"Black October" Cybersecurity Crisis Dominates
A torrent of major security incidents across the last 48 hours — from a CVSS 10.0 GitLab RCE flaw to npm backdoors, the eMudhra CA certificate compromise, and PwC's 590GB breach — has been dubbed 'Black October,' with analysts warning AI is turbocharging exploit discovery and shortening patch windows to zero.
What we know
The wave of incidents is being called 'Black October' across multiple sources. An account on X amplified a comprehensive timeline noting year-level incidents are now occurring hourly: a SubQuery npm backdoor (Oct 5), IDCF ransomware hitting 495 orgs (Oct 7), a malicious TensorLake npm (Oct 8), and escalating through the month. The critical vulnerability is GitLab's CVE-2026-110264 (CVSS 10.0), enabling unauthenticated remote code execution across 12 years of releases. The eMudhra CA certificate flaw is especially acute for crypto: Another account on X retweets CertiK warning crypto bots and exchange apps remain exposed even after browser-level browser patches. another account on X via trader1sz issued a full DeFi revocation alert — avoid smart contracts for 7–14 days. On the AI angle, another account on X notes 'one prompt' is now enough to exploit a previously too-complex bug, and Amazon found a PHP2Shell exploit attempt four days before an AI-discovered vuln was publicly disclosed, implying potential leakage of embargoed vuln data. Another account on X floats a conspiracy: top hackers work for governments, and the crisis is being used to push surveillance and crypto custody agendas. Another account on X captured the dark humor: 'can't own stonks, can't own crypto, can't browse the internet — everything is hacked.' another account on X argues this makes compute and energy a national security issue. Another account on X retweets a new free live-incident tracker site with RSS + LLMs.txt.
How the story developed
A torrent of major security incidents across the last 48 hours — from a CVSS 10.0 GitLab RCE flaw to npm backdoors, the eMudhra CA certificate compromise, and PwC's 590GB breach — has been dubbed 'Black October,' with analysts warning AI is turbocharging exploit discovery and shortening patch windows to zero.
A historically unprecedented wave of critical CVEs is dropping hourly, prompting Asia-wide PHP emergency alerts, CZ warnings, and widespread alarm about the viability of the internet itself.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.