On October 21, two of the most widely used components on the web shipped emergency fixes for critical flaws on the same day. PHP patched PHP2Shell. Node.js and Google patched Broccoli2Shell in the Brotli compression library. Both were added to CISA’s Known Exploited Vulnerabilities catalog within a week, and some observers started calling the stretch Black October.
The rest of the month didn’t slow down. Attackers raised the temperature of supermarket refrigerators across France. A newly named ransomware group claimed an attack that diverted ambulances away from a Level I trauma center. And the ShinyHunters investigation turned toward the people victims pay for help.
Here’s what the CyOps team tracked, and what it means for defenders.
Black October: Two Flaws Below the Application Layer
PHP2Shell
PHP2Shell covers two critical flaws in PHP’s core runtime, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS. They live in how PHP handles memory and errors, so websites can be exposed even when their own application code is secure. Under the right conditions, an unauthenticated attacker can run code or read process memory that may hold passwords, authentication tokens, and API keys. At disclosure, approximately 5.1 million online hosts were running PHP.
The disclosure didn’t go to plan. On October 20, the CVE identifiers leaked on Hacker News and social media, along with an incorrect claim that the flaws scored 10.0. PHP moved its release up a day, to October 21. Amazon’s MadPot honeypots had already logged an exploitation attempt on October 17, four days earlier. With CERT-EU advising organizations that couldn’t patch to take PHP applications offline, councils, universities, and data protection authorities across Europe pulled sites down as a precaution. A honeypot later recorded confirmed remote code execution, and CISA added both CVEs to its KEV catalog on October 26.
Fixed versions, temporary mitigations, AWS indicators of compromise, and investigation steps are in our PHP2Shell vulnerability update. The full October CTI Report also includes a CyOps technical breakdown of both flaws.
Broccoli2Shell
Broccoli2Shell, also called Node2Shell and HTTP2Shell, is CVE-2026-111497, a critical out-of-bounds write in Google’s Brotli decompression library. Brotli shows up in Node.js, Python packages, Bun, .NET, Envoy, Istio, and plenty of other software. Any application that decompresses Brotli data from an untrusted source with an affected version may be exposed, whether that data arrives in an incoming request or a response the application fetched itself.
The timeline is the striking part. According to OpenSourceMalware’s analysis, the fix first landed in the Brotli source in February 2026. Downstream releases for Node.js and Brotli itself didn’t ship until October 21. Projects that bundle their own copy of the decoder, including ClickHouse, DuckDB, and Apache Arrow, still had no patched release when we published our analysis on October 26. Wiz reports that 91% of cloud environments have resources vulnerable to the flaw. CISA added it to the KEV catalog on October 27.
Affected products, fixed versions, and interim mitigations are in Broccoli2Shell, Node2Shell, and HTTP2Shell explained.
What the two have in common
- AI-assisted discovery: Researchers at Wiz, OpenAI, and Calif used AI-assisted research to find and demonstrate PHP2Shell. Broccoli2Shell was reported by OpenAI Codex Security.
- Hidden dependencies: Few organizations think of PHP or Brotli as products they run. Both sit inside hosting platforms, appliances, containers, and libraries, which makes inventory the hardest part of the response.
- Patching is only half the job: Both require restarting affected workers and services so the fixed code actually loads. Applications with bundled copies need a rebuild, not just a system package update.
Hundreds of French Supermarkets Lose Refrigeration Overnight
On the night of October 11, threat actors reportedly gained remote access to refrigeration controllers running older versions of Danfoss control software. They triggered automatic defrost cycles and pushed refrigerator temperatures up at approximately 250 to 350 supermarkets, according to the CyOps report. Intermarché, Carrefour Market, Monoprix, Leclerc, and Coopérative U were all affected. Stores pulled fresh and frozen products from compromised units, and the Paris prosecutor’s office opened an investigation that includes reports of food losses and fires.
The count kept climbing after the first reports. Reuters reported that some units reached as high as 50 degrees Celsius, and France’s finance minister later told Parliament that about 700 of the country’s 10,000 supermarkets were affected. Danfoss said most of the affected systems were older products that no longer received security updates.
Two details matter most for defenders.
- The entry point was a third party. Intermarché confirmed the incident reportedly originated with a service provider responsible for managing refrigeration systems in its stores. The retailers didn’t need to be breached directly.
- The devices were findable. Following the incident, researcher Baptiste Robert identified approximately 2,752 Danfoss systems exposed to the internet, 1,590 of them in France. Claroty’s Team82 had published research on vulnerabilities in Danfoss refrigeration controllers in August.
That combination, an internet-facing OT device managed by an outside vendor and running software past its update window, describes a lot of equipment in retail, healthcare, and manufacturing environments. Most of it isn’t on anyone’s asset inventory.
Healthcare Takes a Hit From a Brand-New Ransomware Group
On October 26, the University of New Mexico Health Sciences Center suffered a cyberattack that forced UNM Health, operator of New Mexico’s only Level I trauma center, to divert ambulances, restrict new admissions, and suspend outpatient surgeries. Classes across four health sciences schools were canceled.
A newly emerged group called Byod claimed responsibility on its leak site, alleging it compromised about 36,000 systems, including Active Directory, Group Policy, the Microsoft Entra tenant, and Oracle databases. Byod also made an unusual offer: free decryption keys for healthcare systems and up to $2,500 in compensation per impacted patient, while keeping the stolen data.
UNM’s account differs sharply. By October 27, all critical systems were restored, and the university’s initial investigation found the attack affected several end-user devices but did not penetrate core systems or servers. Byod’s claims remain unverified. A group with six listed victims has every reason to exaggerate its reach.
Data Breaches in Copenhagen and Tokyo
- University of Copenhagen: Attackers accessed a test environment containing personal information on about 525,000 individuals, including Danish national identity numbers. PIN codes for another 20,000 students and employees were also exposed, prompting the university to restrict physical access to some campus locations and reissue access codes.
- Sony Network Communications: An unauthorized party accessed the membership database behind the So-net and plala internet services, exposing about 2.58 million customer records. Passwords for 54,401 email accounts across four Sony email services were compromised, along with 16 bank account records.
The Copenhagen case is a familiar lesson. Test environments often hold real data with weaker controls than production.
Law Enforcement Wins, and an Uncomfortable Arrest
- Operation Serengeti III: Interpol announced results from an operation across 21 African countries that led to 1,462 arrests, dismantled 10,909 malicious networks, and recovered more than $105 million in illicit funds.
- Nefilim and Hive affiliate sentenced: Artem Stryzhak, a Ukrainian national, received 70 months in U.S. prison for his role in the Nefilim and Hive ransomware operations. His alleged accomplice Volodymyr Tymoshchuk remains at large, with a reward of up to $11 million on offer.
- The negotiator case: This month’s Cynet Lighthouse section covers the October 8 arrest of Edward Dubrovsky, a cybersecurity executive known for ransomware negotiation work, in connection with the ShinyHunters investigation. Reporting also indicates federal investigators believe at least one executive at a US consulting firm may have helped operate Shinywire, the group’s victim-facing extortion site. The case echoes the 2024 charges against MonsterCloud’s CEO and raises hard questions about vetting the third parties organizations bring in during their worst week.
The Rest of the Vulnerability Review
The high-score vulnerability review flagged 10 critical and high-severity CVEs, several in the edge and remote-access products attackers favor most:
- SonicWall SMA1000 (CVE-2026-102255, CVSS 10.0): pre-authentication SSRF in the Work Place interface
- JetBrains TeamCity (CVE-2026-106218, CVSS 10.0): Kotlin DSL sandbox escape leading to RCE
- Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8): unauthenticated arbitrary file write
- Fortinet FortiMail (CVE-2026-104286, CVSS 9.8): unauthenticated path traversal and file write
- BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.8): authentication bypass by spoofing
Three New Malware Families
The CyOps team analyzed three new families this month, each executed in a lab with Cynet running in detection-only mode so every stage could be logged.
- Panzer: A Rust-based ransomware-as-a-service operation first observed in August 2026, with 46 claimed victims across 20 countries, mostly in the EU. It enumerates hosts with “net view,” copies itself to shared folders, and detonates through remote scheduled tasks.
- Penumbra Stealer: An infostealer sold on the Crackcodes forum in late September. It masquerades as a Windows Update binary, disables Defender protections, and ships stolen data to a Discord webhook.
- BlackLocks: An emerging double-extortion ransomware group first seen in September 2026 with three claimed victims. Its Rust payload stops the Windows Search, Volume Shadow Copy, and SQL services, then encrypts files created within the past three years before older ones.
The Thread Running Through October
Most of this month’s incidents trace back to something sitting just outside someone’s direct view: a compression library buried in a dependency tree, a PHP runtime inside a hosting platform, a refrigeration vendor’s remote access, a test database, a negotiator brought in to help. Attackers keep finding the systems and relationships that fall between teams.
The practical takeaways:
- Build a software inventory deep enough to find runtimes and libraries, not just applications
- Patch critical runtime flaws on an emergency timeline, then restart and rebuild so the fix actually loads
- Inventory internet-facing OT and IoT devices, including the ones vendors installed and manage
- Hold third parties with remote access to the same monitoring and access standards as your own staff
- Treat test and staging environments that contain real data as production
Get the Full Report
The complete October 2026 report includes the full critical news summary, the high-score vulnerability review with patch guidance, the CyOps PHP2Shell technical breakdown, full malware analysis with MITRE ATT&CK mappings for Panzer, Penumbra, and BlackLocks, and the Cynet Lighthouse darknet investigation.