Black October vulnerabilities expose critical flaws in web and CI/CD pipelines
A series of critical security incidents dubbed "Black October" has exposed remote shell attacks in PHP-based systems and supply chain compromises in Python ecosystems. The events highlight persistent operational failures in key management and the prevalence of legacy software in enterprise environments.
A series of critical security incidents in the past week, termed "Black October," includes remote shell attacks affecting PHP-based sites like WordPress and Drupal, alongside a certificate authority compromise involving crackable keys. One issue involved a private key for an intermediate certificate, posing man-in-the-middle and supply chain risks, which led to updated Python releases with new bundles. LiteLLM suffered a second exploit this year after keys exfiltrated from its build process were used to drop branch protections and make releases. This followed a key that was not fully revoked after being accidentally pushed to GitHub. A poisoned supply chain attack targeted CI pipelines, with a malicious LiteLLM package on PyPI receiving 49,000 downloads in two hours. Additionally, the Brotli and Brotli CFFI libraries had a remote code execution vulnerability, affecting Python installations with specific transitive dependencies. These incidents highlight the prevalence of PHP in enterprise systems, including SAP ECC servers, and the rapid pace of modern exploits compared to previous years. One analyst noted that the LiteLLM example is a DevOps issue, stating that code got pushed to repositories and keys didn't get revoked, which are operational failures.