What October 2026 Taught Engineering Leaders About Preventing Supply Chain Attacks

In one week of October, critical problems hit the PHP runtime, a compression library that HTTP clients depend on, a self-managed source control platform, a set of certificate authorities and a package on PyPI. A lot of that exposure came through components the affected teams didn't write themselves. Codacy's dependency scans found the eMudhra flaw in 576 repositories across 72 organizations.

One Week, Five Layers of the Stack Broke

The disclosures landed on 17 October (eMudhra) and 21 October (PHP2Shell, Brotli and GitLab). Here is what broke, layer by layer:

• Runtime: PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both rated critical (CVSS 9.2). CISA added both to its Known Exploited Vulnerabilities catalog on 26 October. Delft University's Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses. One researcher recorded successful shell execution on honeypots in a favorable setup, while Sophos revised its own report to scanning and failed attempts.
• Library: an out-of-bounds write in Google's Brotli compression library, CVE-2026-111497, rated critical (9.2). Imperva showed it could be exploited for remote code execution against an official Node.js image. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October. Akamai's researchers track it as Node2Shell.
• Toolchain: remote code execution in GitLab Community and Enterprise Edition through bugs in Ruby's Onigmo regex engine. Our incident log rates CVE-2026-110264 at CVSS 10.0 with no exploitation reported, and CISA added a related GitLab flaw, CVE-2026-97229, which lets an unauthenticated user execute arbitrary code, to its KEV catalog on 29 October.
• Trust layer: a key weakness at the eMudhra certificate authority, CVE-2026-111943, disclosed 17 October. It affected eight intermediate CA keys, which were revoked on 18 and 19 October.
• Supply chain: a malicious LiteLLM release (v1.107.0), published to PyPI and Docker on 21 October, that carried credential-stealing malware.

Then the layers started stacking. CISA notes that a Linux kernel flaw, CVE-2026-46300, "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."

Any one of these would have been a normal bad week. The trouble was that every layer had its bad week at once.

The Patch Window Is Getting Shorter

Attackers did not wait for the patch cycle. AWS saw attempts to exploit the PHP flaws as early as 17 October, four days before public disclosure. The official clock was short too: CISA gave US federal agencies until 29 October, three days after the listing, to deal with them.

An attacker needs one exploit that works. A company needs a ticket, an owner, a change window and a test run before anything moves.

Change control exists for a good reason. Rushed patches can break production. So I'm not arguing for skipping the controls. I'd rather see teams decide the patch path before a disclosure lands, so a fast fix can still go through review, testing and a rollback plan.

The pressure is also getting worse. Verizon's 2026 Data Breach Investigations Report says software vulnerabilities have overtaken stolen passwords as the top way attackers get in, and that attack techniques "are now being bolstered by generative AI." If finding bugs gets cheaper for defenders and attackers alike, I'd plan for more critical CVEs a month, not fewer.

Much of Your Exposure Is Code You Didn't Write

Much of the risk in an incident like this sits in dependencies and container base images rather than in first-party code.

Codacy's own scan data shows how that played out.

Dependency scanning found the eMudhra flaw CVE-2026-111943 in 576 repositories across 72 organizations, with 640 findings still open (the CVE was assigned so that updated CA certificate bundles, such as ca-certificates and the copies shipped with Go, Java and Perl, could be tracked like any other package fix).

It found the Brotli flaw in 12 repositories across 11 organizations. Container scanning, which covers the Docker images customers upload to Codacy, found the eMudhra flaw in 96 repositories and the Brotli flaw in 47, with 163 Brotli findings still open.

The PHP2Shell flaws turned up in one repository's images. The GitLab flaw CVE-2026-110264 didn't show up in either scan, as you'd expect: it sits in a server teams host themselves, so it needs a patch path rather than a dependency fix.

So the question for the next morning is "is the vulnerable path reachable in our code?", and ideally you want the answer within hours, not days. Answering it completely is hard. A dependency map (see our guide to software dependency management) tells you whether the package is in your tree and how it got there. Software composition analysis narrows it down quickly, but that last check still needs someone looking at your code.

How to Prevent Supply Chain Attacks Before the Next Black October

Preparing doesn't mean another fire drill. It means changing the routine so the next disclosure is a short, rehearsed exercise rather than a scramble. Four habits are a good place to start:

• An always-current dependency inventory. A software bill of materials generated once a year for an audit can be out of date the day a CVE lands.
• Security checks in the pull request, before code merges. Catching a vulnerable dependency or an exposed secret at the PR is usually cheaper than finding it in production, and it is the part of CI/CD pipeline security developers actually see.
• Pre-planned patch paths, including for self-hosted tools like source control. Decide now who patches what, in which window, and how to roll back. This is the answer to the change-control objection.
• Credential hygiene. The LiteLLM release carried malware that steals credentials, so short-lived tokens, rotation and secrets scanning belong next to patching.

We cover the wider practices in software supply chain security.

Budget for Security as a Running Cost

Here is where Codacy fits. Dependency scanning shows the chain to a transitive vulnerability, with a prompt to find the affected functions in your code. That narrows the reachability question, although it is not full reachability analysis. Merge gates on SAST, secrets and dependencies run on every pull request, and you can export an SBOM in CycloneDX.

On the Business plan, every dependency in the codebase and every container image SBOM is re-scanned daily for new CVEs.

Whatever tools you use, the decision in front of a VP is about money and habits. Weeks like Black October are likely to come again. Fund the inventory, the PR checks and the patch paths as a standing budget line, the way you fund on-call. Otherwise you are likely to pay for them anyway, as emergency spend after the next big disclosure.

Supply Chain Attacks FAQs