Black October: Is the M in CDM finally going full-time?
Patching, or at least vulnerability mitigation (the M in Continuous Diagnostics and Mitigation, or CDM), can no longer be run as a big, slow monolith. Most organizations still run it that way.
In July, I wrote that the Patch Apocalypse was here. Microsoft had just shipped a record 570 fixes in one Patch Tuesday, and AI-driven discovery was about to push volume past what most teams could absorb.
Three months later, 570 looks quaint.
October’s Patch Tuesday topped 1,400 vulnerabilities. Then, from October 19 to 22, came critical PHP flaws touching much of the web, a certificate authority whose private keys could be computed from its public certificates, new Linux kernel problems, and more Cisco exploitation. Social media named it Black October.
The name is catchy but a little misleading. I have taken to calling this month Spooktober from my kid’s influence on me, and this one certainly lived up to the season. But spooky is not catastrophic. As one analysis put it, this was a disclosure wave, not an attack wave. Many of these bugs sat in code for a decade. What changed is how fast they are being found.
Which raises the real question.
Is your organization ready for patching that behaves like a CI/CD pipeline?
What Black October Actually Looked Like
It was not one event. It was a pile-up across the whole stack.
PHP2Shell. Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Asked which versions were affected, SANS answered: “All of them. At least starting with PHP 5.” Wiz found them with AI-assisted tooling. Patches shipped October 21 for PHP 8.2 through 8.5 only, attacks followed within hours, and some agencies told operators to take sites offline if they could not patch. Two days later, Canada’s Cyber Centre flagged a third RCE, CVE-2026-115560, that the release does not fix.
The eMudhra CA failure. Eight eMudhra intermediate CA private keys had so little randomness they could be calculated from the public certificates. Chrome and Mozilla blocked them on October 20, and fixes rippled through Go, Firefox, NSS, Node.js, Linux distributions, and Python’s certifi. Some fixes remove roots outright, breaking legitimate servers. Two days later, eMudhra exited the public TLS business, leaving an estimated 30,000 customer certificates to move.
Microsoft. October’s Patch Tuesday fixed 1,411 flaws, 70 critical, with one exploited zero-day, plus 348 fixes earlier in the month. BleepingComputer tied the record to Microsoft’s own use of AI to find bugs.
Cisco. Secure Email Gateway zero-day CVE-2026-76519 gives unauthenticated attackers root. CISA gave agencies three days to fix it, ending on a Saturday. It was the second exploited email gateway zero-day in about a month, following an exploited Catalyst SD-WAN Manager bypass.
Linux. Six AI-found Zero Day Initiative reports, including two CVSS 9.0 flaws in the kernel’s SMB server, landed on public mailing lists before fixes existed. A month earlier, CISA gave agencies three days to fix three exploited kernel flaws.
Add a CVSS 10.0 GitLab bug, a Node.js RCE, and a poisoned LiteLLM release, and you get the picture.
Notice the deadlines. Three days is becoming the norm, not the exception.
Patching Has Become a Pipeline
In July I quoted Matt Johansen of Vulnerable U: “Patch management is having its DevOps moment.” October proved him right.
The old model had a rhythm: monthly patches, year-long certificates, weekly change boards, and time to test in a lab. That rhythm is gone. Here is what now arrives continuously.
Code fixes. AI is finding decade-old bugs faster than vendors can ship fixes, and Linux kernel guidance reportedly now treats AI-found bugs as already public. Johansen’s advice: exploit timelines have collapsed, and “your patch SLAs should reflect that.”
Certificates. Maximum public TLS certificate life fell to 200 days in March 2026, drops to 100 days in March 2027, and hits 47 days by March 2029. eMudhra showed the flip side: when a CA fails, its certificates move on someone else’s timeline.
Trust stores. The eMudhra fix was a Go rebuild, a Node.js update, a certifi bump, and OS package refreshes. Few organizations know every place a CA bundle is embedded.
Federal timelines. CISA, part of DHS, has written this pace into policy. Binding Operational Directive 26-04, issued in June, replaces the flat KEV deadline with a decision tree: Is the system publicly exposed? Is the flaw in KEV? Can the exploit be automated? Does it give total control? Hit all four and the clock is three days, plus forensic triage. Some internet-facing flaws not yet in KEV land in the three-day tier too. Agencies must be operating on these clocks by roughly early December.
The directive binds only federal civilian agencies, but CISA “strongly encourages all partners to adopt similar actions,” and contractors, FedRAMP providers, and insurers tend to follow. If it faces the internet, assume three days is your clock.
Development teams chose CI/CD and built the testing and rollback to support it. Operations and security teams are having it imposed on them, often on infrastructure never designed to change this often.
Most organizations are not ready. The question is how to buy time to adapt without getting breached in the meantime.
Should We Pull Things Back Off the Internet?
This is the question I hear most from clients: if we cannot patch everything in three days, can we make fewer things reachable?
Yes, and it is overdue. Admin consoles, internal web apps, file transfer servers, backup portals, and forgotten vendor remote access all landed on the internet because it was convenient. Each is now on the same exploit clock as your public website. Pulling them back buys time: a flaw only authenticated users can reach is a problem you schedule, not one you fight on a Saturday.
But the method matters.
“Back to VPN” is not a clean answer. VPN concentrators, firewalls, and SD-WAN controllers are among the most exploited devices of recent years, including this month’s Cisco SD-WAN Manager and PAN-OS flaws. Hiding a hundred apps behind one appliance moves the exposure to that appliance, which becomes your top patching priority. Its management interface belongs off the internet, “which you’ve definitely already done, right?” as Johansen put it.
SSE and zero trust access fit most organizations better. Outbound-only connectors leave no inbound port to scan, and the provider patches the broker, often within hours. You trade some control for a vendor dependency, a trade most mid-sized organizations should make.
SD-WAN helps with segmentation, not invisibility. It limits what a compromised branch can reach. It does not hide a public service.
Some things cannot hide. Public websites, portals, and APIs must stay reachable, which is exactly where PHP2Shell landed. There, breathing room comes from a WAF or CDN that can virtually patch. Cloudflare had PHP rules out before most teams finished the advisory.
The goal is not to hide everything. It is to shrink the list of systems that must be patched in hours to the ones that truly must face the internet.
Giving Teams a Structure That Holds
Reducing exposure buys time. Structure lets teams use it well.
Tier by exposure, not just severity. Set clocks: internet-facing in hours, internal in days, isolated in weeks. Get leadership sign-off before the next Black October, not during it.
Pre-approve the fast lane. If every emergency patch waits for a change board, the process is the vulnerability. Define an emergency change category with pre-agreed testing and rollback.
Know where things live. The hard part of PHP2Shell and eMudhra was finding every PHP runtime, container image, and embedded CA bundle. Software inventory is no longer a compliance artifact. It is the starting line.
Automate certificates now. At 100-day lifetimes, manual renewal becomes an outage generator. Use ACME automation, keep a second CA ready, and lock CAA records to the CAs you use.
Retire what cannot be patched. PHP 8.1 and older got no fix. Older Cisco Unified Communications releases were told to migrate. Every unsupported system is a standing exception someone must defend.
Patch in rings, continuously. Move from a monthly event to a rolling cadence with pilot, early, and broad rings. Smaller changes are easier to test and roll back.
Make patching a job, not a side job. Three-day clocks, weekly releases, and short-lived certificates do not fit between tickets. Expect patch and vulnerability management to become a dedicated team with its own staffing, on-call rotation, and metrics, the way DevOps and SRE did.
Hold vendors to the same clock. Ask MSPs, hosts, and SaaS vendors how fast they handled PHP and eMudhra, and put response times in contracts.
Patch, then hunt. Cisco warned that attackers with root may erase evidence, and several Black October intrusions had run for months. A patch closes the door. It does not tell you who already walked through it.
The View From Here
Black October will get a sequel. The AI tools that found PHP2Shell are pointed at everything else, and certificate lifetimes will keep shrinking on schedule.
The organizations that come through well will not be the ones with the most heroic weekends. They will be the ones that decided in advance what must face the internet, what can hide, and how fast each tier moves.
In July I said to audit your old risk decisions. Now add a second audit: what is on the internet by choice, and what is there by habit?
Breathing room is not something the next disclosure wave will give you. You have to build it.
By: Adam John
Image is AI generated, I’m not that talented with art.
Sources
- The Patch Apocalypse Is Here (Dynaxys, July 2026)
- Black October Is a Disclosure Wave. The Label Hides the Clock. (Forkast via Yahoo Tech)
- Black October: why bugs discovered by OpenAI tech are creating a cyber emergency (Axios via Yahoo News)
- Black October: Many attacks had been running for months (SecurityToday)
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer)
- PHP warns admins of two critical flaws (BleepingComputer)
- Critical PHP Vulnerability (SANS Internet Storm Center)
- AL26-026 Critical vulnerabilities impacting PHP (Canadian Centre for Cyber Security)
- Eight eMudhra CA Keys Compromised (The Hacker News)
- Disgraced Indian cert issuer leaves the cert issuing business (The Register)
- What the eMudhra CA Key Compromise Teaches About CA Agility (Encryption Consulting)
- Cisco patches actively exploited Secure Email Gateway zero-day (BleepingComputer)
- Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation (Infosecurity Magazine)
- Critical Unpatched Linux Kernel Flaws Accidentally Disclosed (Cyber Security News)
- Linux kernel KEV active exploitation research note (Cloud Security Alliance)
- Vulnerable U #188 (Matt Johansen)
- Vulnerable U #189 (Matt Johansen)
