Black October: A Concentrated Wave of Critical Vulnerabilities Across Core Internet Infrastructure

Last week delivered one of the most intense clusters of high-severity security issues we have seen in recent months, affecting several of the foundational technologies that power a large proportion of the modern web and development ecosystem.

Among the most significant disclosures: ▪️ PHP2Shell (CVE-2026-109618 and CVE-2026-109619) – two unauthenticated remote code execution vulnerabilities in the PHP core itself. Given PHP’s prevalence across websites and applications, the potential impact was substantial. Scanning and exploitation attempts were observed even before the emergency patches were released, and CISA has since added both flaws to its Known Exploited Vulnerabilities catalogue. ▪️ Next.js – two critical unauthenticated RCE issues, one affecting Image Optimisation (particularly with SVG handling on glibc-based systems) and another related to use cache functions returning multiple typed arrays. Patched versions are now available and should be treated as priority upgrades. ▪️ Go and the eMudhra certificate authority compromise – weak private keys for eight intermediate certificates led to rapid distrust actions by major browsers and an urgent security release in Go that hard-blocks the affected keys in the runtime certificate verifier. ▪️ Node.js Brotli vulnerability (also referred to as Node2Shell or HTTP2Shell) – a critical out-of-bounds write in the Brotli decoder that can result in memory corruption or remote code execution. The same underlying issue affects other runtimes and libraries that incorporate the vulnerable decoder. ▪️ GitLab – a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw impacting self-managed Community and Enterprise instances. Immediate upgrades are strongly advised. ▪️ nginx – several memory-corruption vulnerabilities, some rated critical by F5, that can lead to worker process crashes or potential code execution under specific configurations involving alias/rewrite, map directives, or AIO with SSI.

What made this period notable was the scale and speed of disclosures. Multiple widely used runtimes, frameworks, and infrastructure components required urgent updates, with exploitation attempts emerging soon after public disclosure.

For security and engineering teams the practical takeaway is straightforward: treat these as high-priority patches, verify that updates have been applied consistently across production, staging, containers and any serverless environments, and review related logs for signs of probing or compromise.

The volume and severity of these disclosures serve as a timely reminder of how dependent we remain on a relatively small set of core open-source and infrastructure components - and how rapidly the risk landscape can change when issues surface in them.