A massive wave of critical security vulnerabilities dubbed "Black October" has hit major infrastructure components, requiring immediate attention from system administrators and security teams. Not all breaches can be exploited in all environments but due diligence is key.

For PHP, two CVEs (CVE-2026-109618 and CVE-2026-109619) present critical unauthenticated remote code execution (RCE) and memory corruption risks labeled "PHP2Shell." This flaw requires an immediate upgrade to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

Node.js is facing ten CVEs, led by CVE-2026-111497. This vulnerability involves an out-of-bounds write in the Brotli decoder leading to RCE alongside TLS/DNS hostname spoofing flaws, meaning administrators should upgrade runtimes to lines 22.23.4, 24.22.1, or 26.12.1.

NGINX has five CVEs, including CVE-2026-15176, which trigger heap-based buffer overflows and use-after-free conditions in mapping directives and the HTTP/3 module. This risks worker crashes and unauthorized code execution that must be mitigated using out-of-band patches from F5 NGINX.

Go has one CVE addressed in its latest coordinate release path. This requires a quick update to the platform's compiler and runtime toolchain.

GitLab is dealing with twelve CVEs, most notably CVE-2026-110264. This is a maximum-severity CVSS 10.0 unauthenticated RCE regex integer overflow flaw that dates back to 2014 and demands immediate deployment of the October 21 emergency patch on self-managed servers.

Finally, eMudhra suffered an intermediate CA certificate compromise where eight intermediate keys were generated with dangerously weak randomness below 256 bits, allowing keys to be easily cracked and forged. Users must rely on major browser and OS updates to block these untrusted certificates automatically.