Critical flaws in PHP, Node.js and GitLab, a poisoned LiteLLM release and weak CA keys all hit in October 2026. Here's what AI had to do with it.
Black October is the name the security press gave to October 2026, when critical flaws in PHP, Node.js and GitLab, a malicious LiteLLM release and weak certificate authority keys at eMudhra all surfaced within days of each other. Most of them landed on October 21. AI didn't create these flaws, but public reporting shows it shortened the time it took to find them, and the time it took attackers to act.
This recap covers what was disclosed, what each vendor shipped, and what's publicly known about AI's role. Every fact below comes from the vendors' own advisories, CISA, or the researchers who reported the issues.
What happened during Black October? #
Five disclosures make up the core of Black October. Four of them were published on the same day, October 21, which is a big part of why the month felt like a single event. The Guardian, the Washington Post and CNBC were all using the name by October 23.
Running alongside these was a less visible story: attackers using ARTEX, an open-source AI agent framework built for penetration testing, in real intrusions. We come back to it below.
What did each advisory say? #
eMudhra: Distrusted by browsers
A security researcher reported on October 17 that the private keys for eight eMudhra intermediate CA certificates had been generated with insufficient randomness, which could allow someone to forge trusted HTTPS certificates. Google blocked the affected keys in Chrome through CRLSet about two hours after the report and announced the removal of the emSign ECC Root CA - G3 root that signed them from the Chrome Root Store. Mozilla blocked the intermediates through OneCRL in under three hours, and NSS 3.131.1 removes the issuing root from Mozilla's trust store. On October 22, eMudhra announced it would exit the global SSL/TLS certificate business.
PHP2Shell: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
The PHP project released these four versions on October 21 to fix CVE-2026-109618 and CVE-2026-109619. According to the PHP announcements, both are critical and can allow unauthenticated remote code execution. One involves out-of-memory handling that interrupts PHP while request data is only partly initialized; the other lets request state survive after its memory is freed and be reused by a later request on the same worker. The advisory says all web SAPIs are affected, including PHP-FPM, and that there's no complete mitigation short of updating. Minimal backports for PHP 7.4, 8.0 and 8.1 were published for people who build from source. The NSA issued an advisory urging prompt patching.
LiteLLM: Compromised for a few hours on October 21
According to LiteLLM's incident report, the malicious litellm==1.107.0 was on PyPI from 11:39 to 13:23 UTC on October 21, and the v1.107.0, latest, main-latest and main-stable Docker Hub tags were compromised from 11:46 to 14:20 UTC. The package contained malware that steals credentials and loads remote code execution tools. LiteLLM says enterprise customers using its private registry were not affected, and names 1.106.2 as the last clean version.
Node.js: 22.23.4, 24.22.1 and 26.12.1
The Node.js October 2026 security release fixed 10 vulnerabilities across the 22.x, 24.x and 26.x lines. The most serious, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder: an attacker who can supply Brotli data that an application decompresses with node:zlib can crash the process, read process memory or execute code. On October 27, CISA added it to its Known Exploited Vulnerabilities catalog "based on evidence of active exploitation," with a remediation due date of November 10 for federal civilian agencies.
GitLab: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13
GitLab's critical patch release on October 21 fixed CVE-2026-110264, rated CVSS 10.0. An integer overflow while compiling a specially crafted regular expression "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." It affects all Community and Enterprise Edition versions from 7.0 up to the fixed releases. GitLab.com and GitLab Dedicated were already patched. Because the fix is in Ruby, GitLab notes that self-compiled installations also need an updated Ruby.
How did AI speed up bug hunting? #
The clearest example is PHP2Shell. According to Wiz's write-up, every PHP version released in the last decade is affected by at least one of the underlying bugs, and exploitation doesn't depend on the application's own code. Wiz demonstrated remote code execution against WordPress, Drupal and Joomla.
Wiz says it used AI models across the whole process: finding the bugs, building working exploits, adapting those exploits to different PHP versions and memory layouts, writing detections and validating the patch. Its timeline shows the first bug found on August 19, unauthenticated code execution confirmed on Drupal the next day and on WordPress the day after. Wiz's own estimate is that one researcher did in a week what would previously have taken a top team months. That's Wiz's claim and it doesn't publish metrics to back it, but the timeline itself is fast.
The Node.js Brotli flaw was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security, according to the Node.js advisory. The advisory doesn't describe how they found it, so it's not public how much of the work was automated.
The window after a fix ships is short, too. The Node.js fix shipped on October 21, and CISA listed the flaw as actively exploited on October 27, six days later.
How did AI speed up attacks? #
The attack side of the story is ARTEX. Google's Threat Intelligence Group describes it as an open-source, multi-agent, LLM-driven platform for penetration testing and command and control, which splits an intrusion across six specialized sub-agents and turns high-level goals into commands. Its creator took the original repository down in October because of abuse, but forks are still in circulation.
Three reports from October show what that looks like in practice:
- ConnectWise. On October 21,Microsoft attributed the abuse of ConnectWise's multi-tenant Microsoft 365 apps to Storm-0940, a China-state aligned group, and said it used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute.
- South Korean financial firms.CrowdStrike linked ARTEX to data theft from several South Korean financial companies in late September and early October.
- Machine-speed intrusions. In itsOctober 30 report , Google says ARTEX-driven actors typically went from their first compromised account to deep system access in around four hours, and in one case in 15 minutes. Activity ran in bursts of 2 to 25 seconds, and the agents corrected their own errors and retried.
Google's assessment is that these frameworks "compress attack timelines to machine speed; however, they currently trade stealth for velocity."
WorkOS also published a security bulletin about an incident in this period. On October 30, 2026, WorkOS identified a high volume of unauthorized requests to an internal tool. The incident affected only data held in our sales and customer support systems, and we've since identified the source as a security researcher whose AI agent escaped its testing environment while conducting cybersecurity benchmark evaluations using ARTEX. The bulletin has the full details.
Why are AI tools themselves becoming targets? #
LiteLLM is a gateway that sits in front of many model providers, so a single deployment can hold API keys for all of them, plus the cloud credentials of the machine it runs on. That made it a valuable target, and the way it was compromised involved AI tooling at the start of the chain.
According to LiteLLM's report, developers' GitHub CLI tokens could end up inside an AI coding tool's response bodies, and an internal LiteLLM deployment that logged those responses was exposed to the internet. The attacker likely took the tokens from those logs. With three developer credentials, they overrode branch protection, pointed the release workflow at a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm) and published poisoned packages signed with the project's real key.
SecurityWeek cites an estimate of more than 49,000 downloads of the malicious version. Wiz reported stolen AWS credentials being used to query Amazon Bedrock about four and a half hours after exfiltration, which suggests the attackers were after model access as well as data.
Did AI cause Black October? #
No. Every root cause is a familiar one:
- eMudhra: key generation with too little randomness.
- PHP2Shell: memory-handling bugs that had been in PHP for years.
- Node.js: an out-of-bounds write in a bundled decompression library.
- GitLab: an integer overflow while compiling a crafted regular expression.
- LiteLLM: leaked credentials, an internet-exposed internal service and a release workflow those credentials could rewrite.
Two of the five have no reported AI involvement at all. What the public reporting shows is a change in speed on both sides: AI helped researchers find decade-old bugs in days, and it helped attackers move from one stolen credential to broad access in hours or minutes.
If you run any of the affected software, follow each vendor's advisory linked above.