Black October
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Several security incidents in the week of 17 October 2026 have been grouped as "Black October." The most prominent are PHP2Shell, two PHP flaws (CVE-2026-109618 and CVE-2026-109619) that Wiz found with AI assistance and used to demonstrate unauthenticated code execution on WordPress, Drupal and Joomla. Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. LiteLLM 1.107.0 was briefly published to PyPI with credential-stealing code, so teams should rotate secrets. eMudhra's weak CA keys were reported but not independently verified.
Why it ranked
No. 15 of 62 with a score of 0.67. The panel rated it highest on audience breadth (0.82) and reader interest (0.76), lowest on technical depth (0.48). The judges disagreed most on new information (spread 0.66), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2Contestedjudges differ by 0.66 on new information
- Significance0.70
- Reader interest0.76
- Audience breadth0.82
- Practical relevance0.74
- Substantiated0.65
- Technical depth0.48
- New information0.63
- Counts against: Promotional0.04
- Counts against: Overclaim0.38
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.77 | 0.62 | 0.72 | 0.70 | 0.14 | +0.24 | +0.168 |
| Reader interest | 0.65 | 0.80 | 0.82 | 0.76 | 0.17 | +0.26 | +0.197 |
| Audience breadth | 0.97 | 0.70 | 0.78 | 0.82 | 0.27 | +0.13 | +0.106 |
| Practical relevance | 0.82 | 0.72 | 0.68 | 0.74 | 0.14 | +0.22 | +0.163 |
| Substantiated | 0.64 | 0.60 | 0.72 | 0.65 | 0.12 | +0.05 | +0.033 |
| Technical depth | 0.66 | 0.40 | 0.38 | 0.48 | 0.28 | +0.05 | +0.024 |
| New information | 0.84 | 0.20 | 0.86 | 0.63 | 0.66 , above the contested threshold | +0.05 | +0.032 |
| Promotional | 0.09 | 0.03 | 0.01 | 0.04 | 0.08 | −0.19 | −0.008 |
| Overclaim | 0.47 | 0.35 | 0.32 | 0.38 | 0.15 | −0.11 | −0.042 |
| Sum of contributions | +0.673 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.673 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-26/15/"><img src="https://rubric.hrih.si/badge/2026-10-26/15.svg" alt="Ranked #15 on Rubric, 26 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 5 matches source · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
A security researcher reported on 17 October 2026 that private keys for eight eMudhra intermediate CA certificates were cryptographically weak, generated with insufficient randomness during a key-generation ceremony in April 2025.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the private keys associated with eight intermediate certificate authority (CA) certificates operated by the Indian digital trust provider eMudhra were cryptographically weak”
The source says No passage could be compared.
Source cited by the article: blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates
Couldn’t checkNumber
Google Chrome blocked the affected public keys via CRLSet, and Mozilla distributed revocations to Firefox users via OneCRL, without requiring an immediate browser restart.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Google Chrome blocked the affected public keys through its CRLSet mechanism, while Mozilla distributed revocations to Firefox users through OneCRL”
The source says No passage could be compared.
Source cited by the article: blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates
Matches sourceQuote
eMudhra stated that none of the affected intermediate authorities had issued end-entity certificates and that it found no evidence of a breach of its infrastructure or customer data.
The cited source says the same thing.
The article says “eMudhra stated that none of the affected intermediate authorities had issued end-entity certificates and that it had found no evidence of a breach of its infrastructure or customer data”
The source says “No certificates had been issued from any of them, our infrastructure was not compromised, and no data was breached”
Source cited by the article: emudhra.com/en/post/certificate-security-incident
Couldn’t checkDate
On 22 October, eMudhra announced it would withdraw from the global SSL/TLS certificate business following the incident and loss of trust from major technology companies.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On 22 October, eMudhra announced that it would withdraw from the global SSL/TLS certificate business following the incident”
The source says No passage could be compared.
Source cited by the article: reuters.com/legal/litigation/indian-firm-emudhra-exits-global-digital-certificates-business-after-2026-10-22
Matches sourceDate
On 21 October 2026 the PHP team released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), that could let unauthenticated attackers execute arbitrary code.
The cited source says the same thing.
The article says “the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell”
The source says “The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging…”
Source cited by the article: helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619
Matches sourceCausal conclusion
Wiz researchers demonstrated remote code execution against WordPress, Drupal and Joomla installations, and the research involved AI-assisted vulnerability discovery and exploit development.
The cited source says the same thing.
The article says “The research involved AI-assisted vulnerability discovery and exploit development”
The source says “demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest), using their latest container images at the time of testing”
Source cited by the article: wiz.io/blog/php2shell-php-rce
Matches sourceVersion
PHP released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October.
The cited source says the same thing.
The article says “The PHP project released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October”
The source says “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution”
Source cited by the article: php.net
Matches sourceVersion
Malicious LiteLLM version 1.107.0 was available on PyPI between 11:39 and 13:23 UTC on 21 October, per LiteLLM's incident report.
The cited source says the same thing.
The article says “the compromised PyPI packages were available between 11:39 and 13:23 UTC on 21 October”
The source says “PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC”
Source cited by the article: docs.litellm.ai/blog/security-incident-oct-21-2026
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 26 Oct 2026, 07:27 UTC. It played no part in the ranking.