Lessons from cybersecurity Black Week
Our summary
A single October week turned into a stress test for security teams, as several unrelated but severe incidents landed almost simultaneously. Among them: two critical memory-safety bugs in PHP core dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2, affecting PHP 5.4–8.5.11 and fixed in 8.5.12/8.4.27/8.3.36/8.2.35); prematurely disclosed, unpatched Linux kernel flaws in the KSMBD SMB server (ZDI-CAN-33549 and ZDI-CAN-33774, both CVSS 9.0); a supply-chain compromise of the LiteLLM proxy, where attackers published a malicious PyPI release (1.107.0) and tainted container images carrying a credential stealer plus RAT; a Node.js/Brotli decoder bug nicknamed "Node2Shell"/"HTTP2Shell" (CVE-2026-111497, high severity, underlying Brotli issue CVSS v4.0 9.2), patched in Node.js 22.23.4, 24.22.1 and 26.12.1; a maximum-severity GitLab vulnerability (CVE-2026-110264, CVSS v3.1 10.0) tied to regex compilation and fixed via an out-of-band release; and a certificate-authority trust failure involving compromised eMudhra/emSign intermediate CAs still trusted by some Python tooling, prompting urgent updates to certifi, pip, uv and several Python releases. ESET notes that despite the alarming severity ratings, real-world exploitation varied widely — PHP2Shell proved harder to weaponize than feared, while LiteLLM's compromise demanded full incident-response treatment rather than a simple update. The cluster of incidents underscores how defenders must prioritize by actual exposure and exploitability rather than headlines or CVSS scores alone, and highlights the value of layered detection to cover the gap before every affected system is patched.
Below is the opening; the full story is at ESET WeLiveSecurity.
From ESET WeLiveSecurity
The week leading up to October 25, 2026, was every cyber defender’s nightmare: a barrage of critical vulnerabilities in PHP and the Linux kernel, a compromised LiteLLM release, a maximum-severity flaw in GitLab, a Node.js Brotli flaw, and a certificate authority incident affecting TLS trust.
A few years ago, a backlog like this would have filled a defender’s to-do list for a whole month. In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October. AI-assisted research helped uncover at least two of these flaws: PHP2Shell and the Brotli bug. On top of the breakneck patching pace, security teams faced mounting pressure to deliver status reports to other departments, management, customers, and the media.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.