Black October: Three Critical Flaws in 48 Hours Put Patching and Disclosure to the Test

Three flaws, one week

The week of October 20, 2026 compressed a quarter of bad news into two days. Drata's account of the week records three major vulnerabilities disclosed in a 48-hour window, a sequence the cybersecurity community labeled Black October, and the timeline behind it shows why teams felt pressed from several directions at once. m:…9414

On October 20, The Register revealed that certification authority eMudhra's private keys were compromised, and on October 22 eMudhra announced it was withdrawing from the TLS certificate business altogether. Between those two announcements, PHP shipped emergency patches on October 21 for two critical flaws, and later the same day Node.js shipped an emergency patch for a bug called Node2Shell. m:…9414

For regulated buyers, the pile-up mattered because each flaw touched infrastructure underneath applications rather than inside them, so the question quickly became which suppliers had patched, checked, and said anything at all. m:…9414

The Brotli hunt

The Brotli flaw, tracked as CVE-2026-111497, is an out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0, scored 9.2 under CVSS v4.0. A remote, unauthenticated attacker could crash a process, read its memory, or potentially run code by sending crafted compressed data, and the flaw works in both directions: a malicious client can attack a server, and a malicious server can attack a client. m:…9521 m:…3369

The awkward part is the calendar. OpenAI reported the bug in February 2026 and the fix was committed to the Brotli repository on February 27, 2026, but it was not labeled as a security issue until later, and Upwind reports that nobody treated it as a security fix, so no release shipped it until October. Node.js shipped fixes on October 21, 2026 in versions 22.23.4, 24.22.1, and 26.12.1, and public proof-of-concept code appeared on GitHub about five hours later. m:…3369 m:…9521 m:…3394

Finding every copy is the long tail. Tanium notes that Brotli rarely shows up as an application in its own right because it is bundled inside other software, runtimes, or container images, and Python applications using urllib3, aiohttp, or httpx with Brotli installed are automatically exposed, according to Upwind. Sysdig adds that Express 5 with express.json is exposed by default, that Node.js versions 25 and 20 are end-of-life and will not receive patches, and that Imperva demonstrated code execution on the official Node.js 24.22.0 image for Linux arm64. m:…9521 m:…3369 m:…3394

As of October 24, the flaw was not listed in CISA's KEV catalog and no public indicators of compromise had been released, according to Tanium, and Upwind reported no exploitation in the wild as of October 23. The absence of confirmed exploitation is not the same as safety when proof-of-concept code is public and the vulnerable component is buried inside other packages, which is why Tanium's interim advice is to reject requests with Content-Encoding: br at the web application firewall, reverse proxy, or ingress. m:…9521 m:…3369

PHP's behavior problem

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, a pair of unauthenticated remote code execution flaws in the PHP engine itself, each rated 9.2 under CVSS v4.0. The vulnerable code dates back to PHP 5.4 in 2012, and the flaws affect both Apache mod_php and PHP-FPM, hitting applications such as Magento, WordPress, Drupal, Joomla, Nextcloud, and phpMyAdmin even when their own code is clean. m:…3721

The reason patching alone is not the whole story is that PHP processes the malicious request before any application code runs, so application-level authentication does not protect a vulnerable server, and a patch does not take effect until PHP-FPM or Apache restarts and loads the new binary. Cribl's response illustrates the detection side: its Detection Lab combines CVE metadata with ATT&CK mapping to generate detection packs, and it generated eight detection rules for CVE-2026-109618 plus four correlation searches that chain rules into attack stories on the same host. m:…3721

Cribl's rules are behavior-based rather than signature-based, which matters when exploit tooling changes quickly. One rule fires when a PHP worker becomes the direct parent of a shell, a scripting interpreter, or a file transfer tool, and another fires when a PHP worker writes a file with a .php extension into a temporary directory. Sysdig's parallel approach for Node2Shell is a managed rule correlating a Node.js process crash with suspicious program execution that follows it in the same workload. m:…3721 m:…3394

Trust becomes the deliverable

Drata's Trust Center data shows buyers were not waiting quietly. Vulnerability and incident updates published in Drata Trust Centers rose 8x in the week of October 19, 36 percent of Drata enterprise customers published a Trust Center update about the recent vulnerabilities, and most of them did so within 24 hours of patch announcements. Customers sent 33,359 emails to Trust Center subscribers from October 19 to 23, compared with 2,506 the week before, a 13.3x increase, and subscriptions to Trust Center updates nearly doubled week over week. m:…9414

Drata's recommended cadence is to announce within 0 to 24 hours of a vulnerability announcement, publishing a Trust Center update and notifying the audience that needs it. The lesson of Black October for buyers is therefore twofold: ask suppliers for the inventory of bundled components, not just the patch status of named products, and treat the speed and specificity of a supplier's disclosure as evidence about how the next incident will go. m:…9414

What remains unresolved is the inventory problem: every bundled Brotli copy and unpatched PHP worker, including end-of-life runtimes that will never receive a fix. m:…3394 m:…9521