“Black October” Fact-Check: What Really Happened in Cybersecurity (20–23 Oct 2026)

Last updated: 23 October 2026. This is a fast-moving story. We checked every item against vendor advisories, official statements and established security outlets (sources at the end) and will update this page as facts change.

Since 22 October a list has gone viral on X and Instagram calling the past two days “Black October”, “the most serious 48 hours in cybersecurity history”. It names 27 incidents, from the PHP2Shell flaw to a data leak at State Bank of India. We checked every one of them. Here is what actually happened, what was exaggerated, and what you should do about it.

Step-by-step follow-up guides: eMudhra certificates: is your website affected? · SBI data leak: how to protect yourself · UpdraftPlus backdoor: check your WordPress site

The short version

• None of the 27 items is invented. Every incident on the list is real and reported by reputable sources.
• Many are exaggerated or older than 48 hours. Several attacks happened weeks or months ago and were only disclosed this week (AOMEI ran in May–July, the Medi-Cal breach dates to 2025, the Palo Alto flaw to May). It was a wave of disclosures, not 48 hours of new attacks.
• Three items matter directly in India: PHP2Shell (patch PHP now), the eMudhra certificate-key failure (check your TLS certificate chain before 27 October) and the State Bank of India data exposure (watch for scam calls).
• The common thread is stolen secrets and supply chains: API keys, environment variables, update servers and developer accounts were the way in for Railway, LiteLLM, OVHcloud, UpdraftPlus and AOMEI.

Fact-check: all 27 items at a glance

Verdicts: Confirmed = accurate as posted. Partly true = real, but the viral wording overstates it. Older = real, but it happened or started before 20 October.

What matters most for Indian organisations

1. PHP2Shell: patch every PHP server now

Two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a web server without logging in. They affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. Cloudflare’s CEO said the network saw thousands of exploit attempts in the 10 hours before disclosure and millions afterwards, and Amazon reported an attempt as early as 17 October. Japan’s Prime Minister asked operators to patch the same night, and banks, airlines and ministries in Japan temporarily took services offline.

Full details: PHP2Shell explained, how to check and patch a Linux server and the 15-minute checklist for WordPress on shared hosting.

2. eMudhra: check your TLS certificate chain before 27 October

eMudhra, an Indian certificate authority, generated the private keys of eight intermediate certificates (six for TLS, two for code signing) with too little randomness. Anyone could calculate them from the public certificates; researchers noted that one key was simply the number 4. eMudhra blames a flaw in an April 2025 key ceremony. Chrome and Firefox blocked the intermediates on 17 October, Microsoft on 20 October and Apple by 22 October. Mozilla has removed the emSign ECC Root CA – G3, and Chrome’s removal is expected to reach devices around 27 October. CERT-In issued advisory CIAD-2026-0050, and MeitY has formed a team to investigate.

Indian digital signature certificates (DSC) and eSign are not affected, according to MeitY and eMudhra; they are regulated separately by the Controller of Certifying Authorities.

What to do: if any of your websites or APIs use an eMudhra/emSign TLS certificate, check the chain and replace the certificate with one from another hierarchy now. Update ca-certificates on Linux servers, and rebuild Go applications with Go 1.27.3 or 1.26.10.

# Show the issuer chain of a site's certificate
openssl s_client -connect your-domain.com:443 -servername your-domain.com -showcerts </dev/null 2>/dev/null | grep -E "s:|i:"
# Look for "emSign" in the issuer (i:) lines

3. State Bank of India: expect scam calls, never share OTPs

On 21 October SBI told the stock exchanges about a suspected exposure of customer data on the dark web. A preliminary review of about 375,000 records found 3,897 customer records with personal information: names, mobile numbers, dates of birth, gender, email and postal addresses, branch/CIF IDs and loan-lead details. Account numbers, balances, passwords, OTPs, card data, PAN and Aadhaar were not listed. SBI was alerted on 16 October by its threat-intelligence provider, CERT-In and the Defence Cyber Agency, and has engaged a CERT-In-empanelled firm. It says the authenticity and source of the data are still being investigated and that operations are not affected.

What SBI customers should do: be extra careful with calls, SMS and emails that use your name, date of birth or address to sound genuine. SBI will never ask for your OTP, PIN or password. Report phishing to report.phishing@sbi.co.in, and report fraud on the 1930 helpline or at cybercrime.gov.in.

4. WordPress sites using UpdraftPlus

Attackers broke into TeamUpdraft’s website on 17–18 October and stole UpdraftCentral connection keys. From 18 October they used those keys to create admin accounts and install backdoor plugins disguised as maintenance tools on connected sites. If you use UpdraftPlus: update to 1.26.13 (free) or 2.26.13 (Premium) or later, delete old UpdraftCentral keys under Advanced Tools, check for unknown admin users and plugins, and rotate the credentials for your remote backup storage.

5. AOMEI Backupper users

AOMEI’s update servers handed out malware during three short windows on 28 May, 16 July and 20 July 2026. Victims were found in six countries, including India, mainly in IT services, telecom and higher education. AOMEI has secured its servers, but that does not clean machines that were already infected. If you ran AOMEI Backupper in that period, check for the published indicators of compromise and unknown scheduled tasks or remote-access tools (Radmin).

Patch and action checklist

The bigger lessons

Secrets are the new perimeter

Railway, Zeabur and TiDB Cloud all lost API keys or environment variables. LiteLLM and OVHcloud were poisoned through stolen developer accounts, and UpdraftPlus through stolen connection keys. If a platform you use is breached, assume every secret stored there is exposed. Keep an inventory of where your keys live, use short-lived credentials where possible, and practise rotating them before you need to.

Trusted updates can be the attack

AOMEI’s update server, LiteLLM’s package and OVHcloud’s release files were all official channels. Pin versions, verify checksums or signatures, and delay non-security updates for a day or two so poisoned releases are caught before they reach you.

AI is now part of real attacks

CrowdStrike reported four threat groups using AI agents to automate intrusions; one breached at least 15 healthcare organisations in Argentina. Criminals abused the AI-agent tool Cairn to break into over 100 companies. Axios reported that major US banks are seeing third-party AI agents log in to customer accounts with customers’ own credentials. Faster, automated attacks shrink the time you have to patch, which makes basics like asset inventory, MFA and patch SLAs more important, not less.

Read the dates, not just the headlines

Viral lists are useful alerts but poor risk assessments. Several “Black October” items were weeks or months old, and some numbers (like “3.4 million downloads a day”) describe something different from what readers assume. Prioritise by what you run, whether it is exposed to the internet, and whether exploitation is confirmed.

Frequently asked questions

Was this really the worst 48 hours in cybersecurity history?

That is an opinion, not a finding. The incidents are real, but many started earlier and were only disclosed this week. What is unusual is how many serious disclosures landed at once, led by PHP2Shell.

Is my WordPress site at risk?

Possibly, from two directions: PHP2Shell (check your PHP version with your host) and the UpdraftPlus key theft (if you used UpdraftCentral). Use our shared-hosting checklist and our free website safety check.

Was my SBI account hacked?

SBI has not reported any access to accounts, passwords or card data. The exposed information is personal and contact data, which scammers can use to sound convincing. Treat unexpected calls and messages with suspicion and never share OTPs.

Are Indian digital signatures (DSC) affected by the eMudhra issue?

No. According to MeitY and eMudhra, DSC and eSign services run on separate infrastructure regulated by the CCA. The problem affects certain eMudhra/emSign TLS and code-signing certificates used by websites and software.

Need help?

If you are not sure which of these affect you, we can check your servers and websites and help you patch them. See our Linux server hardening & audit and VAPT services, or contact us. For ongoing hardening, use our free Linux server hardening checklist.

Sources

• Help Net Security: PHP2Shell patched
• watchTowr: PHP2Shell FAQ
• The Register: attacks began before disclosure
• Nippon.com/Jiji: Japan’s response to PHP flaws
• W3Techs: PHP usage statistics
• The Hacker News: eight eMudhra CA keys compromised
• The Hacker News: State Bank of India data leak
• Business Standard: SBI customer data on the dark web
• EdWeek: California student data breach
• Railway: security disclosure
• Zeabur: October 2026 security incident
• The Hacker News: LiteLLM supply-chain compromise
• The Hacker News: critical GitLab flaw
• SecurityWeek: Cairn abused to hack 100+ organisations
• The Register: Ahold Delhaize cyberattack
• Onamae.com: official notice (Japanese)
• Privacy Guides: Signal calling vulnerability
• The Hacker News: NGINX fixes
• FoxIO: HTTP/3 QPACK amplification research
• BleepingComputer: Plex2Shell attacks
• Cybersecurity Dive: FBI/CISA SafePay advisory
• Help Net Security: ransomware groups exploit GlobalProtect
• BleepingComputer: Bullhorn outage
• OODA Loop: Paradigm Healthcare / Medi-Cal breach
• BleepingComputer: stolen UpdraftCentral keys
• BleepingComputer: AOMEI update servers hijacked
• TheStreet: Meta Muse privacy loophole
• The Hacker News: hijacked Tor exit relays
• Dark Reading: TiDB breach
• SecurityWeek: OVHcloud CLI stealer
• Help Net Security: Siemens Software Center exploitation
• BleepingComputer: Lazarus Operation FlashHole
• Node.js: October 2026 security releases
• Cybersecurity Dive: CrowdStrike on agentic AI attacks
• Axios: banks detect unauthorised AI agents
• Forkast: “Black October” is a disclosure wave