Black October Wasn't an Attack Wave. It Was a Warning.

Last week a string of security failures hit software that much of the internet runs on. Security experts started calling it “Black October.” The name stuck because it felt like a blow. But the more important story is quieter, and it touches nearly everyone who uses a website, a bank, or a government service. For policymakers and the reporters who cover them, it raises the questions: are we doing all we can to keep that software safe and who is responsible for doing so?

What Happened

On October 21, the team behind PHP, a programming language that runs roughly 70 percent of websites by some estimates, rushed out emergency fixes for two critical flaws. Either one lets an attacker take over a web server remotely, with no password. The National Security Agency (NSA) told organizations to update immediately or take affected systems offline, and governments and companies around the world, including in the U.S. and U.K., briefly took dozens of websites offline as a precaution.

Researchers at Wiz and Calif found the flaws in August using artificial intelligence tools from OpenAI and Google. 404 Media reported that the security company Chainguard published fixes hours before the official disclosure, drawing criticism that it could have tipped off attackers. Cloudflare said it saw thousands of attempts to exploit the flaws in the ten hours before the public announcement and millions soon after.

The same stretch brought other failures. A company that vouches for website identities was found to have weak digital keys, forcing roughly 30,000 certificates to be replaced. A developer platform, Railway, told all customers to change their secret keys after a breach.

What Most Coverage Misses

This was mostly a wave of discoveries, not a wave of new attacks. One analysis called it “a disclosure wave, not an attack wave.” Several breaches reported that week began months earlier, including one that exposed California student data from May to September.

That doesn’t mean nothing was hit. Axios reported disruptions to developer platforms, data leaks at public schools, break-ins at public companies, and banks detecting unauthorized third-party access inside customer accounts, though many organizations have so far avoided major real-world harm.

That points to two problems at once. Flaws are being found faster than ever, and attackers were already inside many systems before anyone knew to look. Former Cybersecurity and Infrastructure Security Agency (CISA) director Chris Krebs told CNBC that roughly 3 percent of all critical vulnerabilities ever discovered were found in the last month.

Why It Matters

The usual routine is to find a flaw, quietly tell the maker, and wait for a fix. That routine assumes a slower world. This time the fix and the attacks arrived almost together, and every organization running old software got less time. One scanning firm, Modat, estimated that 79 percent of the PHP services it could identify run on versions that no longer get official fixes.

Who Is Actually Responsible?

Most of the systems involved in Black October are privately owned and run: the open-source PHP project, the companies that operate websites, and internet services like Cloudflare that help defend them. The government’s role is part defender (of its own systems, through agencies like CISA and the NSA), part coordinator, and setter of expectations. Cyber defense is a team sport, but the public deserves – and will ultimately demand transparency around the leaders and the process. 

Answers to have on hand: 

• Do you know where this kind of software runs, including on systems run by contractors and vendors?

• Who is responsible for updating it, and how fast can that happen on a weekend?

• Which public-facing services would go dark if you had to take them offline?

• Is anyone looking backward for intrusions that began before the fix?

The Takeaway

Black October was not the big attack. It was a preview of how fast the next one could arrive. Our dependence on software will only grow, so we need visible assurance that its defenders, in government and industry, are as fast and capable as the criminals and adversarial governments attacking it.

Sources: Axios; CNBC; 404 Media; Forkast; SecurityToday; The Hacker News; TechCrunch; Wikipedia.