Brief · Builders

Are IR Teams Really Drowning in "Black October"?

By alkizz · Oct 30, 2026

The new version of the Black October story is that the people who clean up breaches can't keep up. The Wall Street Journal ran "Cyber Responders Strained By 'Black October'" on Oct 29, and an X post turned a Sophos blog into "SEVEN major incidents in SEVEN days." Some of that holds up and some of it got bigger on the way to your feed, so here's which is which.

What the Journal actually says

The free part of the WSJ Pro piece says a wave of fast-moving threats "is stretching emergency-response services, with surging demand from targeted companies hitting all-time highs," and calls this "a period industry insiders have dubbed "Black October."" The free part doesn't name the insiders, and nobody has turned up who coined the term. CNBC and the Guardian used it on Oct 23 without naming anyone either. The Journal also says "Many blame artificial intelligence," which is the paper reporting what people think, not a finding. The rest of the article is behind a paywall, so that's all I'm quoting.

What Sophos actually said

The "seven in seven" number comes from a Sophos blog post by Ross McKerchar. He wrote that "In seven days, Sophos' internal SecOps team responded to seven incidents," and listed them: abuse of a Sophos product through a trial account, the ConnectWise Cloud Backup compromise, PHP2Shell, the eMudhra weak SubCAs, the LiteLLM supply-chain compromise, critical Node.js bugs and a GitLab RCE. Then he wrote "A year ago, that would have been a quarter's worth," and, to his credit, "Admittedly this is a sample size of one."

So these were Sophos's own security team dealing with things that hit Sophos, mostly vulnerabilities and supply-chain problems, not seven customer breaches worked by an incident response team. He also wrote "We avoided major impact, but only through a concerted effort and some very long hours." Separately, he says Sophos's "own IR function has never been busier and is forecasting an industry-wide capacity crunch," so Sophos does think responders are stretched. That's a claim worth taking seriously, but the seven-in-seven number isn't the evidence for it.

He's careful about AI too. He cites Sophos X-Ops research putting attackers at an "early-adopter stage," and says that in Sophos's MDR cases, attackers used AI "as an assistant with a human in control." He also notes that "PHP2Shell has not, so far, become the mass-exploitation event many of us braced for."

How it got bigger on X

An X post opened with "WTF" and said Sophos's "incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS." Almost every part of that changed on the way. The internal security team became the incident-response team, "major" got added to incidents Sophos said it avoided major impact from, and "a year ago, that would have been a quarter's worth" became "normally takes three months." The caveat about a sample size of one didn't make the trip at all. The post's screenshot shows only the WSJ headline and byline, and the free part of the article doesn't mention Sophos, so I can't confirm whether the Journal reported any of this.

What hasn't changed

The PHP bugs are still real. CISA added both to its Known Exploited Vulnerabilities catalog on Oct 26, which means it has evidence they're being exploited, and federal civilian agencies had until Oct 29 to patch. Our PHP brief is still a 5. The scariest AI detail from the first week is still gone, too: Unit 42 retracted its report of an AI-driven intrusion at a European government agency on Oct 25, saying it's "unable to confirm that initial access is associated with the specific PHP2Shell CVEs."

The score

A 2. The busy-responder story may well be true, and the PHP bugs underneath it are a 5 on their own. But the most-shared number in this story is one company's internal team in one week, by its author's own description a sample size of one, and nothing here gives you a new thing to patch.

My take: I've run IR teams that see more than double that every week. And those seven weren't IR cases. They were Sophos's own internal security team dealing with bugs and supply-chain problems that hit Sophos itself. Its IR team says it's never been busier, so the strain may be real, but this number isn't the proof.

What to do:

Finish the PHP to-do list. Patch, restart workers, rebuild images, and confirm the version you actually run. It's all in the PHP brief.
Shrink what's exposed. McKerchar's advice is the boring kind that works: "Remove nice-to-have internet-facing services. Put the rest behind a VPN, ZTNA, or an authenticating proxy," and "Turn on automatic updates wherever vendors offer them."
Keep the evidence. If a PHP host was reachable before you patched, preserve web server, PHP and endpoint logs before you rebuild anything, so whoever helps you later has something to work with.
Know who you'd call. If responders really are busy, now is a good time to find your IR retainer or insurer's contact and check how fast they say they'll respond.

Sources

← All briefs