What the industry now calls “Black October” has put security leaders everywhere on notice.
Two critical issues in shared internet infrastructure, PHP2Shell and the eMudhra certificate keys, reached thousands of organizations at once. Security teams spent days hunting for exposure across vendors and services. Leaders had to weigh security against the business: stay online and vulnerable, or go offline and absorb the disruption. Other organizations were disrupted when a trusted third party failed and had to answer for a risk they did not create.
Either of these events is a serious test for any security team. Facing two in a single week is a first in my career. PHP2Shell alone drew comparisons to Heartbleed, except this time AI compressed the attack chain, from discovery to exploitation.
Black October is a wake-up call: AI is exposing vulnerabilities faster than ever. No organization has operated at this pace before. We are in an era that demands a new approach to managing cyber risk. Prevention and patching will sometimes fail, which is why resilient organizations have a plan and a practiced response ready.
Why This Is Cybersecurity’s New Normal
AI is highly effective at writing code and finding vulnerabilities in it. Closed frontier models make the headlines, such as the OpenAI test agents that broke out of their sandbox and attacked Hugging Face in July. Open-weight models, which anyone can download and run, are only a few months behind. Researchers are using AI agents to find vulnerabilities that evaded years of human review or were believed to be too complex for any human attacker to exploit. The PHP2Shell flaws, one half of Black October, are a case in point. They sat in core code that powers a large share of the web, lurking for years.
AI is also now writing a growing share of new code, which carries risks of its own. In one Veracode study, 45% of AI-generated code samples failed security tests. So even as AI helps find and patch vulnerabilities, it is also introducing new ones.
The backlog of vulnerabilities compounds the problem. Finding security gaps used to take rare skill and a lot of time. AI removes that barrier. According to the CVE Program, more than 86,000 vulnerabilities have been published so far this year, almost 80% above last year’s record of 48,151. Verizon’s 2026 Data Breach Investigations Report found defenders now take a median 43 days to patch, up 34% on a year ago.
The window to respond is about to shrink. Frontier models surfaced the PHP2Shell flaws in August, and it took about two months to ship a patch. Open-weight models are catching up to the vulnerability-finding capabilities of today’s frontier models. Once they do, security teams won’t have the luxury of two months to prepare a patch.
Organizations should prepare for more weeks like the one we just lived through. That means your next critical incident could start in a vendor, an open-source component or the web’s shared infrastructure, where you are waiting on someone else’s fix while attackers exploit it. Resilient organizations treat a week like Black October as a drill they have already run.
Three Questions Every Resilient Organization Can Answer
Cyber resilience works like a muscle. It strengthens with regular training and fades quickly without it. Yet most organizations still “exercise” incident response about once a year. That pattern runs through more than 9,500 incident readiness surveys analyzed for the CYGNVS Resilience Benchmark Report. Boards are asking security leaders the same three questions, and the data shows how the most resilient organizations answer them.
- “Are we ready?” Ready organizations plan for specific incidents. They keep scenario-specific plans current, revisit them whenever the threats change and rehearse with everyone who would be in the room, from legal and risk to the executive team.
- “Will our response stay under control?” Controlled organizations run the response from one secure place the threat cannot reach. It serves as a single source of truth, so every stakeholder stays current and gets the right information when they need it. Roles, access and outside experts are lined up before an incident starts, so the first hours go to containment instead of logistics.
- “Can we justify our decisions afterwards?” Defensible organizations build the record while the incident unfolds. They capture who knew what and when in real time, so the answers are ready when regulators, insurers and auditors come asking.
Lessons From 50+ New Critical Incidents a Week
At CYGNVS, we help organizations respond to more than 50 new critical incidents every week. We see what sets the most resilient organizations apart:
- They prepare for the specific scenario. Roles, contacts and decision rights are set for third-party and critical-vulnerability incidents as well as ransomware.
- They practice like it is real. They rehearse realistic scenarios drawn from the latest threats, with the full response team at the table.
- They respond from one secure place. Security, IT, legal, communications, executives and outside experts work from the same facts, tasks and files, apart from the systems under suspicion.
- They report from a record built as they go. A timestamped trail of who knew what and when is ready before the first regulator calls.
Strength in these four areas is what allows a leadership team to answer the board’s three questions with confidence. That confidence comes from treating incident readiness as always-on, and not as a break-glass measure reserved for when an incident starts.
Train Your Cyber Resilience Muscle Now
Black October will not be the last month like this. AI will keep surfacing vulnerabilities faster than the world can fix them. Every organization that uses this moment to strengthen how it prepares, practices, responds and reports will be on firmer footing when the next incident arrives. Run your next exercise on a Black October scenario before the next one arrives.
About the Author
As Chief Technology Officer at CYGNVS, Kevin Gaffney leads the technology vision and product innovation behind the out-of-band command center for cyber and AI incidents. More than 3,000 organizations in 71 countries rely on CYGNVS when email, SSO and core systems are down or compromised. Kevin’s team builds the platform that lets security teams, business leaders and external providers prepare, practice, respond and report in one secure place. That includes patented Out-of-Band Identity and Isolate Mode. With 50+ new critical incidents running on CYGNVS every week, real-world experience shapes everything that’s built.
FAQ: Black October and Cyber Resilience
What was Black October?
It’s the name the industry gave a single week in October 2026 when two critical issues in shared internet infrastructure hit at once: PHP2Shell vulnerabilities and the eMudhra certificate keys. thousands of organizations were affected at the same time. Security teams spent days finding out if and where they were exposed across vendors and services.
How is AI changing the vulnerability landscape?
It works on both sides. AI agents are finding vulnerabilities that got past years of human review. AI is also writing more and more new code, and in one Veracode study 45% of AI-generated code samples failed security tests. Open-weight models, which anyone can download and run, are only a few months behind closed frontier models. Once they catch up, attackers will be able to find serious flaws privately and at scale. For defenders, that means less warning before a vulnerability is exploited, and sometimes no fix is ready when the attacks begin.
Are there more vulnerabilities now than before?
Yes. More than 86,000 vulnerabilities have been published to the CVE Program so far this year. That’s almost 80% above last year’s record of 48,151. Patching is also getting slower: Verizon’s 2026 Data Breach Investigations Report puts the median time to patch at 43 days, up 34% on a year ago.
Why won’t patching and prevention be enough?
The time between finding a flaw and attackers using it is shrinking. With PHP2Shell, about two months passed between discovery and a patch. Once open-weight models can find flaws as well as today’s frontier models, defenders won’t get that much warning. Your next critical incident may also start at a vendor or in an open-source component, where you’re waiting on someone else to fix it.
What three questions should leadership teams be ready to answer?
Boards are asking: “Are we ready?”, “Will our response be controlled, not chaotic?” and “Can we justify our decisions afterwards?” The most resilient organizations answer them with scenario-specific plans, one secure place to run the response, and a record they build in real time as the incident unfolds.
What do the most resilient organizations do differently?
Based on the 50+ new critical incidents that run on CYGNVS every week, they do four things:
- They prepare for specific scenarios, including third-party and critical-vulnerability incidents.
- They practice realistic exercises with legal, communications and executives involved.
- They respond from one secure place, separate from the systems under suspicion.
- They report from a timestamped record they build as they go.
How often should we run incident response exercises?
More often than once a year, which is what most organizations do today, based on the 9,500+ readiness surveys behind the CYGNVS Resilience Benchmark Report. Resilience works like a muscle and fades without regular training. A good next step is to run your next exercise on a Black October scenario.
