Exploit scripts reportedly emerged in under 60 minutes of PHP2Shell patches landing on 21 October, against enterprise patch cycles of 30 to 90 days.
NEW DELHI: Black October did not switch off the internet. However, between 17 and 24 October 2026, a cluster of critical disclosures exposed something more consequential. Attackers, according to the research compiled, can now turn a published software fix into a working exploit in under 60 minutes. Consequently, calendar-based patching looks dangerously slow.
One week, several fault lines
The centrepiece was PHP2Shell, a pair of critical remote code execution flaws in the core PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619. PHP runs an estimated 69% to 70% of public web servers. Furthermore, Wiz researchers said the bug had sat undetected in the codebase since version 5.4. Within hours of disclosure on 21 October, Cloudflare CEO Matthew Prince reported, exploit attempts climbed from thousands to millions. Meanwhile, ministries in France, Germany, Finland, the Netherlands and the United Kingdom briefly took public websites offline. Notably, that disruption was precautionary and rapid patching and firewall rules largely blunted the feared mass breach.
A startup file as a skeleton key
The same day brought a supply-chain breach at LiteLLM, an AI gateway. Adversaries had tested a master key, exposed in a public repository on 27 May, on 10 October. Then, on 21 October, they used it to publish a malicious version 1.107.0 to PyPI and Docker. Crucially, the package planted a Python .pth file that runs whenever Python starts. Therefore the infostealer executed even if an application never imported LiteLLM. It harvested AWS, GCP, OpenAI, Anthropic and source-control tokens. Likewise, Railway reported unauthorised access to its secret-key storage, which potentially touched customer credentials.
The under-an-hour exploit
Artificial intelligence cut both ways. Researchers at Wiz, Calif and Chainguard used frontier models to trace memory flaws in legacy C code that human auditors had missed for years. However, adversaries pointed automated agents at the public patch diffs once the fixes landed. Those agents reportedly derived the vulnerability and generated working exploit scripts in under 60 minutes. Moreover, former NSA Director of Cybersecurity Rob Joyce claimed an attacker breached over 100 of 1,200 targeted sites for roughly $5,000 in tokens, or about $50 each. That figure remains an attributed claim rather than an independently verified one. Meanwhile, defenders faced testing and staging requirements, which left what the research describes as a “negative patch window”.
A certificate failure with an Indian address
Closer home, eMudhra suffered a cryptographic failure. Eight intermediate certificate authority keys, generated at a ceremony on 30 April 2025, carried scalar values below 256, which made them mathematically recoverable. After disclosure on 17 October, eMudhra revoked the certificates and major browsers blocked them. Consequently, the company announced on 22 October that it would exit the global SSL/TLS certificate business, and its shares fell 36% to 40% over two sessions.
Encouragingly, MeitY and eMudhra stated that India’s domestic Digital Signature Certificate and eSign systems remained secure. Those systems run on separate infrastructure under Controller of Certifying Authorities oversight. Nevertheless, questions persist. MeitY has opened an inquiry into how international WebTrust audits by BDO International missed the flaw. Similarly, Yash Kadakia, Founder and CTO of Security Brigade, asked how such an elementary error escaped mandatory audits. Independent researcher Karan Saini added that legacy enterprise devices with static trust stores remain exposed. Meanwhile, CERT-In urged banks, public bodies and MSMEs to update their PHP runtimes, and the Internet Freedom Foundation sought a public incident report.
What to watch next
Several indicators will show whether October was a shock or a new baseline. First, long-tail exploitation of unpatched PHP versions below 8.2 across public portals will reveal the real damage. Second, adoption of mandatory signed workflows and automated secret revocation at PyPI, npm and Docker Hub will test supply-chain resolve. Likewise, enterprises may shift coding agents into disposable sandboxes. Furthermore, regulators could require entropy checks during certificate key ceremonies. Finally, funding for memory-safe rewrites and the pace of defensive AI will matter.
Unlike Y2K, Black October has no fixed calendar resolution. Anthropic Deputy CISO Jason Clinton urged security chiefs to seek board support for the basics rather than for AI. Encouragingly, rapid disclosure, firewall rules and browser revocations contained the damage this time. Ultimately, the next test may arrive faster than the last patch cycle.
About the Author
