If you’ve spent more than a year in this wacky industry we call cybersecurity, you will no doubt know that since 2004, October has been designated National Cybersecurity Awareness Month. And, oh boy, did the awareness spike this October. The ground has shifted under the IT defenders the world over, and I think it’s important to process what happened last month and what’s likely to keep happening.
PHP2Shell #
On October 20th, the infosec rumor mill exploded with reports of a disastrous bug in PHP. Basically, any website that runs PHP (which would be most of them, at about 70% of market share), has a critical vulnerability chain whereby an attacker could subvert a webserver into running arbitrary code, and thus, take complete control over the webserver. In my opinion, the best writeup around is calif.io’s PHP2Shell advisory (complete with a comic drawn by human artist Stephanie Cortes), though Ariane Djad’s writeup from an outsider’s perspective published a few days later is a strong contender as well.
The long-term implications of PHP2Shell are still forming, but of course, it’s not just regular websites that are affected. PHP is embedded in all sorts of security gear, including, for example, edge firewalls. We expect these bugs to persist for quite some time in the wild, and while exploitation is trickier than initially suspected, offensive tooling tends to get better and better over time.
This kind of vulnerability finding with its massive attack surface, the subsequent global coordination of defenders, and the tsunami of exploitation attempts is not normal; it’s what we call a black swan event, a predictably unpredictable, but rare, crisis that hits the connected world.
eMudhra CA #
In the same week as PHP2Shell, certificate authority eMudhra propagated some certificates that were accidentally generated with tragically short eight-bit private keys. As described by Marcus Chen of Tech Insider, this wasn’t due to an external compromise, it was unfortunately a failure of the company’s key generating ceremony (and yes, that’s what the technical process of generating trustable certificates is called).
These certificates are what gets you to the green padlock icon in your browser, but this certificate exposure goes beyond merely keeping your private web browsing private. As HD Moore describes in detail, these certs end up in software supply chains, and are foundational to establishing the trust that the software you download and install today is, in fact, what the upstream developers wrote. Without signed software, your computer can’t know that the next update you get isn’t already backdoored by malicious threat actors.
Like the PHP2Shell issue, I expect this whoopsie from eMudhra to persist for quite a while, especially in places where updating certificate chains of trust is problematic (think of long-running OT and IoT gear where firmware updates are rare, but critically important to trust).
As it happens, I’ve been paying more attention to post-quantum cryptography (PQC) as an end-of-life problem (slash opportunity), and it struck me that the recent eMudhra CA issue is similar to what “Q-Day” will look like, but in miniature. There was no breach, no key theft, just trivially factorable private keys that would allow an attacker to subvert software signing, and working around this for one issuer was and will be a bunch of work.
On Q-day, the day that a cyber superpower chooses to undermine signed software, all traditional certificates will become trivially factorable. So, it won’t just be the one CA, it’ll be all of them, all at once. This is why people paying attention to quantum cryptology and cryptanalysis are getting more and more vocal about switching to PQC algorithms for attestation well before a cryptographically relevant quantum computer (CRQC) is revealed to the world. October gave us a glimpse of what that work will entail, and it includes chasing down lots of software supply chains and figuring out how they actually work.
At any rate, this kind of issue in key generating ceremonies is also a black swan event; exceedingly rare, but with outsized impact downstream. Hey, that’s two black swans in one week!
Broccoli2Shell #
But, the security awareness events last month didn’t stop there. As mentioned, PHP is the server-side programming language behind most dynamic websites in the world. Among those that don't use PHP, they’re probably running a Javascript, Python, or .NET based runtime. Unfortunately, those folks had their schadenfreude cut short by CVE-2026-111497, known variously as HTTP2Shell, Brotli2Shell, or, my favorite, Broccoli2Shell.
Brotli is a compression algorithm provided by Google, and if a website (or web application) accepts Brotli-compressed data, then an attacker could supply specifically malicious compressed data to gain code execution. Like with PHP2Shell, the path to exploitation was a little tricky at first, but this fundamental, component-level bug in use by all sorts of endpoints and frameworks is yet another a black swan event. That’s a lot of black swans in one month!
October Patch Tuesday #
Of course, Cybersecurity Awareness Month wouldn’t be complete without a nod to Microsoft’s Patch Tuesday. This past October’s release saw 1,474 individual CVEs addressed. Compare this with October of last year, with a paltry 180 CVE-identified issues fixed. This means, year-over-year, we’ve seen an increase of 719% in Microsoft-addressed vulnerabilities.
This wasn’t a slow and steady climb to where we’re at now. In September, Microsoft set a then-record with 999 bug fixes, but blasted through that milestone with 48% more CVEs addressed month-over-month in October. For context, last quarter, in July, there were 663 fixes (October beat that by 122% quarter-over-quarter), and in April, things were still normal with a mere 173 fixes.
Microsoft is not alone, of course. Thanks to new AI tools, every major vendor is seeing a significant uptick in vulnerabilities discovered, either internally diagnosed or externally reported.
Additionally, if your job is patch management, you’ve no doubt noticed by now that your existing processes have already hit a ceiling. The Verizon DBIR noted a speed-of-light-style hard limit on just how many critical vulnerabilities any enterprise can address on a given timescale, and we’re all going to have to figure out some fundamental changes to those processes just to stay current.
Hey, maybe this October spike was a black swan event, too, and the average number of Microsoft vulnerabilities will return to the mean with November’s release. But, I think you can see where I’m going with this.
Ninja update: The November Patch Tuesday just released, and it’s over a thousand issues, but about 25% lower than October. It’s entirely possible we’ve hit the high water mark, but only time will tell.
Oops, all black swans #
If you happen to be in Western Australia, you’ll find literal black swans pretty much everywhere. They’re native to Oz, and only seemed exotic to Europeans when they started getting imported, thus, the metaphor. Maybe that’s the lesson that this gnarly October is trying to teach us. I’m starting to suspect that we’ve all been migrated to this version of the internet where vulnerabilities aren’t just coming at us faster and furiouser (thanks to AI), but the time it takes for weaponization and exploitation has gotten markedly shorter (thanks to AI). Targeting is getting better, and the long tail of attack surface is getting even longer with unsupported or barely supported downstream components now being noticed as vulnerable targets (thanks to AI).
Not to be a bummer or anything, but this may just be the new normal. We presumed as much back in June when we started noticing that AI-driven offense was getting better and better. Despite this dour review of what was certainly in the top five most crisis-driven couple weeks in my lifetime as a cybersecurity professional, I do believe that defense can, and will, keep up. Knowing with precision what your overall exposure looks like before the next doomsday bug is easier than ever with runZero, so pop over to runzero.com/try today for your fully functional free trial.
But moreso, I think that we can use AI-driven processes to identify, triage, and adjust our working environments and defensive cadence to move at the same machine speed that adversaries are using to probe and attack. Equipping your SOC analysts with better maps of the territory and better intelligence on what’s on the horizon is going to keep you in business.
And hey, if you were chasing all the black swans this October, make sure that you take care of yourself. It’s important to get outside, visit with friends, and get yourself emotionally prepared for the next round. Stress management is what got people through Log4Shell, WannaCry, Heartbleed, and every other internet crisis, all the way back to Code Red. This won’t be the last worst month, but I’m confident that with good people using great tooling, we can get through the next one.
In the meantime, I hope your level of cybersecurity awareness is enough to last you for the rest of the year, but in case you want more, join us on the next runZero Hour where we talk about all this with Thai Duong of calif.io and HD Moore of runZero (a Dragos company) next week. Chat is open if you register, so come with your questions!
