLLM Python package has been compromised with a supply chain attack as well, injecting malwares via Pypi and Docker images.
- LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. on Twitter;
- LiteLLM supply chain attack hoovers up passwords and secrets on The Register.
PHP, NodeJS, and... Ruby. This language requires to be patched due to remote code execution vulnerability related to the Regexp module (integer overflows and double free issue). All versions of Ruby are impacted.
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 from the official Ruby news.
Kubernetes will also have a bad time, with 4 critical CVEs released very soon, including an issue on Azure Kubernetes, allowing remote code execution.
I don't even think it's done... And to be honest, I am not the only one to do a summary of all those security issues. Here few of them from Twitter:
- THE INTERNET BROKE TODAY
- This is the most serious 48 hours in cybersecurity history.
- October has been an absolute nightmare for software
- We can call it Black October for the security breaches:
- 33 security incidents in the news this October, sorted by size. 7 ran on a stolen key (K), 4 abused a trusted channel (T).
- This week the internet’s core infrastructure got hit harder than most people realize
While writing my article on the libsodium library port on Dart using FFI, I also checked the Erlang driver called erlang-libsodium. Sadly this package was kinda old (version 1.0.18+ released in 2019). Few issues and PRs have been opened to fix the library, but the project seems to be dead. Anyway, I wanted to use is to test the interoperability with the Dart implementation, and decided to fork it. libsodium has been updated to version 1.0.22 (the latest), the PRs have been merged, and I'm working on doing a lot of test cleanup. After that, I will - perhaps - ports the missing features from the latest release. The project can be found here: niamtokik/erlang-libsodium on Github.
What's happening in the economy right now is interesting -- and also terrifying. During the week, most of the big players just started to fall, as well as the Asian market.
The Semiconductor (SOX) Index was hammered 11.4% [...] Supporting the bursting Bubble thesis, the semi equipment stocks were under notable pressure. Applied Materials lost 19.3%, Lam Research 17.2%, and KLA 15.3%. Coherent dropped 25.5%, Lattice Semiconductor 17.8%, and Marvell Technology 17.2%. Nvidia slumped 6.1%, down a quick 12% in eight sessions. Broadcom fell 9.1% to a six-month low. Micron sank 14.6%, Intel 14.2%, and AMD 13.1%. South Korea’s KOSPI Index was hammered 14.5% this week, with a seven-session drop of 18.3%. [...] Japan’s Nikkei Index fell 5.4%.
-- Credit Bulletin Report
In fact, this situation is a direct result of something I saw many time in the past. Most of the current companies are not really companies anymore, but they look like sects. They are selling dreams, and faith to people without having an ounce of the knowledge or the experiences required to understand the bare minimum. You don't even need to give big proofs to make them pay, you know the aphorism "fake it until you make it". You just need one small miracle to make your company grows exponentially. The result? Some "expert" will also fall in the trap, and will start to preach. It will attract more people, blindly believing in them and in fine, in the technology sold by the company. The reality is harsh, and every actions produce reactions.
Investors are losing confidence that revenues from the AI boom will be sufficient to support the vast debt piles financing data centres, pushing bonds backing some of the largest US infrastructure projects into increasingly stressed territory.
-- Credit Bulletin Report
The recent message(s) from Linus Torvalds are hilarious. Torlvads has a strong reputation to be against a lot of new/modern technologies, but for LLMs, that's okay, that's just another tool. It's fascinating to see someone like him using LLMs and trashing other people opinions on this subject when you know the Open Secure AI Alliance joined the Linux Foundation in September. What kind of companies are present in this alliance? NVIDIA, Microsoft, Cisco, CrowdStrike, Hugging Face, IBM, Palantir, Red Hat and many others.
It's not done yet, nvidia is also giving money to Linux Foundations in many other ways. They are LVFS sponcors and they are supporting many other open-source projects (including the Linux Foundation). In fact, we don't even know the amount of money nvidia is giving to the Linux Foundation because it is not public. In doubt, follow the money, even a monk can be corrupted with gold.
Anyway, the LLM buzz is like the blockchain/crypto-currency one. They have both been created to do what fraudsters do the best: steal the money from your pocket by selling you a dream. The sects are doing the same with their victims. The result? What will happen when investors will discover all of these companies are selling snakeoil? They will simply ask their investment back. With $71 billions debt for Anthropic, and the small revenue generated by the company, it will become hard to explain that to investors.
In short: this is a bubble, it will pop one day, probably very soon (if it's not already the case). To my brainwashed IT colleagues, please stop be part of these frauds...
Coding
🏗️ DOOM on the Aspire PIXO — natively
System
📝 Introducing uncm(4): finally! a replacement for urndis driver working with recent version of Android! Say hello to uncm, providing support for the USB Network Control Model Ethernet devices.
📝 The hidden design compromises of Docker layers
📝 dbupdate(8) added to -current
🌐 exe.dev: Computers for developers and agents (Durable Sandboxes that are fast, secure, and sharable).
Database
🏗️ credcheck: provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming.
🏗️ pg_hint_plan: makes it possible to tweak PostgreSQL execution plans using so-called "hints" in SQL comments.
Security
📝 PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
📑 FloatDoor: Platform-Triggered Backdoors in LLMs
🌐 Private key compromise of eMudhra Intermediate Certificates: the thread from mozilla regarding the corrupted certificate.
🌐 eMudhra Intermediate CA Compromise: a longer post with solutions to apply after the CA corrupted certificate.
📝 How I got over 300 Tor exit nodes removed: a huge attack on tor network, where 333 nodes have been deployed to do MITM attack on SSH connections.
📝 Dumping Encrypted Viltrox Lens Firmware - two times
📝 One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
🌐 ExploitGrid: Get notified when a CVE hits the software you run.
📝 Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
📝 Scoop: Unvetted AI agents are accessing U.S. bank accounts
Security/cryptography
📑 Claude reveals ECDSA curve origins:
📝 How were the NIST ECDSA curve parameters generated?
📝 Can You Slop Out High-Assurance Cryptography?
Update/Upgrade
🔄 OpenBSD 8.0: another release of OpenBSD.
Misc
📝 Theo de Raadt: The Man Who Built the Internet's Locks
🐦 Meta just got hit with the largest penalty ever imposed on the company.: Meta will pay $25 bn for misleading Facebook users about how their data was protected.
Leaks of the week
French Communist Party: 183000 users impacted.
La France Insoumise: leaks about campaigns and organization.
ADMR: 4.5 millions people impacted, the leak include data about health and daily habits.
AMSAM: 922GB of data stolen including invoices, bills, many kind of internal documents about 400 people.
Cover image by Matthew Hamilton on Unsplash
Top comments (0)