AW Dev Rethought Radar | October Pulse (Oct 18–24, 2026)

After a longer pause than planned, the Rethought Radar is back. And it’s returning to one of the most turbulent weeks in recent tech memory — a week where infrastructure failed, trust systems collapsed, and the security community coined a name for the month: Black October.

🔭 The Rethought Radar

• The Internet Had a Very Bad OctoberTwenty-seven significant cybersecurity incidents in a single month. PHP2Shell exposed RCE vulnerabilities in a runtime that powers 70% of the web — and attackers were exploiting it four days before patches existed. GitLab hit a CVSS 10.0 unauthenticated RCE. LiteLLM, one of the most widely used AI gateways, was compromised in a supply chain attack. SharePoint has an unpatched zero-day under active exploitation right now.The scale isn’t what’s alarming — it’s the variety. Runtime, CI/CD, AI tooling, certificate infrastructure, cloud platforms, all in the same window. Black October isn’t a campaign. It’s a reminder that the attack surface of modern software is enormous, and it all needs to hold at once.

  ---

• A Certificate Authority’s Keys Were Recovered in Under a SecondeMudhra, an Indian certificate authority trusted by Chrome and Firefox, had eight intermediate CA private keys compromised — not stolen, but mathematically recovered from their own public certificates due to catastrophically insufficient entropy. One key had a value of 4. Chrome and Firefox moved to distrust the CA within hours of disclosure. eMudhra has since announced it is exiting the certificate business entirely.This is the trust model of the internet working exactly as designed — and also a reminder of how much that model depends on CA operators generating keys correctly. When they don’t, the entire chain built on top of those keys becomes worthless overnight.

  ---

• Google Cloud’s London Region Failed — And the Redundancy Didn’tOn October 20, a power outage in Google Cloud’s europe-west2-b zone triggered an eight-hour incident affecting 38 products. The story that emerged from the postmortem is more troubling than the outage itself: the two healthy zones in the same region did not absorb the load from the failed zone as expected. Revolut, Lloyds, and HSBC were among the affected.Multi-zone architecture is the standard recommendation for resilience. This week showed that the guarantee only holds if the healthy zones actually have capacity to absorb the failed one — and that assumption is not always tested until something breaks.

  ---

• An AI Pentesting Tool Was Used in a Nation-State CampaignARTEX, an open-source autonomous AI pentesting system published on October 8, was used by a Chinese APT group in combination with stolen ConnectWise credentials to compromise over 2,250 Microsoft 365 tenants. Privileged access in under three hours per target. The repository was deleted after the attack became public. It had over 800 forks.The original is gone. The forks are not. This is the first well-documented case of an AI offensive security tool deployed at scale in an active nation-state campaign — and it happened within two weeks of the tool being published.

  ---

• SBI Customer Data Appeared on BreachForums3,897 State Bank of India customer records were posted on BreachForums this week, including names, account details, and contact information. SBI has not issued a formal public statement at the time of writing.The number is small by breach standards. But SBI is India’s largest bank, and any confirmed breach of its customer data carries outsized trust implications — particularly as digital banking adoption continues to accelerate across India’s retail banking base.

🔭 Trend to Watch — When Everything Fails at Once

• The signal from this week isn’t any single incident. It’s the simultaneity.
• Certificate infrastructure, cloud availability, AI tooling supply chains, runtime security, national banking data — these are not connected systems. They failed in the same window independently. That pattern suggests not a coordinated attack but something more structural: years of accumulated technical debt, under-resourced security teams, and infrastructure assumptions that haven’t been tested at production scale.
• The industry talks about resilience constantly. Black October is what it looks like when resilience is assumed rather than built.

✍ Closing Note

That’s your Radar, rethought ✨

The Radar is back — and it’s returning to a week that will be cited for a while. Whether it’s your runtime, your cloud region, your AI dependencies, or your CA trust chain, October 2026 made one thing clear: the surface area of a modern system is larger than most teams are prepared to defend.

Back next week with more signals 🔭