Black October: Compilation as of 23rd Oct

1. Zeabur: Cloud infrastructure breach

Public reporting: October 19, 2026

Zeabur disclosed unauthorized access to internal systems and customer environments following an incident on October 14–15. The investigation identified exposure involving infrastructure credentials, service secrets, customer databases, and platform data.

The incident highlights the risks of long-lived administrative tokens, plaintext credentials, and insufficient monitoring of legitimate access paths. Zeabur subsequently announced plans to wind down its services.

Further reading: Zeabur's October security incident report · Official shutdown announcement

2. OpenCode Console: AI-provider credential exposure

Public reporting: October 19, 2026

OpenCode reported a breach involving an older system supporting OpenCode Console. Approximately 1.4% of Console users were affected, including users who had stored AI-provider API keys on the platform.

Potential consequences include unauthorized model usage, API billing abuse, and exposure of associated credentials. The reported incident concerned Console rather than the open-source coding agent itself.

Further reading: TechCrunch's incident report

3. PingCAP / TiDB Cloud: Unauthorized access and data exposure

Public reporting: October 19, 2026

PingCAP reported that an unauthorized party used stolen service-account credentials to access internal systems between September 9 and October 7. Its investigation identified copied customer records, business and billing information, and encrypted TiDB Cloud API-key values.

The company reported no evidence that data stored in TiDB itself was affected. Customer-specific exposure and the potential usability of some credentials remained under investigation.

Further reading: PingCAP's official security incident report

4. eMudhra: Intermediate CA private-key compromise

Public reporting: October 20, 2026

Researchers reported that eight eMudhra intermediate certificate-authority private keys could be recovered because they were generated with insufficient cryptographic randomness.

An attacker possessing these keys could potentially issue fraudulent certificates chaining to trusted roots. Browser and operating-system trust programs subsequently implemented revocation and blocking measures.

The incident concerns affected intermediate CAs, not evidence that eMudhra's root CA private keys were compromised.

Further reading: eMudhra incident investigation · CERT-In's security advisory

5. PHP2Shell: Critical PHP vulnerabilities

Public disclosure: October 21, 2026

CVE-2026-109618 and CVE-2026-109619

Two critical PHP memory-safety vulnerabilities were disclosed after details leaked ahead of the planned release. Under affected conditions, memory corruption during request processing could enable unauthenticated remote code execution.

The risk extends to applications running vulnerable PHP builds, regardless of whether they use a particular framework. Exploitation attempts were reportedly observed before public disclosure.

Further reading: Check Point's PHP2Shell analysis · AWS Threat Intelligence analysis

6. LiteLLM: AI infrastructure supply-chain compromise

Public disclosure: October 21, 2026

Attackers compromised LiteLLM's release pipeline and published a malicious 1.107.0 release to PyPI and container registries. The affected artifacts contained malware capable of stealing credentials and enabling remote code execution.

The compromise involved developer credentials and unauthorized changes to the release workflow. Exposed secrets could include cloud credentials, environment variables, and AI-provider API keys accessible to affected environments.

Further reading: LiteLLM's official incident report · Datadog Security Labs technical analysis

7. Node.js: Brotli decoder vulnerability

Public disclosure: October 21, 2026

CVE-2026-111497

A flaw in the native Brotli decoder can cause an out-of-bounds memory write when processing crafted compressed input. Successful exploitation may cause memory corruption and potentially remote code execution.

The Node.js project included the fix in its October 21 security releases for the 22.x, 24.x, and 26.x release lines.

Further reading: Node.js October 21 security releases

8. GitLab: Critical regular-expression compiler flaw

Public disclosure: October 21–22, 2026

CVE-2026-110264

An integer overflow in GitLab's regular-expression compilation path could permit unauthenticated remote code execution on vulnerable self-managed instances. The vulnerability received a CVSS score of 10.0.

A compromised GitLab server could expose source code, CI/CD secrets, deployment credentials, and other infrastructure assets.

Further reading: GitLab's critical patch release · CERT-EU technical advisory

9. State Bank of India: Reported customer data leak

Disclosure date: Unverified

Dark-web claims attributed to a threat actor reportedly linked SBI customers to exposed personal and loan-application information. The authenticity, scope, and provenance of the alleged dataset require confirmation from SBI or an appropriate authority.

If customer information was exposed, the principal risks would include targeted phishing, identity fraud, and social engineering.

Further reading: SBI's cybersecurity guidance · CERT-In

Verification status: The specific data-leak claims have not been established by the sources cited here.

10. Plex Media Server: Reported exploitation

Disclosure date: Unverified

Reports using the name “Plex2Shell” describe alleged exploitation of internet-exposed Plex Media Server installations, including claims of command execution, reverse shells, and cryptocurrency-mining payloads.

The exact vulnerability, affected versions, and scope of exploitation require incident-specific evidence before these claims can be treated as confirmed.

Further reading: Plex security announcements · CISA cybersecurity advisories

Verification status: A primary advisory confirming the specific “Plex2Shell” claims has not been established.

The takeaway

Black October highlights how failures in software distribution, cryptographic infrastructure, and credential management can create systemic risk. A vulnerable runtime can expose an application, a compromised package can expose an entire development environment, and a compromised certificate authority can undermine trust across many services.

These disclosures do not establish a single coordinated campaign, nor does every reported incident have the same level of verification. The operational lesson is to combine rapid patching with reliable intelligence, credential hygiene, and evidence-based incident response.

This compilation reflects information available as of October 23, 2026. Disclosure dates and incident details may change as investigations progress.