Tag: 2026 midterms

The Fear Is, Of Course, That Trump Will Latch On To ‘Black October’ As The Reason Why The Republicans Lost The 2026 Midterms (If They Do)

by Shelt Garner
@sheltgarner

I still have serious doubts that Republicans will lose the 2026 midterms in any meaningful way for a variety of reasons. People continue to be too distracted. The economy continues to chug along, even if inflation is up. It’s all sot of a lulz.

And, yet, I suppose it is possible that despite all my doom and gloom that Democrats might actually pull it off.

Which brings us to Trump.

Trump is notorious — FUCKING NOTORIOUS — for latching on to one simple idea and banging it into people’s minds to an absurd degree. So, I could totally see him latching on to the “Black October” computer security event going on right now as an excuse to dismiss any victory by Democrats as the ultimate political heist pulled off by rouge hackers.

Ugh.

The ultimate irony is, of course, if anyone had the means, motive and opportunity to “steal” the 2026 midterms, it’s Trump and MAGA Republicans. And, yet, no one listens to me and MAGA seems to always get away with anything they do, so that’s the ultimate lulz, I suppose.

Black October and the Trust Tax

How a week of AI-found bugs could cost the midterms something no hacker has to touch: our faith in the count.

Nine days before the midterms, the computer security world has given this month a name: Black October. It’s a good name. It’s also a slightly misleading one, and the gap between those two facts is where the real election risk lives.

What actually happened

Strip away the branding and Black October is a cluster of disclosures that landed within a few days of each other. The headliner is PHP2Shell: two flaws in the core PHP interpreter, patched on October 21, that let an attacker with no login run code on a web server. Every PHP version from roughly the last decade is hit by at least one of them. Since PHP sits underneath something like 70% of the websites on earth (WordPress, Drupal, Joomla, and a great many county government homepages), the National Security Agency told everyone running it to patch immediately, and outfits from Wikimedia to the Internet Archive briefly pulled services offline to do it.

Around that: a poisoned release of LiteLLM, a popular AI-gateway package, that harvested developer and cloud credentials; a batch of Node.js security fixes; and the revelation that an Indian certificate authority, eMudhra, had generated weak private keys for eight intermediate certificates, the kind of thing that in principle lets someone impersonate a secure website.

The part that makes this feel like a new era: the PHP bugs were found by AI. Researchers at Wiz, using frontier models from Google and OpenAI, found them back in August. That’s the same story we’ve been living since spring, when Anthropic’s Mythos started surfacing vulnerabilities faster than maintainers could fix them. Chris Krebs, CISA’s former director, told CNBC that about 3% of all the critical vulnerabilities ever discovered turned up in the past month.

Two caveats worth holding onto. First, nobody has found evidence of a single coordinated attack behind all this. It’s a disclosure wave, not an invasion. Second, so far most organizations have patched or mitigated without catastrophe. Even the origin of the name is shaky: it supposedly comes from an X post calling the preceding 48 hours the worst in security history, and at least one newsroom couldn’t find the post.

What it isn’t

Black October is a web-layer crisis. American votes are overwhelmingly cast on paper or leave a paper record, and they’re counted on tabulators that aren’t sitting on the public internet running WordPress. Nothing in PHP2Shell hands an attacker a path to change a vote total in a county that checks its paper against its machines.

So if the question is “can Black October flip the House?” the honest answer is that there’s no evidence pointing that way, and the architecture of American elections makes it a long shot.

But that isn’t the only question, and it may not be the important one.

The Florida preview

At 10 a.m. on October 21, VR Systems, the Tallahassee firm that hosts county Supervisor of Elections websites across Florida, pulled its public lookup tools offline in response to the PHP warning. With early voting underway, Floridians suddenly couldn’t check their registration, view a sample ballot, or find a polling place on their county’s site. The tools came back around 7 p.m.

The company’s chief operating officer stressed that voting and the voter rolls were untouched. That was true. From a trust standpoint, it was also almost beside the point. A get-out-the-vote organizer in Manatee County put it plainly: the outage “certainly doesn’t help voter confidence right now.”

That’s the template. No vote was touched. No data was stolen, as far as anyone has said. A vendor did exactly the responsible thing. And a voter who hit an error page during early voting now has a story, and stories travel farther than press releases.

Four ways this erodes trust without touching a ballot

1. Availability failures read as integrity failures. Most people don’t distinguish between “the website is down” and “the election is compromised.” Every county that takes a lookup tool or results page offline to patch in the next nine days is generating screenshots. From the outside, responsible patching and sabotage look identical.

2. The election-adjacent surface is huge, and much of it runs on the web stack that just broke. Check Point’s researchers argued back in June that the real 2026 exposure was never the voting machines but the trusted accounts, platforms and information channels around the election: campaign email, fundraising (they found thousands of exposed ActBlue and WinRed credentials), local news, and official websites. Election-night results pages are the most consequential example. A defaced or spoofed results page changes no counts. It can absolutely change a narrative for the hours before anyone corrects it. And the eMudhra certificate mess, minor as it may prove in practice, is a reminder that a padlock in the address bar isn’t proof a page is real.

3. The defenders are thinner than usual. The federal election-security apparatus has had a rough two years. CISA released its election infrastructure security plan just 40 days before the vote, and election officials called it late and inadequate after the agency’s election work was cut back; DHS maintains it has consistently supported them. The administration’s fiscal 2027 budget proposal would eliminate CISA’s election security program outright. Minnesota’s secretary of state said his office expected to spend about $250,000 on private penetration testing to fill the gap. Whatever you think of those cuts, the practical result is that a county IT shop, often two or three people, is triaging the worst PHP bug in memory with less federal backup than in any cycle since 2018. And Black October isn’t one patch. It’s the leading edge of a steady schedule of AI-found disclosures that will keep landing through Election Day and beyond.

4. The audience was primed before the bugs dropped. In July, President Trump used a primetime address to declassify intelligence he said showed China had obtained voter files on 220 million Americans across 18 states, and to warn of “shocking vulnerabilities” in election infrastructure. He said the goal was to earn confidence by fixing those weaknesses, not to undermine it. Critics noted that the intelligence community had previously concluded China did not interfere in 2020, that much voter data is publicly available anyway, and that he presented no evidence of altered outcomes; China called the claims fabricated. You don’t have to settle that dispute to see its effect: a large share of voters walked into October already told the system is wide open. Meanwhile, on the other end of the spectrum, fringe claims that 2024 itself was hacked still circulate. Both camps now have a real, scary-sounding event to fold into whatever they already believe.

That last point is the one I’d underline. The danger isn’t that Black October gives anyone the power to steal the midterms. It’s that it gives everyone the vocabulary to claim they were stolen.

Why I’m not panicking

Decentralization, the thing that makes American elections maddening, is also what makes them hard to hack at scale. Thousands of jurisdictions run different systems from different vendors. Paper records, post-election audits and canvass deadlines exist precisely so that a disputed result can be checked against something physical. Florida’s outage lasted about nine hours and was fixed before most people noticed. By OpenAI’s account, the PHP bugs were found by friendly AI before attackers got to them. The machinery of patching is visibly working, and loudly.

What to actually watch

A few honest tests for separating real problems from noise between now and certification:

  • Is the claim about availability (a site was down) or integrity (a count was changed)? The first is common and fixable. The second requires evidence from audits, not screenshots.
  • Who’s the source? Your county election office’s phone line or official accounts beat a forwarded screenshot.
  • Expect slower results in places that pull their results pages to patch. Slow isn’t stolen.
  • Watch the audits and canvasses, not election night. Election-night numbers are always unofficial.

Black October is a real event, and the AI-driven vulnerability flood behind it is the defining security story of the year. But its most likely casualty in November isn’t a vote count. It’s our shared willingness to believe one. That’s a tax we pay in trust, and how much we pay is partly up to us.

Sources

Can the Justice Department Stop a State From Certifying Its Election?

The Attorney General can’t stop a state from certifying its congressional results on his own. What he can do is ask a judge, send in the FBI, lean on the officials who sign the paperwork, and hand ammunition to the House. That’s the real menu behind the word “doomsday.”

On Thursday in Norfolk, Attorney General Todd Blanche was asked whether there was any scenario in which the Justice Department would try to block a state from certifying its midterm results. He didn’t say no. He said there were hypothetical “doomsday” scenarios anyone could dream up, that it’s never DOJ’s intention to improperly interfere, and that he wasn’t going to say there are no circumstances in which the department would act. He added that he isn’t “planning my days around the election to be somewhere to not certify.”

That’s a long way from a plan. It’s also a long way from “never.” Election Day is November 3, twelve days out. So it’s worth asking the obvious follow-up the press gaggle couldn’t: how would he even do it?

The short answer: he has no button to push

No federal law gives the Justice Department power to delay certification or challenge ballots. American elections are run by states and counties. Their officials count the votes, and their officials certify them.

DOJ’s lawful role is narrow. It enforces civil-rights and voting statutes, and it prosecutes individual people who break election law. Candidates and private citizens can sue over a result. The executive branch has no equivalent standing to halt a state’s canvass.

So a “doomsday” move by DOJ can’t be a direct order. It would have to be indirect, working through someone else who does have power over the outcome. There are four plausible routes.

Four ways a doomsday scenario would actually play out

1. Ask a federal judge to freeze certification

This is the most likely route, and the groundwork is already laid. DOJ can sue states to enforce federal election statutes, chiefly the National Voter Registration Act and the Help America Vote Act. Both are mostly about how states maintain voter rolls.

The department has already sued California to force a review of 18,000 registered voters it suspects may be noncitizens. NBC reports DOJ is weighing similar suits against more states, possibly after November 3. A post-election version would argue that ineligible ballots were counted in a close race and ask a judge for an emergency order pausing certification until they’re sorted out.

The catch: these statutes govern how rolls are kept going forward. They weren’t built to unwind a counted election, and federal judges have been deeply reluctant to stop certification on that kind of theory.

2. Seize the evidence

This is the scenario Senate Democrats are most worried about. The FBI could obtain criminal search warrants for ballots, voting machines, or records as part of a fraud investigation. Seizure wouldn’t legally void a result. But physically removing ballots or equipment could make recounts, audits, and canvasses impossible to finish on deadline.

Sens. Alex Padilla, Dick Durbin, and Sheldon Whitehouse have asked Blanche in writing to rule out seizing election materials before certification. They pointed out that the FBI Director’s own no-seizure assurance means little on its own, since the FBI answers to the Attorney General. Blanche’s Norfolk remarks did not give them that commitment.

There’s also a quieter tool: the Civil Rights Act of 1960, which requires officials to preserve federal election records for 22 months and lets the Attorney General demand them.

3. Squeeze the people who sign

Certification isn’t a machine. It’s county boards, canvassers, and secretaries of state putting their names on documents. A criminal investigation of election officials, or federal encouragement for a local board that balks, could produce delay.

We’ve seen local refusals before. In 2022, a county commission in rural New Mexico refused to certify primary results. A state court ordered it to certify, and it did. That’s the usual ending, because certification is treated as a mandatory duty, not a judgment call.

4. Hand the House a reason

For congressional seats, the last word doesn’t belong to a court or to DOJ. Under Article I, Section 5 of the Constitution, each chamber judges the elections of its own members, and the House can hear contested races under the Federal Contested Elections Act. DOJ allegations or referrals could become the evidentiary record for a House challenge to a seat.

Washington’s Attorney General Nick Brown, who leads election-protection work for Democratic state AGs, told Raw Story it would be remarkable in the worst sense for the House to reject a state’s certification. He also said that hypotheticals once dismissed as absurd now seem a lot more plausible.

The catch: every route needs an accomplice

Look at the four routes again and the pattern is obvious. Each one requires someone outside DOJ to go along.

  • A lawsuit needs a judge willing to freeze a state’s count.
  • A seizure needs a magistrate to sign a warrant, and it only delays the result; it doesn’t decide it.
  • Pressure on officials needs officials who crack, and state courts that let them.
  • A House challenge needs a House majority willing to refuse a seat.

On its own, the Justice Department can mostly manufacture three things: delay, legal pressure, and doubt. That’s not nothing. In a close race with a hard certification deadline, delay and doubt can be the whole game. But it isn’t the power to overturn a result.

Two ways to read “doomsday”

The charitable reading is that Blanche answered a hypothetical honestly. No Attorney General promises never to act under any circumstances. He said plainly that interfering isn’t the intent and that no such action is being planned. The administration and its supporters frame its election work, including the California suit and a record deployment of about 1,000 DOJ election monitors, as long-overdue enforcement against noncitizen voting.

The skeptical reading starts from context. Blanche was Trump’s personal lawyer, and he made these remarks while the department is suing states over voter rolls and preparing the largest monitoring operation in its history. DOJ sent about 289 monitors in 2022 and 714 in 2024, per CBS News figures. Voting experts say noncitizen voting is rare. To critics, declining to rule out post-election action is itself the message, aimed at officials who will be deciding whether to sign.

Either way, the structure holds. The Attorney General has no lever that stops a state from certifying. What he has is the ability to make certifying harder, slower, and more contested, and to give others with real power a reason to act. Watch the judges, the county boards, and the House. That’s where any doomsday scenario would actually be decided.

Sources

2027 Is Going To Suck

by Shelt Garner
@sheltgarner

For variety of reasons, but public and private, I have a feeling 2027 is going to suuuuuuck. It’s going to be horrible. The chief issue is a lot of the shittier elements of Trump’s Big Beautiful Bill will kick in, causing a lot of heartache for poor people like me.

Meanwhile, if somehow, miraculously, Democrats don’t blow it and manage to win big in the 2026 midterms, there is always a risk that Trump will fuck with the outcome after the fact or simply not recognize it as legitimate.

And, of course, there’s the possibility that Trump will do something so horrible, so heinous that Democrats will actually get off their asses and impeach him. He won’t be convicted, of course, unless, I don’t know, he commits treason or murders someone live on TV.

Even then, given how corrupt our political system is, it would probably be iffy.

Anyway, there’s little I can do about any of this. I just have to hunker down and prepare.

Contemplating Martial Law Ahead of The 2026 Midterm Elections

Even President Abraham Lincoln, amid the Civil War, did not impose martial law for the purpose of disrupting free and fair elections. While Lincoln suspended the writ of habeas corpus and established martial law in limited areas (including parts of Kentucky in 1864), his proclamations explicitly provided that these measures “will not be deemed or taken to interfere with the holding of lawful elections.” The 1864 presidential election proceeded on schedule; Lincoln insisted on holding it despite unfavorable wartime conditions and personal political risk, viewing the continuation of democratic processes as central to the Union cause.

Today, serious discussion has arisen about the possibility of extraordinary executive actions—including speculation about martial law—ahead of the 2026 midterm elections. Concerns persist regarding the integrity of future elections. Although the federal Safeguard American Voter Eligibility (SAVE) Act has not been enacted into law (having passed the House in various forms but stalled in the Senate), related state-level measures requiring documentary proof of citizenship or stricter identification have advanced in multiple jurisdictions.

Under these circumstances, some observers anticipate that the administration may pursue significant pre-election measures. Declaration of martial law is frequently cited as one potential option. Legally, however, a president lacks authority to cancel or suspend federal elections. Election dates are fixed by statute and the Constitution; only Congress can alter them. Martial law—itself a contested and rarely invoked power with no clear statutory basis for nationwide application—does not confer the ability to override these constitutional and statutory frameworks. Historical precedent, Supreme Court rulings limiting military authority over civilian functions (such as Duncan v. Kahanamoku), and analyses of emergency powers confirm that elections have continued through prior wars and crises.

Any attempt to cancel elections would likely provoke profound institutional, political, and public resistance, potentially escalating into severe domestic conflict. A purely symbolic or power-asserting declaration of martial law, absent a genuine and overwhelming public-safety justification, would also carry substantial political costs. Decision-making in this domain remains difficult to predict with certainty.

In short, while historical practice and constitutional design strongly constrain the use of martial law or emergency powers to interfere with elections, vigilance regarding electoral integrity remains warranted as the 2026 midterms approach.