CyberWatch Weekly: Black October, The Month the Internet Could Not Keep Up
October 2026 will be remembered less for any single breach than for the pace at which they arrived. Within three weeks, a pair of flaws in the language that runs most of the web was being exploited before the world was told it existed. Japan’s government convened every ministry it has because no individual company’s response was equal to what was happening across its economy. And India’s largest bank told the stock exchanges that its customers’ records were circulating on the dark web, while conceding it did not yet know how they got there. Three incidents, three continents, one shared problem. Here’s a closer look at the month that earned its name.
PHP2Shell: Four Days of Exploitation Before the World Was Told
On 21 October, PHP shipped emergency patches for two critical vulnerabilities. CVE-2026-109618 is an out of memory handling bug. CVE-2026-109619 is a use after free error. Both scored 9.2 out of 10, and both allow an attacker to run code on a server without ever supplying a password. PHP underpins roughly 70 percent of known websites, so the blast radius was effectively the internet.
The patches themselves arrived quickly enough, covering versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for 7.4, 8.0 and 8.1. Anything on 8.1 or older will not be fixed at all. What went wrong was everything that happened before the announcement. Amazon detected an exploitation attempt against its MadPot honeypot on 17 October, four days before disclosure, while the flaws were still under embargo, from an anonymised IP address. CJ Moses, CISO of Amazon Integrated Security, concluded PHP2Shell was already being broadly exploited in the wild and told organisations to investigate suspicious activity back to 17 October rather than assume the clock started at disclosure. Details of the flaws leaked two days early. Working exploit code circulated a day before the fix.
When the announcement finally landed, the response was immediate. Cloudflare chief executive Matthew Prince logged tens of thousands of exploitation attempts within 45 minutes, hundreds of thousands within two hours, and millions after that. Wikipedia disabled systems. The Internet Archive went briefly offline. Government services across the Netherlands and Finland took sites down pre-emptively rather than risk staying up. Citing VirusTotal, BleepingComputer counted more than 5.1 million PHP hosts still exposed online.
PHP’s own guidance is blunt: every installation serving web requests is at risk, and the risk is highest for mod_php, where a demonstrated exploit fires before any application code runs at all. Its interim mitigations, which it stresses are incomplete, include capping memory limits and request sizes and disabling session upload progress tracking.
Japan Calls In Every Ministry as Corporate Breaches Mount
On 8 October, the Japanese government did something it had not done before. It convened all ministries and agencies in a single coordinated response to a run of attacks on private companies. Cybersecurity minister Toshiharu Furukawa said the government would press firms to address vulnerabilities promptly and adopt multifactor authentication, and instructed participants to report leaks to the National Cybersecurity Office so the picture could be managed centrally. The NCO’s assessment was that attacks on private firms began rising in August, that the perpetrators remain unknown, and that countermeasures should proceed on the assumption that attackers are using artificial intelligence.
The numbers behind that meeting explain the urgency. Monogatari Corp, which operates the Yakiniku King barbecue chain, lost over 10 million customer records through its reservation and rewards app. Karaoke operator Daiichikosho reported 8.72 million customer and employee records compromised after a subcontractor’s computer was found infected with malware. Car-sharing service Times Car exposed around 6.6 million account records, including images of 1.6 million identification documents such as driver’s licences. Convenience store operator Lawson disclosed roughly 2.16 million account IDs. Survey firm GMO Research and AI lost 948,498 member records, and attackers converted member reward points into Amazon gift card codes in 611 separate transactions worth ¥2,869,500, which the company has pledged to reimburse in full.
Running alongside all of it, the National Police Agency confirmed that the Qilin ransomware group has struck 53 Japanese companies spanning manufacturing, services, construction, hospitals and schools.
Security firm LAC’s recommendation cuts to the heart of it: organisations should minimise what they retain, purging records of former members and terminated customers promptly. Times Car’s exposure included licence images belonging to people who had already closed their accounts.
Source: Jiji Press, The Mainichi, Anadolu Agency, AsiaToday
SBI Confirms Records on the Dark Web, But Not Where They Came From
State Bank of India notified the stock exchanges on 21 October that it had identified 3,897 customer records containing personally identifiable information within roughly 375,000 records found circulating on the dark web. The alert did not come from the bank’s own monitoring. It came on 16 October from three separate parties: SBI’s threat intelligence service provider, the Defence Cyber Agency, and CERT-In.
What was exposed is specific. Registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, alongside branch details, customer information file identifiers, lead IDs, and metadata attached to loan and lead records. A CIF identifier is the unique number a bank uses to hold a customer’s consolidated relationship and account information in one place. Lead IDs typically mark prospective customers moving through a bank’s sales and lending processes. Together they describe not just who someone is, but what they were asking the bank for.
The trail began with a threat actor using the name Siriusim, who posted on BreachForums on 16 October advertising 375,000 CSV rows and 2,722 PDF documents said to include loan applications, supporting documents, account opening forms and addresses. The monitoring account CyberPulse flagged it. SBI has since activated its cyber incident response and containment protocols and engaged an independent CERT-In empanelled agency to assess the damage, and says the incident has had no material impact on core operations, financial performance or business continuity.
The unresolved part is the one that matters. The bank states plainly that a detailed investigation is still required to establish the data’s authenticity, completeness, source and extent. Nine days after disclosure, India’s largest lender can confirm its customers are exposed without being able to say how.
Source: Hindustan Times, Times of India, TechRadar
Conclusion
The case for calling it Black October is not the size of any one number. It is that in every instance, the defenders were working from information that had already gone stale. PHP’s maintainers lost four days before they could warn anyone. Japan’s ministries met in October to address a pattern the NCO traces back to August. SBI learned of its own exposure from three outside agencies. The month’s real finding is that detection is no longer the hard part. Knowing in time is.
Stay vigilant and informed, tune in next week for more updates in InfosecTrain’s CyberWatch Weekly!