Between October 19 and 22, 2026, a large number of serious security flaws and attacks were disclosed at once, and security teams started calling it Black October. The list included critical flaws in PHP, a maximum-severity flaw in GitLab, tampered releases of popular developer tools and a ransomware group with at least 600 victims.
Most of those affect servers and developer platforms. For IT leaders responsible for laptops and desktops, the question is simpler: when a fix is released, does it get installed on every device, and can you show that it did?
I talked about this with Steve Arlin in a webinar on October 22. We are finding vulnerabilities at a record pace, and the time allowed to fix them keeps getting shorter. That applies to every industry, and it isn't only a security team problem. (Takeaways from the webinar.)
Black October in 69 seconds: what happened, what changed, and where Devicie fits.| Disclosure | What was reported | Source |
|---|---|---|
| PHP | Two critical flaws in PHP core, each rated CVSS 9.2, found with the help of AI after more than a decade in the code. Fixed October 21. | Axios, Bitsight |
| GitLab | A flaw rated CVSS 10.0 that allows remote code execution without logging in. Fixed October 21. | Forkast |
| Poisoned releases | Tampered builds of popular tools, including a malicious LiteLLM 1.107.0 and backdoored OVHcloud command-line releases on October 19. | Forkast, SecurityToday |
| SafePay | Ransomware named in a joint FBI, CISA and US Secret Service advisory on October 20, citing at least 600 victims. | CISA advisory AA26-293A |
Most of these attacks had been running for months. Data was copied through a compromised login from May to September. A firewall flaw was exploited after its May fix. A vendor's update channel was tampered with in May and July (SecurityToday). What happened in October was that they were all disclosed in the same few days.
What changed is how quickly exploitation starts. In the 45 minutes after the PHP fix was announced, Cloudflare saw tens of thousands of attempts to exploit the flaw across its network. Within two hours it was hundreds of thousands, and by the time Cloudflare's CEO posted about it, millions (404 Media). Once a fix is public, attackers can study it to find the flaw it closes.
On October 13, Microsoft released more than 1,400 fixes, the most it has shipped in a single Patch Tuesday. One of them, for a Windows Shell flaw tracked as CVE-2026-96951, was already being exploited (Dark Reading). Updates to third-party apps come on top of that.
A fix can be ready to deploy without being installed. Three things commonly sit in between: a setting that changed after it was configured, an app update that was prepared but never rolled out, and reporting that shows what was sent rather than what was installed. Knowing the difference per device is how you show that a fix landed.
Devicie works on the device side, inside Microsoft Intune. It checks your Intune policies every hour, corrects drift when it finds it and tells your team what it changed. It prepares and tests new versions of supported apps, your team controls the rollout, and the current version plus the two before it are kept. It also reports both states for each device: ready for deployment and installed.
For regulated organizations this matters more. Speed, automation and trust need to be built into the vendors and partners you depend on.
Devicie doesn't update web servers or developer platforms, manage secrets and credentials, or run your Windows update rings. Those stay with your security and infrastructure teams and their partners.
A free Intune Health Assessment shows where your Intune environment stands today.
Request your free Intune Health Assessment
Alex Hesterberg is Chief Executive Officer of Devicie.