Let's Talk About Black October

In October 2026, a pile-up of unrelated major software vulnerabilities dubbed Black October exposed widespread patching bottlenecks across the industry, particularly impacting Java and Gradle builds through compromised certificate authorities and vulnerable native libraries. Gradle investigated its own exposure, finding that its CI agents and official Docker images trusted a forged TLS certificate chain because underlying JDKs carry their own trust stores. The team recommends immediate actions including updating JDKs, turning on dependency verification and locking, and auditing native code like brotli4j. Open article →