Skip to main content

Black October

Patched PHP2Shell? Now find out what happened before you did.

We're giving organizations a free 90-day WitFoo Analytics Pro license to look back through what reached their servers. Complete the WitFoo Certified Analytics User course before the 90 days are up, and we'll extend it to 180 days in total.

Request your free license

What happened

Black October is the name people have given to a cluster of security disclosures between October 19 and 22, 2026. It is a community label, not an official one.

One of them is PHP2Shell: two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 by PHP under CVSS v4.0. They can let an attacker who has not logged in run code on a server that uses PHP to serve web requests.

PHP released fixes on October 21, 2026. Attempts to exploit the flaws were reported the same day. The NSA and the UK's National Cyber Security Centre both urged organizations to update. For systems that can't be fixed right away, the NSA recommended taking them offline until they can be fully mitigated, and the UK agency said organizations should consider it.

Patch first

Update every PHP installation that serves web requests to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's fixed package, and restart every PHP worker so the fixed code is what runs. Follow PHP's announcement and your distribution's advisory.

Then look back

Patching closes the door. It doesn't tell you whether anyone came through it first. WitFoo Analytics Pro gives your team one place to look:

  • It collects the logs your firewalls, endpoints, cloud services and web servers already produce.

  • It parses them with parsers WitFoo writes and maintains, so there are no parsing rules for you to write.

  • Your team searches the logs from every source it collects in one place, by field, value and time range.

  • It shows which systems talked to which, and when each connection was first and last seen.

  • It can match the IP addresses, domains, URLs, file hashes and sender addresses in your logs against STIX threat-intelligence feeds you turn on.

  • It groups related activity into work units, and marks a work unit Disrupted when a block was the last thing that happened and the activity stopped.

  • If your Apache, nginx or HAProxy logs come into WitFoo, your team can search their raw text for the signs researchers describe, such as PHP memory-limit errors, bursts of HTTP 500 responses and crashing workers, and can add its own lead rule to flag them.

  • Your team can add notes and attach files to a work unit, and its activity log shows who changed its status, added a note or removed evidence, and when.

See WitFoo Analytics at work in our demos.

Finding PHP2Shell in WitFoo Analytics

Watch on Vimeo

The offer

  • A WitFoo Analytics Pro license, free for 90 days from the day we issue it.

  • Complete the WitFoo Certified Analytics User course before your 90 days are up, and we'll extend your license to 180 days in total.

  • One license per organization.

  • It runs on infrastructure you control. Deploy the WitFoo Appliance from GitHub, then enter your license key during setup.

  • No payment details and no sales call.

  • Requests close at the end of November 30, 2026, US Pacific time. Licenses already issued run their full term.

  • When you're ready to buy, every legitimate route is on How to buy.

Request your license

Thanks. Check the address you entered for your license key, or for the next step if we need to check something first.

We send your license key here.

Your country decides which license agreement applies.

We use your organization name, email and country to issue and manage your license, extend it when you finish the course and contact you about this offer. See our privacy policy.

Requests for this offer closed on November 30, 2026. Licenses already issued run their full term. The 15-day trial is still open: see How to buy.

Questions

Is this the same as the 15-day trial?
No. The 15-day trial is still open when you set up the appliance. This license is for WitFoo Analytics Pro and runs for 90 days, or 180 with the course.
Is it really free?
Yes. There's no fee and we don't ask for payment details. If someone asks you to pay for this license, the request didn't come from us.
Where does it run?
On infrastructure you control: your cloud tenancy, your data center or your office. We don't offer WitFoo as a hosted service.
What is the WitFoo Certified Analytics User course?
WitFoo's user course for Analytics, on our training site at witfoo.myabsorb.com. It's open now, and the email with your license key links to it. Finish it before your 90 days are up and your license runs to 180 days in total.
What happens when the license ends?
WitFoo keeps your data readable and reports the license as expired, and renewing clears that without a restart. To keep using it, buy through a WitFoo channel partner or your cloud's marketplace: every route is on How to buy.
Who can ask for one?
Any organization, one license each. Whoever sends the request must be able to accept the license agreement for the organization.

Sources