October 2026 in review: seven security events, their timelines and the patch window

Security reports piled up so fast in October 2026 that a roundup by the developer Drew Silcock made the rounds: "Is this the new cyber normal?" of 23 October. His conclusion is that the time from news of a flaw to automated attacks has shrunk from weeks to hours. We read every claim in it against the primary sources and wrote down, for each event, when the advisory came, when the patch and when the exploit.

A patch window is the time between a vulnerability becoming public and the moment an operator has closed it in production, including a restart of the affected services. It consists of three dates: advisory (the flaw is public), exploit (a working attack is known) and patch (the fix is running). This post measures how long the stretch between advisory and exploit actually was in October.

The timelines at a glance

All times UTC where the source gives a time. A cell that says "not documented" means we found no date in the sources we read.

Event	Advisory or report	Patch or countermeasure	Exploit or exploitation	Source
PHP2Shell, CVE-2026-109618 and -109619	20 Oct 19:30 pre-announcement, 21 Oct 13:34 advisory	21 Oct, PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35	attempt 17 Oct (Amazon), earliest PoC 21 Oct about 02:00, CISA KEV 26 Oct	PHP Foundation, GitHub, Amazon, CISA
GitLab CVE-2026-97229	12 Oct	12 Oct, 19.4.2, 19.3.5, 19.2.8	Rapid7 PoC 13 Oct, CISA KEV 29 Oct	GitLab, Rapid7, CISA
GitLab CVE-2026-110264	21 Oct	21 Oct, 19.5.1, 19.4.3 and others	not documented, not in KEV (as of 6 Nov)	GitLab, CISA
eMudhra, eight intermediate certificates	17 Oct report, at Mozilla 20:06	17 Oct 22:46 CRLSet, 18 Oct revocation	test certificates in CT logs from 20 Oct 09:40	Mozilla Bugzilla, eMudhra
Linux kernel, ZDI reports	21/22 Oct on a public list	no mainline fix (as of 28 Oct)	PoC for ZDI-CAN-33367 rebuilt, exploitation not reported	Phoronix, Sysdig
LiteLLM 1.107.0	21 Oct 11:39, the malicious code itself	PyPI removed 13:23, Docker 14:20	not applicable, the package was the attack	LiteLLM
Railway	21 Oct notice, attack from 20 Oct 13:58	access ended 22 Oct 03:32	not applicable, a breach rather than a flaw	Railway

PHP2Shell: the exploit came before the advisory

The PHP Foundation dates it like this: on 20 October around 15:00 UTC the two CVE numbers circulated on forums, with the wrong release time and the wrong score. The project moved its pre-announcement up to 19:30 and the release from 22 October to 21 October, 14:00 UTC. Around 20:00 Calif, one of the reporters, accidentally published a video of its exploit. On 21 October at 07:41, according to the PHP Foundation, the distributor Chainguard published images containing the fix, more than six hours before the release. The advisory itself carries the timestamp 13:34 in the GitHub API.

Amazon writes that one attempt against its honeypot network dates from 17 October, four days before the advisory, from an anonymised address. The earliest proof of concept was available around 02:00 on 21 October. After the release, more appeared "within hours" and were used against its sensors almost at once. These are vendor statements from its own telemetry. The PHP Foundation countered that its team had found no working exploits at the time of the release. Both can be true, because they measure at different points. Whether an effective attack actually ran on 17 October, Amazon does not say.

Two claims from the roundup hold up. The flaw has a history: a related memory bug was reported in 2020 (bug #78876), and an audit by OSTIF and Quarkslab found a related problem in 2024 whose exploitability stayed unproven. Silcock writes that the bug was found in the audit; the sources speak of a related bug with no concrete attack path. Second, AI tooling was involved: the PHP Foundation names OpenAI Codex Security among the finders. The model names Silcock lists appear in none of the primary sources we read.

eMudhra: key 4 and the time to proof

On 17 October a researcher (listed as Wayne in Bugzilla) reported that eight intermediate certificates of eMudhra used private keys that were small integers. The certificates come from a key ceremony on 30 April 2025. Mozilla confirms that all eight keys were below 256. Mozilla received the report at 20:06 and calculated the keys back itself at 21:48, 1 hour 42 minutes later. A commenter in Bugzilla lists the values 4 to 237; nobody there confirmed them, so we treat them as a comment.

The CRLSet entry was in place at 22:46 and the Firefox block at 22:59; eMudhra revoked around 09:38 on 18 October. From 09:40 on 20 October, 107,107 certificates appeared in the Certificate Transparency logs, 106,050 of them test certificates for google.com by Mozilla's count. eMudhra says no certificate in production was issued from the eight intermediates. That attackers used the keys earlier is not documented.

GitLab: one day to the PoC, 17 days to exploitation

Both CVSS 10 flaws are confirmed. CVE-2026-97229 was closed on 12 October with 19.4.2, 19.3.5 and 19.2.8; the next day Rapid7 published a proof of concept and wrote that no confirmed exploitation existed yet. According to Rapid7 the path needs write access to a public project, even though the rating says "no authentication". CISA added the flaw to its KEV catalog on 29 October. That is the date of confirmed exploitation, the first attack may be earlier. CVE-2026-110264 followed on 21 October as a second regex flaw; 19.4.2 is still vulnerable to it. It is not in the KEV as of 6 November, and reports conflict on whether a public PoC exists.

Kernel, LiteLLM and Railway

Trend Micro's Zero Day Initiative sent five reports to the kernel security team on 21 October and, according to Sysdig, copied public lists. Phoronix describes it as an accident; we found no statement from ZDI. Two reports carry CVSS 9.0, and a CVE and a mainline fix were missing as of 28 October. Sysdig reports that TuxCare rebuilt the PoC for ZDI-CAN-33367, with root access on Ubuntu, Debian and AlmaLinux.

LiteLLM 1.107.0 was available on PyPI from 11:39 to 13:23 according to the vendor, the Docker tags until 14:20. That is a little over 100 minutes for PyPI. An earlier incident with 1.82.7 and 1.82.8 is documented by Datadog. Our own finding on it is in the post LiteLLM 1.107.0: malicious code and rotating keys. At Railway, 37.5 hours passed from the first latency alert (20 Oct 13:58) to the confirmation that the attacker no longer had access (22 Oct 03:32); the decryption of variables falls on 21 October between 07:25 and 09:18 according to Railway's report.

What supports "hours instead of days"

One event with data supports it: PHP2Shell, and there it rests on Amazon's telemetry. At GitLab, patch to public PoC is about a day and patch to confirmed exploitation 17 days. For the kernel it is at most three days to a rebuilt PoC; for eMudhra it is under two hours to the key being calculated back at Mozilla and a good two and a half days to test certificates in the logs. Outside October, one vendor reports a first attempt less than nine hours after CVE publication for the Alpine OpenSSH flaw (Help Net Security); our fleet check for it is in the Alpine post. As a general rule the claim stays open: a honeypot operator only sees what hits its own sensors, and the KEV date is an upper bound. Independent measurements across many events are missing.

For PHP2Shell we also set the clock against ourselves. According to our PHP measurement post, our own image was running on 21 October at 17:07 UTC, 3 hours 33 minutes after the advisory's GitHub timestamp, and the last affected container started at 20:28:10, 6 hours 54 minutes after it. More posts on flaws and supply chain are collected in the hub Security and privacy.

Recommended patch window

For systems reachable from the internet with unauthenticated remote code execution, the day of the advisory is the deadline, restart included. Next come platforms that hold credentials for other systems, meaning CI, build servers and secret stores: after an incident, rotation comes before root-cause analysis. For flaws that surface after the advisory, search backwards from 17 October, not from the publication day. Internal systems without stored secrets may wait a few days. Anyone who wants their inventory and patch window reviewed will find the offer under Services.