October 2026, Link by Link: What the Record Connects and What It Does Not
The October 2026 cybersecurity incidents, checked against primary sources.
October 2026 was a chaotic month of breaches and security fixes. Some of the incidents are connected, upstream or downstream, through a shared component or a shared release. Others are separate incidents. This note takes each incident in turn and checks it against the primary source: the project's own advisory, the Common Vulnerabilities and Exposures (CVE) record, or a government catalog. Where a source states a link between two incidents, we report it. Where no source does, we say so. All times are Eastern Time (ET). Every source was checked on Oct 28.
Timeline
| Date and time (ET) | Event | Source |
|---|---|---|
| Apr 30, 2025 | eMudhra runs the key generation ceremony it later links to its certificate incident | eMudhra |
| Feb 27, 8:10 a.m. | A change is committed to the Brotli source code | GitHub |
| Oct 21, about 10:00 a.m. | PHP (PHP: Hypertext Preprocessor) 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released for CVE-2026-109618 and CVE-2026-109619 | PHP Foundation |
| Oct 21, 3:26 to 3:27 p.m. | Brotli 1.0.10, 1.1.1 and 1.2.1 are released, the first Brotli releases after the Feb 27 change | Brotli releases |
| Oct 21 | Node.js 22.23.4, 24.22.1 and 26.12.1; GitLab 19.5.1; the alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on PHP | Node.js, GitLab, CISA |
| Oct 22, 6:11 a.m. | Bun 1.4.4 is released with Brotli 1.2.1 | Bun release, Bun commit, Bun advisory |
| Oct 22, 11:11 p.m. | Ruby posts its fixes: 4.0.9, 3.4.12 and 3.3.13 | Ruby |
| Oct 23 | The Bun and Envoy advisories for the Brotli flaw | Bun, Envoy |
| Oct 25, 3:06 p.m. | Microsoft publishes its advisory and patched versions for the Brotli flaw in .NET | Microsoft |
| Oct 26 | CISA adds the two PHP flaws to its Known Exploited Vulnerabilities (KEV) catalog; php.net publishes Windows builds with Brotli 1.2.1 | CISA, php.net |
| Oct 27 | CISA adds the Brotli flaw (CVE-2026-111497) to its Known Exploited Vulnerabilities (KEV) catalog | CISA KEV |
Chain 1: PHP
PHP released fixes on Oct 21 for CVE-2026-109618 and CVE-2026-109619, two flaws the PHP Foundation calls critical. The Foundation says both "sit in parts of PHP that nearly every request touches: memory management and error handling."
php.net says "PHP 8.1 and older no longer receive updates from the PHP project." The security team still published minimal source backports for 7.4, 8.0 and 8.1.
CISA added both flaws to its KEV catalog on Oct 26. Its alert tells organizations: "Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable." Palo Alto Networks lists affected versions of PAN-OS, its firewall operating system, in its advisory, and Schneider Electric lists affected products in its bulletin SESB-2026-295-01. The live coverage from British Broadcasting Corporation (BBC) News on Oct 22 quoted its cyber correspondent Joe Tidy describing PHP as "one of these things we take for granted" (BBC News).
The shared part of this chain is that PHP sits inside products whose owners may not see it. No source we reviewed says the PHP flaws caused any of the incidents below.
Chain 2: Brotli
CVE-2026-111497 is a flaw in the Brotli decompression library. Node.js, Bun and Microsoft describe it as an out-of-bounds write. The CISA KEV catalog calls it an unchecked return value vulnerability. The CVE record lists both weakness types, out-of-bounds write and unchecked return value. A change was committed to the Brotli source code on Feb 27. The first Brotli releases after it came on Oct 21, and the comparison of 1.2.0 with 1.2.1 lists a cherry-pick of that change and a release-preparation commit. Node.js lists the cherry-pick of that change under CVE-2026-111497 in its Oct 21 release commit.
The same flaw is documented in at least six places, each by its own project: Node.js, Bun, Envoy, Istio, .NET and the Windows builds of PHP. Exposure depends on configuration. In PHP's Windows builds the decoder is reachable through cURL when automatic response decompression is enabled, which php.net says is off by default. Microsoft says ASP.NET Core and HttpClient do not decompress Brotli automatically in their default configurations. Istio's bulletin is dated Oct 15, the date of its original releases; the Istio repository shows the Brotli entry was added to it on Oct 20.
A change that sits in a repository without a release does not reach the products that bundle the library by itself.
Chain 3: GitLab and Ruby
Ruby's post lists four GitLab CVEs, CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264, and maps them to three bugs in Ruby's regular expression engine, Onigmo. It says GitLab addressed them by patching the Ruby it ships. Ruby also says the bugs are reached only when an application compiles a regular expression from a string an attacker controls. Applications that use only expressions written by their own developers are not affected.
Chain 4: eMudhra
eMudhra, a certificate authority (CA), says: "A script error resulted in issuing CA’s with weak keys." It ties the keys to a ceremony it ran on Apr 30, 2025, and says it has not yet confirmed the exact root cause (eMudhra). Updates followed in Python, Java, Node.js, Bun, Cisco and browsers, as Google describes for Chrome and Android.
The credential incidents
Railway says its attacker was after keys to artificial intelligence (AI) providers (Railway). LiteLLM says its attacker focused on tokens for upstream AI inference services (LiteLLM). OpenCode said on Oct 17 that its breach was "related to a large scale distillation attack" and that the incident was ongoing (OpenCode). It said it "cannot share more details at this point."
No report links its case to the other credential incidents or to PHP. One report does mention another incident: LiteLLM said on Oct 23 that it would issue a release with "a fix for removing the eMudhra certificate authority from our trust store." Its release notes for 1.103.8 list the removal of the eMudhra root CA.
What connects and what does not
| Link people draw | What the sources support | Source |
|---|---|---|
| One Brotli flaw and advisories or builds from Node.js, Bun, Envoy, Istio, .NET and PHP for Windows | Connected. Same CVE, documented by each project | Node.js, Istio, php.net |
| Four GitLab CVEs and Ruby | Connected. Three Ruby bugs sit behind the four CVEs | Ruby |
| eMudhra's error and updates in Python, Java, Node.js, Bun, Cisco and browsers | Connected. One incident, updates in many ecosystems | Cisco, Google |
| PHP inside other products | Connected. CISA says PHP is often a component of other software; PAN-OS and Schneider products are listed as affected | CISA, Palo Alto Networks, Schneider Electric |
| The Brotli update and the eMudhra update in one Node.js release | Shared release, separate causes. The Oct 21 Node.js release lists both, among other fixes and dependency updates | Node.js |
| The PHP flaws and the Brotli flaw | Connected through patching, not through cause. php.net's Oct 26 Windows builds include Brotli 1.2.1, and Palo Alto Networks says in its advisory FAQ that for PAN-OS "the same hotfix covers both the PHP and brotli vulnerabilities" (PAN-OS 11.2.10-h16 is the one exception) | php.net, Palo Alto Networks |
| LiteLLM's incident and the eMudhra update | LiteLLM's post mentions the eMudhra update. It does not say one caused the other | LiteLLM |
| The PHP flaws as the cause of the Brotli, GitLab or eMudhra incidents | Not supported. No source we reviewed says so; each describes its own incident | Each advisory above |
| The credential incidents tied to each other or to PHP | Not supported. No report ties its incident to the others or to PHP | Railway, LiteLLM |
| All of it as one campaign | Not supported. No primary source we reviewed groups these incidents as one campaign | Each advisory above |
What this note does not say
The sources we reviewed do not settle how long the Brotli and Ruby bugs existed, which Java versions carry the eMudhra fixes, what eMudhra's root cause was, how Railway's attacker first got in, or which Cisco products end up affected. We do not guess at them.
Our position
For us, a link between two incidents is a claim, and a claim belongs in the record with its source.
The work is done when the system writes to the record.
Read how we connect AI agents to the systems an organization already runs.