Black October 2026: the month the CVE count broke

A record month on every axis: the most CVEs ever published, the largest Microsoft Patch Tuesday, a certificate authority forced out of the web, and PHP2Shell. A sourced count of what was reported, fixed and exploited in October 2026.