Cybersecurity just had a wake-up call.
70% of websites on the internet are at risk. 3,897 SBI customer records on the dark web. AI helped uncover security holes that could expose servers to attack. All within a matter of days.
Welcome to Black October 2026.
But these incidents aren’t all connected, and not every headline means you’re in danger. Here’s what happened, who’s actually at risk, and what Black October means for your digital safety.
What is Black October, and why is it trending?
Black October is a nickname for a bad week in cybersecurity in October 2026. It is not one virus, and it is not one attack on the whole internet.
The name started after a serious flaw was found in PHP, a programming language that many websites run on. The fix came out on 21 October. Over the same days, more alerts followed, and security experts began calling the whole run of them Black October. Indian media picked up the name soon after.
Headlines often mix up three very different things. A weakness is a door that could be opened. An attempted attack means someone tried the door. A breach means someone got in and took something. When you read any update, ask which one it is.
What actually happened during Black October?
Four problems did most of the damage to people’s peace of mind. The table shows who needs to act on each.
| Problem | In simple words | Is this your pile? |
|---|---|---|
| PHP2Shell | Two serious holes in software many websites use | Website owners and web hosts |
| eMudhra flaw | An Indian company made weak digital locks for websites | Mostly not you, India’s e-signatures are safe |
| LiteLLM and Railway | Two tools that app builders use were broken into | Developers who use them |
| SBI data leak | Some customer details showed up on the dark web | SBI customers |
PHP2Shell: the website problem
PHP is a programming language. About 69% of all websites use it, according to W3Techs, including many WordPress sites. On 21 October, its makers released emergency fixes for two serious flaws, listed as CVE-2026-109618 and CVE-2026-109619. Together they are nicknamed PHP2Shell.
The danger was simple. On a normal setup, an attacker could make a website’s server run their commands without even logging in.
Do not read 69% as “69% of websites were hacked.” It only tells you how many sites use PHP. A site is at risk only if it still runs an old, unfixed version. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and agencies such as Canada’s Cyber Centre told organizations to patch fast.
This fix belongs to whoever runs the website or the hosting. Your own password has nothing to do with it.
eMudhra: the weak digital lock
Every secure website carries a digital ID card, called a certificate. It proves the site is the real one. Companies called certificate authorities issue these cards, and eMudhra is an Indian one. The idea rests on cryptography.
A researcher found that eight eMudhra certificates were built with weak secret keys, and one key was reportedly as simple as the number 4. That means attackers could have worked out the key and faked a website. Google and Mozilla stopped trusting those certificates, and eMudhra said it will quit its global website-certificate business.
For India, the news is better. The Ministry of Electronics and IT said the country’s Digital Signature Certificate and eSign services were not affected. It called the impact on Indian websites “very limited.”
LiteLLM and Railway: two tools that app builders trust
These two matter only if you build apps. LiteLLM connects apps to AI models. On 21 October, attackers broke into how it publishes updates and slipped out a poisoned version that steals passwords and secret keys. LiteLLM’s own report says the bad version was removed and its enterprise version was not hit.
Railway is a service where developers host their apps. It reported that someone got into the system that stores customers’ secret keys, and some were exposed. It told customers to change any secrets saved before 21 October.
Both show the same danger: a tool you trust can become the way in. Experts call this a supply chain attack, and it works like malware hiding inside something normal.
The SBI data leak:
On 21 October, State Bank of India told the stock exchange that 3,897 customer records were found inside a bigger dataset on the dark web. That is the hidden part of the internet where stolen data is sold. Reported details included names, phone numbers, birth dates and addresses.
SBI said its core banking was not materially affected. The bigger dataset is still being checked, so 3,897 is what SBI has confirmed so far. It does not mean every SBI customer is affected. Indian news listed it with the week’s alerts, but it is reported as separate from the PHP flaw.
Was my eSign or digital signature affected by eMudhra?
No, it was not. The government said India’s regulated Digital Signature Certificate and eSign services were unaffected. The weak keys sat in eMudhra’s separate global website-certificate business.
Did AI cause Black October?
Not the way the forwards say. AI played two different roles, and people mix them up.
Role one: AI found a hole. Researchers from Wiz, Calif and OpenAI used AI to discover the PHP flaw. Chainguard, another company, said it found the same bugs by asking an AI model to look. But the flaw was already in the code. AI found it faster and did not put it there. Security firm Trail of Bits made the same point: AI speeds up building an attack, but turning a bug into a break-in still takes real skill.
Role two: attackers used AI to move faster. Microsoft says a China-linked group it calls Storm-0940 used an AI tool named ARTEX to target hundreds of organisations. In some cases it gained high-level access in under three hours. Microsoft also said most attempts failed, and that getting in does not prove data was stolen.
So AI changes the speed, for attackers and for defenders, who now use AI against AI-driven attacks too. It does not change the basics of staying safe.
What should you do about Black October?
Go back to the idea from the start: find your pile. Then do only what that pile needs.
If you just use apps and websites, this covers most readers. Turn on a second check, such as an OTP or authenticator code, for your bank and email. Use a password manager so every account has a different password. If you bank with SBI, change your password, and do not trust a caller who quotes your details to sound real. That is a common trick called social engineering. Never click past a browser warning to reach a form.
If you run a website, ask your hosting company to confirm that PHP is updated to a fixed version. Updating a WordPress plugin does not update PHP underneath it.
If you build apps or AI projects, check whether you ever used the bad LiteLLM version or kept secrets on Railway, and change those keys. A simple habit from zero trust security helps: assume any key that touched an exposed system is no longer safe.
Do I need to buy special protection?
No, because no such product exists. The steps that work are the usual ones: different passwords, a second check, updates, and changing exposed keys. Anyone selling a special fix is selling fear.
If you suspect financial fraud, report it on the National Cybercrime Reporting Portal or call 1930.
Weeks like this are why demand for security skills keeps growing, and those skills can be learned. Our cyber security roadmap and cyber security jobs for freshers guide are good places to start.
Conclusion
Black October is not one giant attack, and you do not need to fear all of it. It is a handful of separate problems that landed in one week. Find the pile that is yours, do the one or two steps it needs, and let the noise pass. Start tonight by turning on a second check for your bank and email.
Black October FAQs
1. What is Black October in simple words?
It is a nickname for a bad week in cybersecurity in October 2026. Several separate problems, including a PHP flaw, a weak-lock issue at eMudhra and an SBI data leak, got grouped under one name.
2. Is Black October a global internet shutdown?
No, the internet did not shut down. Some organisations took services offline for a short time while they fixed the PHP flaw. Check a service’s official status page before assuming it was hacked.
3. Does Black October affect India?
Yes, in parts. SBI reported customer records on the dark web. But the government said India’s Digital Signature Certificate and eSign services were not affected by the eMudhra problem.
4. Is my SBI account hacked?
Not necessarily, since SBI confirmed 3,897 records in a larger dataset and said core banking was not materially affected. Change your password and ignore callers who quote your details to sound official.
5. What is PHP2Shell?
It is the nickname for two serious PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They could let an attacker run commands on a vulnerable web server. The fix is updating PHP.
6. Will changing my password fix PHP2Shell?
No, because it is a flaw in server software that only the website’s owner or host can fix. A password change helps only if your own login was exposed elsewhere.
7. Did AI cause the attacks?
Partly, but not as headlines say. AI helped researchers find a flaw that already existed, and one group used AI to work faster. AI changed the speed, not the basics of staying safe.
8. What is the one thing I should do right now?
Turn on a second check, like an OTP or authenticator code, for your bank and email. If you build apps, change any secret keys that sat on an affected service.
Sources
- Datadog Security Labs, PHP2Shell critical vulnerabilities (CVE-2026-109618, CVE-2026-109619): https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
- W3Techs, PHP usage statistics (as of 23 October 2026): https://w3techs.com/technologies/details/pl-php/5
- Canadian Centre for Cyber Security, Alert AL26-026, critical PHP vulnerabilities: https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
- Cybernews, eMudhra weak certificate keys and business exit: https://cybernews.com/security/emudhra-quits-certificate-business-java-python-flaw/
- Business Today, MeitY statement on eMudhra (DSC and eSign unaffected): https://www.businesstoday.in/technology/story/impact-has-been-very-limited-meity-on-emudhra-security-incident-says-indian-dsc-and-esign-unaffected-562927-2026-10-21
- LiteLLM, official security incident disclosure (21 October 2026): https://docs.litellm.ai/blog/security-incident-oct-21-2026
- Railway, security disclosure (21 October 2026): https://blog.railway.com/p/security-disclosure-wednesday-october-21st
- The Hacker News, State Bank of India confirms data leak (3,897 records): https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html
- Microsoft Security, Storm-0940 using ARTEX and the ConnectWise supply chain compromise: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
- 404 Media, AI and the discovery of PHP2Shell: https://www.404media.co/php2shell-black-october-ai-is-changing-everything-about-hacking-no-one-knows-what-happens-next/
- National Cybercrime Reporting Portal (India): https://www.cybercrime.gov.in
