Black October 2026: What It Means for Your Website
On October 22, 2026, a widely shared post on X called the previous two days "the most serious 48 hours in cybersecurity history" and said people were calling it Black October. The name stuck.
Most of the coverage since has been written for security teams. This is for business owners: what Black October actually was, which parts can reach a business website, and the short list of things to check with whoever runs yours.
in PHP itself
turned into backdoors
counted by Patchstack
to check your logs
Black October Is a Week of News, Not One Attack
There was no single Black October hack. The name covers a run of unrelated incidents that became public within a few days of each other. Lined up by when they actually happened, it looks like this:
October 14–15: Zeabur
Attackers took data from 321,810 accounts at the cloud hosting platform Zeabur, including more than 3.2 million stored secrets. Zeabur is shutting down by the end of 2026.
October 15–16: Rank Math PRO
Copies of the paid WordPress SEO plugin Rank Math PRO, version 3.0.123, shipped with a backdoor for about eleven hours.
October 17–19: UpdraftPlus
TeamUpdraft, maker of the UpdraftPlus backup plugin, says its customer database was accessed. Stolen connection keys were used to install backdoors on WordPress sites. The fixed plugin shipped on October 19.
October 17–20: eMudhra
Eight intermediate certificates at the certificate authority eMudhra turned out to have weak keys. Chrome and Firefox blocked them on October 17, before the public announcement.
October 20–22: Railway
An intruder in the cloud platform Railway may have decrypted stored settings, including API keys, for up to 1.85% of its workspaces, about 100,000 of them.
October 21: PHP2Shell and LiteLLM
PHP shipped emergency fixes for two critical flaws in the language, and governments took websites offline. The same day, a poisoned release of LiteLLM, a popular AI developer tool, spent about two hours on the official package index stealing credentials.
Several of these were running long before anyone named the week. Forkast called it "a disclosure wave, not an attack wave," and SecurityToday pointed out that many of the attacks had been going on for months.
The week didn't create the attacks. It's when we found out about them.
Find Your Website in This List
- WordPress or WooCommerce: sections 03 and 04 both apply. This is the group with the most to check.
- Drupal, Joomla, Magento, Laravel or anything else built on PHP: section 03 applies.
- A custom app a developer built and hosts for you: section 05. Ask them the three questions there.
- Wix, Squarespace or Shopify: none of the PHP or plugin problems reach you. Make sure every account that can change your site or your domain has two-factor sign-in.
- A static site served as files: there's no PHP running when someone visits, so section 03 doesn't apply. The account advice still does.
Not sure what your site runs on? That's normal, and it's the first question to put to whoever built or hosts it.
The Flaws at the Centre of It
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two flaws in PHP that let an attacker run code on a web server without logging in. We covered the details on the day in what to do about CVE-2026-109618. A few things are clearer now.
- It reaches back further than most people expected. Wiz and Tenable say every version from PHP 5.4 onward is affected. Versions 5.4 to 7.3 will get no fix at all.
- Attempts started before the fix. Amazon saw an exploitation attempt on October 17, four days before the patches shipped. Cloudflare reported millions of attempts by October 22.
- Whether anyone got in is disputed. Wordfence blocked more than 74,000 attempts and found no confirmed compromises, and Sansec says the public exploit code doesn't work against a default PHP setup. As of CISA's October 23 update, neither flaw was on its Known Exploited Vulnerabilities list.
- There's no workaround. The PHP project says no configuration change fully protects you. The fix is a PHP upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, followed by a restart of the PHP workers.
One practical point: when your developer checks the server logs, they should look back to October 17, not October 21.
Two Plugins You Trusted Were Used Against You
These two matter more to a typical business site than anything else on the list, because neither needed a flaw in your site. Both came in through software you installed on purpose.
UpdraftPlus is one of the most popular WordPress backup plugins. TeamUpdraft believes its customer database was accessed on October 17–18, including the keys that link sites to its UpdraftCentral dashboard. Patchstack found those keys being used to install backdoor plugins under 99 different names, the most common being "Site Health Cache." The backdoor adds a user who appears in your list as an Editor but has an administrator's powers, can log in without two-factor sign-in, and stays behind even after the plugin is removed. Updating does not remove a backdoor that's already there.
Rank Math PRO, the paid version of a popular SEO plugin, shipped a backdoored version 3.0.123 for about eleven hours on October 15–16. If your site installed that version, treat it as compromised until it's checked. The fix is 3.0.124. The free version was not affected.
Update both plugins
UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium), and Rank Math PRO 3.0.124. Then delete any old UpdraftCentral key in UpdraftPlus's Advanced Tools.
Check every user
Look for administrators and Editors you don't recognise, and plugins you didn't install. Have your developer remove them so the evidence is kept, not just deleted from the dashboard.
Change the passwords
Every admin password, your TeamUpdraft account, and the keys for wherever your backups are stored. If anything looks wrong, restore from a backup taken before October 15.
Three Questions to Ask This Week
Three of the incidents hit tools developers use rather than websites directly. Railway and Zeabur are cloud platforms for hosting apps. LiteLLM is a tool for connecting apps to AI models. In each case the risk is the same: the passwords and API keys your app uses to reach payments, email or AI providers may be in someone else's hands.
- "Is anything of ours hosted on Railway or Zeabur?" If yes, every stored key and password needs rotating. Zeabur is closing, so anything there also needs a new home before the end of the year.
- "Did anything install LiteLLM on October 21?" Version 1.107.0 was malicious. The machine that installed it needs rebuilding, and every secret on it needs changing.
- "Have you rotated the keys?" Not "we're not affected as far as we know." Rotating a key is cheap. Finding out later that it wasn't rotated is not.
The Certificate Problem Was Handled for You
The eMudhra incident sounds the most alarming, because certificates are what put the padlock in the address bar. But the weak certificates never issued any website certificates, and Chrome and Firefox blocked them before the news broke. Unless your site's certificate was issued through eMudhra or its emSign brand, which is uncommon outside India, there's nothing for you to do.
Every item on the Black October list was software someone had to remember to update.
Finding the Holes Got Faster
The PHP flaws had been in the language for more than a decade. Wiz found them with help from AI models and reported them in August, which is why there was a fix to ship. The same tools are available to people who won't report what they find.
So the gap between "a flaw exists" and "a flaw is being tried against your site" is shrinking, and the number of things a typical business website depends on hasn't. A WordPress site runs PHP, a database, a theme and a dozen plugins, each from a different company, each a door someone has to keep locked.
The shorter the list of things your website runs, the shorter your next Black October.
We build websites that don't run PHP or WordPress plugins, so we're not neutral here. The sites we run on Araptus Highlander needed nothing from sections 03 or 04 this month. That doesn't make them unhackable. Domains, hosting accounts and the small services behind forms and payments are still targets, and they still get patched.
Work through the checklist above whether or not you ever talk to us. If you finish it and decide you'd rather not run a PHP server again, here's how a move off WordPress works.
The bottom line
Patch PHP, check your WordPress users, rotate your keys.
Then make the list of things your website depends on shorter.
Sources
- X — The post that popularised "Black October"
- Wikipedia — Black October (information security)
- Forkast — Black October is a disclosure wave
- SecurityToday — Many attacks had been running for months
- Wiz — PHP2Shell remote code execution
- Tenable — PHP2Shell frequently asked questions
- heise — PHP2Shell: updates roll out as websites go offline
- CISA — Known Exploited Vulnerabilities catalog
- TeamUpdraft — Security incident, October 2026
- Patchstack — UpdraftCentral key compromise used to backdoor WordPress sites
- BleepingComputer — Rank Math PRO compromised to backdoor websites
- eMudhra — Certificate security incident statement
- LiteLLM — Security incident, October 21, 2026
- Railway — Preliminary report on the October security incident
- BleepingComputer — Zeabur shutting down after second breach
