Black October 2026: How AI sped up bug hunting and attacks

“Black October” refers to a cluster of major security incidents disclosed largely on October 21, 2026, involving weak eMudhra certificate authority keys, critical unauthenticated remote-code-execution flaws in PHP and GitLab, a Node.js Brotli decoder vulnerability later confirmed as actively exploited, and a compromised LiteLLM release that distributed credential-stealing malware. Vendors and browser makers issued patches, package removals, certificate distrust actions, and upgrade guidance, while CISA added the Node.js issue to its Known Exploited Vulnerabilities catalog. Public reporting indicates that AI did not cause the underlying flaws, which stemmed from conventional problems such as weak randomness, memory-safety errors, integer overflow, and leaked credentials, but it may have accelerated both discovery and exploitation. Wiz reported using AI throughout its PHP2Shell research process, OpenAI Codex Security researchers reported the Node.js flaw, and threat researchers linked the ARTEX multi-agent penetration-testing framework to rapid real-world intrusions, including attacks targeting Microsoft 365 tenants and South Korean financial firms. The LiteLLM supply-chain breach also illustrated how AI-related tooling can become a high-value target, as exposed logs from an internal deployment allegedly exposed developer tokens that attackers used to alter release workflows and publish malicious signed packages.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.