Worst month in cybersecurity 2026? What October shows

October 2026 has no official ranking as the worst month in cybersecurity, but it did bring an unusual cluster of unrelated, serious disclosures between 5 and 23 October. The ones most site owners must act on are PHP2Shell (update PHP, restart workers), GitLab, Node.js and Plex. Check which of them you run, then follow the vendor's fixed version.

What actually happened in October 2026?

The table below keeps one row per incident, with the claim limited to what the affected party or agency published. Most rows are vendor accounts of their own incident, so we label them as such.

Who is affected, and who is not?

Most readers are affected by one row, not all of them. A WordPress or WooCommerce site may be touched by PHP2Shell, because the bug sits in the PHP engine under the application. Whether yours is affected depends on the PHP runtime that serves it: a visible version below the fixed release is detected, a hidden version or possible vendor backport is unknown, and only a fixed package or build identifier plus a restart is confirmed by owner evidence (PHP). Our guide to fixed PHP versions has the fixed versions and the host question.

The platform incidents are different. Railway, Zeabur and PingCAP each describe stolen internal credentials. If you have no account with them, those rows are not yours. If you do, read each company's own notice for what was exposed. Rotation walk-throughs exist for Railway secrets, Zeabur customers and TiDB Cloud keys. PingCAP lists account details, SQL editor content and billing information as well as encrypted API-key values.

Why does it feel like one event when it is not?

The sources do not describe one campaign. They describe at least five separate causes:

• A memory-safety bug in PHP, which Wiz says its Wiz Research team uncovered (Wiz). PHP's advisory lists external reporters and, separately, the developers who fixed it.
• A regular-expression bug in GitLab, which GitLab's advisory says was reported through its HackerOne bug bounty program.
• A release pipeline that LiteLLM says was abused to publish artifacts built from a lookalike repository. LiteLLM says the official source tag was clean and that all previous versions are safe (LiteLLM).
• Stolen service credentials at platform companies, each described by that company.
• Compromised private keys at a certificate authority. Mozilla says keys for eight eMudhra intermediate certificates were compromised (Mozilla).

Railway says it believes its incident is part of a series of attacks recently targeting platform companies (Railway, 21 October). That is Railway's belief in its own disclosure. We did not find an independent source that confirms it.

Several viral claims do not survive a check against the primary sources. PingCAP's report gives no data-volume or extortion figure, so repeat none. For eMudhra, the certificate count in Mozilla's post is eight: private keys for eight intermediate certificates were compromised. The only other count we found is one commenter's on Mozilla's incident bug: 107,107 certificates signed with six of the keys were logged on 20 and 21 October, nearly all proofs of concept for google.com. Attribute it to that commenter, and add no other claim about the keys. And the Japan claim is a quote, not a declaration: the party's own page says its cybersecurity headquarters chair described an emergency situation at a meeting on 9 October, and that the government office did not yet know whether the incidents were related (LDP, 14 October).

SafePay's "at least 600" is the wording of the joint advisory itself, which says the group has impacted at least 600 separate victims. The advisory does not say whether the figure comes from the group's claims or from investigators' counts, so treat it as an estimate, not a victim list. The defensive steps for exposed VPNs and edge devices are on their own page.

Was any of it exploited?

It depends on the row, and the labels matter.

How do I fix it?

If a host manages your stack

Send support the PHP question and keep the answer:

For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed package, build or backport identifier, confirm that all workers serving it have been restarted or replaced, and say whether I need to redeploy or change a setting.

• Get the answer in writing, naming your domain.
• If you store secrets on Railway or Zeabur, follow each company's own rotation instructions: Railway's 22 October report and Zeabur's report.
• If you use TiDB Cloud, follow PingCAP's 20 October customer guidance: organization owners inventory the API keys, create a new key, update and verify what uses it, then delete the old key.

If you run the software yourself

• PHP: install your distribution's fixed package, then restart PHP-FPM or Apache. Details are on the PHP2Shell page. PHP's separate notice dated 23 Oct 2026 (php.net, CVE-2026-115560) suggests setting session.upload_progress.enabled=0 until the next regular bugfix release. PHP says the issue needs an unusual combination: session.serialize_handler set to php_binary or php_serialize in configuration, switched to php with ini_set() before session_start(), with upload progress still enabled. Applications that never change the serialize handler at runtime can keep the feature enabled, and if you already applied the setting for CVE-2026-109619, PHP says to keep it.
• GitLab: upgrade to the fixed patch for your line, as GitLab's notice lists.
• Node.js: move to 22.23.4, 24.22.1 or 26.12.1 (Node.js), then rebuild and redeploy images. The Node.js patch details explain each line.
• Plex: update to 1.43.3.10861 or later (Plex). Plex says to assume an older server reachable from the internet may be compromised.
• LiteLLM: if you ever started Python with 1.107.0 or ran the affected image digest, LiteLLM says to treat the environment as compromised. Follow its cleanup steps in its order (it says not to start with pip install), rebuild images and virtual environments from scratch, then rotate everything the host could reach. Cached copies count too.

The running list of October incidents keeps these rows current, and the checklist for this week puts them in order. The other incident write-ups cover each in depth.

Am I affected? A three-state self-test

What would a scan tell me?

The free scan reads the stack your site serves and matches each version to known vulnerabilities. One per domain, no card. It is a lookup: it can say a version is affected, not whether your setup is exposed. The full scan is $100 per scan.

What is the bug class behind these, without the exploit?

The product bugs are memory-safety and parsing errors reachable from the network: PHP's engine, GitLab's regular-expression compiler, Node.js's Brotli decoder. The platform incidents are about credentials and trust: secrets stored with a provider, a release pipeline, and keys at a certificate authority. This page links the vendors' advisories for conditions and fixes and reproduces no exploit material, because you do not need it to patch.