> ## Content Index > Fetch the complete content index at: https://connortumbleson.com/llms.txt > Use this file to discover other available public pages before exploring further. # Black October 2026 - URL: https://connortumbleson.com/2026/11/09/black-october-2026/ - Published: 2026-11-09T03:30:00.000Z - Updated: 2026-11-09T03:30:00.000Z - Description: October came and went and outside of rain on Halloween we had tons of hacks & vulnerabilities among software & businesses. - Author: Connor Tumbleson - Tags: Technology ![](https://connortumbleson.com/content/images/2026/10/photo-1635275074889-3af1e398823e--1--1.jpeg) Photo by [Wouter Supardi Salari](https://unsplash.com/@supardisign?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Roughly around the middle of October we started hearing the rumors that a very severe PHP vulnerability had been discovered. It was so severe the team pre-announced the release of it and one core member unofficially suggested the most secure course of action was to turn off the servers prior to the patch being released. This created quite the internal panic and we set off a schedule to jump into action the next day and upgrade every single project we had as soon as possible grouping into teams to work in parallel. The patches came out and I upgraded my assigned things between work & hobby throughout that day - everything was secure. It felt good to be on supported versions of the PHP language, because patches were available. A few times in my career I've had to fight with clients on the importance of upgrading tooling which was never fun. It was situations like that which helped reinforce the choices we made in the past were worth it. I can't imagine being on an out of date version of PHP and debating how to secure your application the quickest. ![](https://connortumbleson.com/content/images/2026/11/meme-4.png) A meme regarding the private key of the eMudhra certs. This was kinda the 2nd big thing that struck in October with the 1st being the eMudhra intermediate certificates being recovered. They weren't recovered from a theft or hack, but by just remaking the key(s) as their private component was a number less than 255. It's tough to understand the scale of this without really understanding how technology works under the hood. We can roughly summarize it all by saying the world runs on trust. We trust companies to keep things secure so our traffic can be encrypted properly. Instead of a certificate having a private key backed by a number hundreds of digits in length this time roughly 30,000 certificates were backed by the number that could be broken in seconds on any computer. ![](https://connortumbleson.com/content/images/2026/11/keychain-access.png) Looking at trusted certs on Mac via Keychain Access app. This is bad because most devices have what is called a "trust store" where trusted certificates are kept in order to validate the security of other domains. There is less than 100 companies in the world that are trusted to hold a root certificate, when you reduce that list to companies that have a certificate in Microsoft, Mozilla, Chrome and Apple combined you land at less than 40. eMudhra was one of those \~40 companies until this [incident](https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business?ref=connortumbleson.com). It'll take years to purge this certificate from things like embedded devices, IoT devices and more. Beneficially if you are a researcher or attacker you have a large chunk of years till it would have expired to abuse systems still holding an untrusted root certificate. October didn't end there though, we had [Brotli](https://github.com/google/brotli?ref=connortumbleson.com) (compression algorithm) have a nasty bug that could be abused for code execution. Since Brotli is packed into tooling from web browsers to programming languages emergency updates for a bunch of stuff was needed again. GitLab had a [vulnerability](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/?ref=connortumbleson.com) in a dependency that could result in remote code execution requiring another rush to update tooling. LiteLLM had their [supply chain breached](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/?ref=connortumbleson.com) and malicious versions of their package were released on PyPI (Python) and Docker. Clearly the rise of powerful AI is making it a bit more easy to breach software. It doesn't end in October though with software. We had: - [Binance](https://www.reuters.com/world/binance-says-hackers-used-fake-job-interview-compromise-computer-before-63-2026-11-03/?ref=connortumbleson.com) suffered a massive multi-billion dollar hack. - [\~700 French Supermarkets](https://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/?ref=connortumbleson.com) were all targeted to defrost the refrigerators. If this is the new normal every piece of software is going to need to harden its security quick.