Black October 為何是採用 Passkeys 和 2FA 的好理由

What happened

October 2026 has been nicknamed "Black October" in infosec because of several major incidents and vulnerability disclosures. The headline items:

• PHP2Shell: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, reported October 21, affecting a language that powers roughly 70% of websites.
• LiteLLM supply-chain attack: the project's release infrastructure was compromised on October 21, and poisoned PyPI packages were live for under two hours.
• eMudhra: a researcher reported that private keys for eight intermediate CA certificates were cryptographically weak, so fraudulent certificates could be forged. Literally used the number 4
• Password interception: attackers used 333 compromised Tor exit relays starting October 2 to redirect SSH connections to interception servers and steal passwords.

Where passkeys fit (and where they don't)

A passkey won't patch your PHP runtime or stop a poisoned package. If your takeaway is "enable passkeys and I'm safe," stop reading and go patch.

What passkeys do is take away a whole class of attack that keeps feeding incidents like these: stolen, phished, and replayed passwords. A passkey is a per-site key pair. The private key stays on your device, and the server only stores a public key. So:

• A server-side breach leaks nothing an attacker can log in with.
• A phishing page can't harvest a credential that is bound to the real domain.
• There's nothing to type into an interception server.

They're also easier to use. The FIDO Alliance's 2026 index found 36% of successful sign-ins now use a passkey, with a 93% success rate versus 78% for passwords and traditional MFA.

Passkeys vs. SMS 2FA

"But I already have 2FA." Good, keep it. But not all 2FA is equal, and the weakest common version is the text message code.

Why phone-based 2FA falls short

• SIM swapping: an attacker persuades your carrier to move your number to their SIM, and your codes now go to them.
• Interception: texts aren't end-to-end encrypted, and telecom-level weaknesses (like SS7 abuse) can expose them.
• Real-time phishing: a fake login page asks for your password, then your code, and relays both to the real site instantly. The code is valid and fresh, so it works. This is the most common failure.
• Malware: anything that can read your messages or notifications can read the code.
• Push fatigue: attackers spam approval prompts until someone taps "yes."

The root problem is that a six-digit code is just text. You can type it anywhere, including into the wrong site.

Why passkeys are harder to attack

• Origin binding: your browser or OS only produces a signature for the real domain. On a lookalike site the passkey simply doesn't work, so there's no code to be tricked into entering.
• Nothing to steal in transit: the private key never leaves your device's secure hardware, and the site stores only a public key. A server breach doesn't hand attackers a working credential.
• No shared secret: there's no password or code to replay, guess, or reuse across sites.
• Local verification: Face ID or Touch ID unlocks the key on your device, and your biometric isn't sent to the site.

This matches what researchers saw in August 2026: the large campaigns hitting organizations, such as Mirage2FA (4,532 domains) and Kali365 device-code phishing, defeated the kinds of factors that passkeys block.

Caveats

• Recovery is the soft spot. If account recovery falls back to SMS or email, an attacker can go around your passkey. Lock that down too.
• Synced passkeys lean on your cloud account. An Apple or Google account takeover matters more once your passkeys live there, so protect it with a strong recovery setup.
• Local compromise still counts. Malware on your device is a different problem, as CVE-2026-34348 showed.
• Any 2FA beats none. SMS is weaker than an authenticator app or a passkey, but far better than a password alone.

Why Apple passkeys

• Built in: they live in iCloud Keychain / Passwords, so there's no extra app to install.
• Biometric unlock: Face ID or Touch ID is the whole login flow.
• Synced and end-to-end encrypted across your Apple devices, so losing a phone doesn't mean losing access.
• Cross-device sign-in: you can use a QR code to sign in on a non-Apple machine.

The trade-off is ecosystem lock-in. If your life spans Windows, Android, and Linux, look at the alternatives below.

Alternatives

Passkeys aren't magic

In August, SpecterOps presented "Pass-the-Passkey" research at Black Hat covering more than 20 techniques across Windows 11, Entra ID, browsers, and password managers. One finding was CVE-2026-34348, which Microsoft patched in July. The fair summary: the cryptography held, and passkeys moved the attacker from remote and cheap to local and expensive. That's a win, but "we deployed passkeys" isn't the end of the job.

What to do this week

1. Patch PHP, Node.js, and GitLab if you run them.
2. Rotate any secrets that touched LiteLLM or other affected tooling.
3. Turn on passkeys for your email, Apple/Google account, GitHub, and password manager first.
4. Keep a recovery path: a second device or hardware key.
5. If you build auth, add WebAuthn support to your app.

October is also Hacktoberfest and Cybersecurity Awareness Month

Black October landed in the middle of two other October traditions, and they pair well.

Cybersecurity Awareness Month runs all of October, and it's long been about the basics: strong passwords or a password manager, multi-factor authentication, spotting phishing, and updating software. One 2026 write-up reports this year's theme from the National Cybersecurity Alliance as "Don't Make It Easy For Them," with extra attention on AI-driven risk. Themes differ by country (Canada's campaign is "Your best defence is you"), so check your local campaign. Passkeys fit the spirit: they remove the easiest thing for an attacker to steal.

Hacktoberfest 2026 is different from the one you may remember. It's now run by Major League Hacking and DEV with DigitalOcean, and it's built around 300+ in-person events plus an online event focused on open-source AI. Pull requests no longer count toward rewards, partly because counting them led to maintainer burnout from low-effort contributions. That's worth keeping in mind below: the goal is useful fixes, not PR volume.

Want to help fix this stuff? Contribute to open-source security

Much of what broke in Black October (PHP, Node.js, GitLab, LiteLLM) is open source, and maintainers are stretched. Here's how to help without adding noise:

1. Start with software you already use. You know its quirks, and your fix helps you too.
2. Filter issues. On GitHub, look for labels like good first issue, help wanted, and security, and comment to claim an issue before you start.
3. Read CONTRIBUTING.md and SECURITY.md first. If you find an actual vulnerability, don't open a public issue. Follow the project's security policy and report it privately.
4. Turn on 2FA for your GitHub account. Many security-focused projects require it.
5. Quality over quantity. Understand every line you submit. OpenSSF's own newcomer guide warns that leaning on AI coding tools for a first contribution does more harm than good.

Places to start

• OpenSSF: From beginner to builder, your first code contribution
• OpenSSF on GitHub: home of projects like Scorecard and Allstar
• bomctl: an OpenSSF Security Tooling project for working with SBOMs
• VulnerableCode: an open vulnerability database with good first issues
• GitHub Security Lab and the GitHub Advisory Database
• OWASP projects
• Hacktoberfest 2026 and what changed this year

Sources

• Black October (information security) – Wikipedia
• Black October: Many attacks had been running for months – SecurityToday
• FIDO Passkey Index 2026 – Start with Identity news archive
• Passkeys had a hard month, and none of it was the cryptography – Start with Identity
• Hacktoberfest 2026 – official FAQ
• Cybersecurity Awareness Month: Don't Make It Easy For Them – Cyber Magazine
• OpenSSF: From beginner to builder, your first code contribution