October 2026 has shaped up to be an especially scary month for enterprise security teams -- and not because of spooky Halloween costumes, jack-o'-lanterns or horror movies.
The flurry of serious cybersecurity events and disclosures last week, dubbed "Black October," was led by the PHP2Shell vulnerabilities that prompted many organizations to pull the plug on their websites and go dark.
Coinciding with Cybersecurity Awareness Month, Black October saw a wave of challenges, particularly between Oct. 19-23 -- challenges caused by many of the issues Cybersecurity Awareness Month aims to address.
"Black October is not merely a spooky coincidence of security announcements," said Rafay Baloch, CEO and founder of offensive security services firm RedSecLab. "Rather, this month has represented an actual escalation as old threats have learned new and frightening tricks."
What does 'Black October' really mean?
"We need to be careful not to describe October [2026] as an extraordinary escalation in cyberwarfare," said Tom Reveley, a fractional CTO and cybersecurity advisor. "Absolutely, there have been a number of more significant incidents, but the uncomfortable truth is that much of what we're seeing isn't particularly new."
The PHP and GitLab vulnerabilities, for example, were software flaws; the LiteLLM compromise was related to a third-party incident; and the ConnectWise attack was tied to identities and credentials.
What is new is that experts' predictions are coming true: AI is upping the ante.
"What we are seeing is the convergence of the longtime upward-trending cybersecurity risk amplified by the AI-centric capabilities now readily available," said Rob Gregory, CISO at cyber advisory Optiv. In practice, AI is playing a role in a massive reduction in the time it takes for vulnerabilities to go from discovery to exploitation. "AI models are getting very good. Combine that with known exploitations, and you have the perfect blend," he said. "It's the same risks, but at a far greater speed."
What's concerning and serious, said Fred Rica, managing principal and lead of accounting services firm BDO USA's cyber practice, is that AI is finding exploit paths to take advantage of flaws that have been around for years.
Lora Vaughn, founder and CISO of Vaughn Cyber Group, a cybersecurity consulting firm, agreed. "Several of these bugs sat in code for years. What changed is how fast they got found," she said. "AI-assisted research is surfacing old flaws faster than most organizations can inventory what they run, let alone patch it."
Key CISO takeaways
A common thread across Black October events, Vaughn said, is dependency risk.
"PHP2Shell, the LiteLLM pipeline compromise and the rest all hit software that organizations didn't write and often didn't know they were running," she said. "When PHP2Shell dropped, the first question for my community bank clients wasn't 'Are we patched?' It was 'Do we have PHP anywhere, including the website host and the vendor portals?' Plenty of teams couldn't answer that in a day."
If you're a CISO, she said, the lesson isn't to panic about AI hackers, but to learn that asset and vendor inventories now have a shelf life measured in days. "Build the inventory and know who to call at each vendor when the next one lands," Vaughn recommended.
Gregory called for changes in controls and risk tolerance, and for organizations to embrace defensive AI tools. "Not next year, or next month, but today," he said.
This month's events also highlight the importance of shifting from vulnerability management to exposure management, and of updating patching strategies, Rica said. "Companies need a stopwatch, not a calendar, for patching activities. Exploit development that used to take days or weeks of bespoke coding by highly skilled hackers now happens at machine speed."
Matthew Carr, co-founder and head of research and technology at cyber-risk intelligence services firm Atumcell, agreed. "The big lesson from Black October is that vulnerability management must be continuous, not just a compliance exercise you do once a year. Annual penetration tests and quarterly scans aren't enough when a serious vulnerability can appear and be exploited in hours."
Baloch said a silver lining is that "this perfect storm is bringing the message that security is not just a series of checkboxes in IT, but a living and breathing component of an organization's culture, to the boardroom."
Is Black October the beginning of the new normal?
The wave of incidents has left many wondering if this is a sign of the times.
Black October will soon be what a typical month looks like for enterprise security teams, Gregory said, unless organizations embrace defensive AI, agentic security operations centers, exposure management programs and rapid patching.
Many experts reiterated that Black October and similar months are best addressed by following the security best practices that Cybersecurity Awareness Month emphasizes.
"My biggest takeaway is that basic cyber hygiene remains the best armor against these types of attacks," Baloch said.
Carr said it's not clear whether this month was a one-off or the beginning of a sustained trend of security disclosures, but the root causes of this month's incidents remain. "In the end, the organizations most ready for the next Black October won't necessarily be the ones with the biggest cyber budgets," he said. "The real advantage will go to those who know their systems, understand their vulnerabilities, and can reduce their attack surface faster than attackers can."
Reveley agreed. "My concern isn't that November will bring some completely new category of cyberthreat. It's that organizations will still get caught out by the same preventable problems we've been talking about for years."
As for AI-enabled attacks, Reveley added, expect to see more as the technology makes it easier and cheaper to do things that previously required more time and expertise. "The same technology can also help us defend organizations, provided we're using it properly."
"Expect future months to be tumultuous," Baloch said, adding that "leaders should work to mitigate panic and promote preparation and resilience ahead of the next storm."
Rica said that most organizations today don't have an AI problem, but rather a governance problem.
"If you don't have strong asset management and an accurate CMDB, run the latest version of software, understand your exposures and react at machine speed, it's likely every month will be a 'black' month," he said. "AI attacks have exposed governance issues that companies can no longer run from. There is no place to hide if you have poor governance."
Sharon Shea is the lead editor of TechTarget Cybersecurity.
