October 2026 brought so many critical flaws and breaches at once that the security community started calling it "Black October." Two unauthenticated remote code execution bugs in PHP core, a CVSS 10.0 flaw in GitLab reaching back twelve years, an exploited SQL injection in Oracle E-Business Suite, Microsoft's largest-ever Patch Tuesday, and a ~20 million patient breach at Oracle Health all landed in the same few weeks. This roundup covers what broke, who's affected, and what to fix first.
What was Black October 2026?
The name given to October 2026 after a cluster of critical vulnerabilities and large breaches, many exploited within days of disclosure.
What were the biggest vulnerabilities in October 2026?
PHP2Shell (CVE-2026-109618/109619), GitLab's CVSS 10.0 RCE (CVE-2026-110264), and an Oracle EBS SQL injection (CVE-2026-101767).
What was the biggest breach in October 2026?
Oracle Health's legacy Cerner systems, affecting roughly 20 million patients across dozens of US hospital systems.
What should I patch first?
Anything internet-facing and known to be exploited or trivially exploitable: PHP, GitLab, Oracle EBS, and the exploited Windows and Adobe Commerce flaws.
Why did so much break at once?
AI-assisted vulnerability research is surfacing flaws faster, and attackers are exploiting them before most teams can patch.
Key Takeaways
- October 2026 saw an unusual run of critical, internet-facing flaws, several exploited within days of a patch.
- PHP2Shell, GitLab, and Oracle EBS are the three to act on first if you run any of them.
- Microsoft shipped its largest-ever Patch Tuesday, including a Windows zero-day exploited in the wild.
- The month's biggest breach by headcount was Oracle Health's legacy Cerner systems, around 20 million patients.
- AI-assisted research is part of the reason: it finds flaws faster, and attackers move faster too.
- The response is the same as always, just compressed: patch by exploitability, verify fixes, and check whether anything was already hit.
Why October 2026 Earned the Name
Most months bring a few serious vulnerabilities. October 2026 brought a wall of them, and many were the worst kind: unauthenticated, remote, and on software that sits directly on the internet. Several were exploited within days of a patch, or before one existed.
Two forces drove the pileup. First, AI-assisted vulnerability research is finding flaws faster than ever, something we cover in our look at how AI is reshaping vulnerability research. Google's Threat Intelligence Group reported that half of the flaws it believes were found by AI lead to remote code execution, compared with about a quarter of those found other ways. Second, attackers are weaponizing public disclosures within hours. The clearest way to track what's actively exploited is CISA's Known Exploited Vulnerabilities catalog, which added several of October's flaws as evidence of in-the-wild attacks came in.
The Critical Vulnerabilities of October 2026
Date | Product | CVE | Severity | What it allows |
|---|---|---|---|---|
Oct 21 | PHP core (PHP2Shell) | CVE-2026-109618, CVE-2026-109619 | 9.2 | Unauthenticated remote code execution on web servers |
Oct 21 | GitLab (self-managed) | CVE-2026-110264 | 10.0 | Unauthenticated RCE via a regex compiler integer overflow |
Oct 20 | Oracle E-Business Suite | CVE-2026-101767 | 9.8 | Unauthenticated SQL injection that chains to RCE |
Oct 14 | Microsoft (Patch Tuesday) | CVE-2026-96951 | Exploited | Windows Shell security-feature bypass, exploited in the wild |
Oct 20 | Oracle EBS (Workflow) | CVE-2026-101809 | 10.0 | Unauthenticated takeover, fixed in the October CPU |
Oct 28 (KEV) | Adobe Commerce / Magento | PolyShell | Exploited | Store compromise; added to CISA KEV on active exploitation |
Oct 21 | Google Brotli decoder | CVE-2026-111497 | High | Out-of-bounds write from a crafted compressed stream |
Three stand out. PHP2Shell is two flaws in PHP core, so every app on an unpatched server inherits the risk; our side-by-side on CVE-2026-109618 vs CVE-2026-109619 breaks down how they differ. GitLab's CVE-2026-110264 is a perfect 10.0 that reaches back to version 7.0 and sits inside your build pipeline, which is why it belongs in any CI/CD security review. And Oracle's CVE-2026-101767 was already being probed on October 27, a week after the patch.
This isn't the full list. Next.js, Node.js, PeopleSoft, BeyondTrust, Ivanti Connect Secure, and others also shipped critical fixes in the same window. Microsoft's October update alone carried roughly 1,400 CVEs, its largest ever.
The Major Breaches and Supply-Chain Attacks
- Oracle Health (Cerner), ~20 million patients. The month's largest confirmed breach by headcount hit Oracle Health's legacy Cerner infrastructure, with the intrusion traced back to 2025 and notifications landing in October across dozens of US hospital systems.
- LiteLLM supply-chain compromise. On October 21, the release infrastructure of LiteLLM, an open-source gateway for multiple large language model providers, was compromised, a reminder that AI tooling is now part of the software supply chain.
- ConnectWise Cloud Backup. A supply-chain compromise in a widely used backup platform exposed downstream customers.
- BeyondTrust and Ivanti zero-days. A China-linked group tracked as ARMORY CASTLE exploited a BeyondTrust Remote Support zero-day since late August, and an Ivanti Connect Secure VPN zero-day was used to steal Active Directory credentials, local admin passwords, and BitLocker recovery keys.
- Defense Manpower Data Center. A file-sharing flaw let unauthorized users reach US military personnel files from October 2025 until it was patched in July 2026, now the subject of a class action.
The common feature isn't an exotic exploit. Most started with an internet-facing system, a stolen credential, or a trusted update, the same patterns that a scan alone misses but a real penetration test is built to catch.
What to Do Now
The volume is unusual; the response isn't. Work in this order:
- Patch by exploitability, not by count. Start with internet-facing systems running PHP, GitLab, Oracle EBS, and the exploited Windows and Adobe Commerce flaws. Don't wait for a monthly cycle, and don't wait for KEV to confirm what researchers have already shown.
- Verify the fix took. Confirm the running version, restart workers and services, and rescan or retest. A patched package on disk isn't a fix if the old build is still serving traffic.
- Check whether you were already hit. Several of these were exploited before or just after disclosure. For anything internet-facing that was exposed, review logs, rotate credentials that may have leaked, and look for persistence.
- Prioritize what's left. You can't fix everything at once, so rank the rest by real risk, as we explain in vulnerability prioritization.
Must Read: JFrog Artifactory Vulnerability: Exploited in Three Days
How OraSec Can Help
When a month like this hits, the hard part isn't reading the headlines; it's knowing which of these flaws you're actually exposed to and whether anything already got in. OraSec's vulnerability assessment and penetration testing maps your internet-facing systems, confirms which affected products you run, and tests whether the patches and mitigations hold. For anyone exposed before patching, our threat intelligence team watches for leaked data and signs of compromise. The team's own research has produced published CVEs (CVE-2025-50847 through CVE-2025-50850).
Conclusion
Black October was a stress test for every patch program. The lesson isn't that the sky is falling; it's that the window between disclosure and exploitation keeps shrinking. Patch the internet-facing, exploited flaws now, verify each fix, check for compromise where you were exposed, and rank the rest by real risk. If you want an outside view of what you're exposed to after this month, talk to our team.
Frequently Asked Questions
Is "Black October" an official term?
No. It's an informal name the security community gave October 2026 after an unusual cluster of critical vulnerabilities and large breaches.
Which October 2026 flaw should I patch first?
Whatever is internet-facing and either exploited or trivially exploitable. For most organizations that means PHP, GitLab, Oracle EBS, and the exploited Windows and Adobe Commerce flaws.
Were these flaws exploited in the wild?
Several were, including the Windows and Adobe Commerce flaws added to CISA KEV, and the Oracle EBS flaw was being probed within a week of its patch. Others had no confirmed exploitation at the time of writing.
Did AI cause Black October?
Not directly, but AI-assisted research is surfacing flaws faster, and attackers are using AI tooling too, which compresses the time between disclosure and attack.
How do I know if I was breached during one of these?
For any exposed, internet-facing system, review logs from before the patch, look for new accounts or persistence, and rotate credentials that may have leaked. A compromise assessment helps when the exposure window was long.
