Black October 2026: What Small Business Websites Should Patch Now

BerryCoders Team

Black October is the name stuck to a pile of cybersecurity disclosures that landed between 19 and 22 October 2026. The phrase came from a widely shared post on X at 03:42 UTC on 22 October, which called the previous 48 hours the worst in cybersecurity history. The useful part is narrower. Most of the damage did not start this week. The disclosures did. Many of the break-ins had already been running for weeks or months.

For a small business, the traffic around the name is not the point. The point is whether the website, the WordPress install, or the tools that publish to them are in the set that vendors just named. This is a checklist, not a teardown of how the attacks work.

What Black October actually is

SecurityToday's 22 October write-up groups the week into three habits that keep showing up: stolen logins and keys, poisoned update channels, and platforms with a very large customer list. The UK's National Cyber Security Centre has been telling organisations to prepare for a patch wave since 1 May 2026. This week is that wave arriving in public, not a single new worm.

The item with the widest reach is PHP. Wiz Research says two flaws, found with frontier AI models, allow unauthenticated remote code execution and affect about 70 percent of the internet. The bugs had sat in PHP for more than a decade. The NCSC alert on 21 October covers CVE-2026-109618 and CVE-2026-109619 and says any organisation running PHP should update. If a fix cannot be applied quickly, take the system offline until it can.

The fixed PHP releases named in the SecurityToday report are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older lines that will never get those fixes stay exposed. WordPress, and anything else that is just PHP with a coat of paint, inherits the same problem.

What vendors disclosed this week

These are public vendor and researcher reports, collected in the SecurityToday account. They are not a complete list of every incident that used the Black October label.

  • WordPress supply chain. Stolen UpdraftCentral keys were used over the weekend of 17–18 October to create admin accounts and install plugins. About 400,000 sites that held an UpdraftCentral or Migrator key were exposed. Updates 1.26.13 and 2.26.13, released 19 October, revoke those keys.
  • Developer tools. An OVHcloud command-line release was tampered with on GitHub for under two hours on 19 October. LiteLLM 1.107.0 on PyPI carried a credential stealer. On 21 October, Railway said environment variables may have been read and told customers to rotate keys.
  • Platforms going dark. Zeabur is shutting down after data from 321,810 accounts and about 3.2 million environment records was stolen. Admin tokens there had not been rotated since January 2024. GMO is taking 26,739 Onamae.com servers offline. Bullhorn took its recruiting platform down. Ahold Delhaize took most brand websites and apps offline after an incident reported on 12 October. Stores stayed open.
  • Older breaches, disclosed now. California student records were copied from 22 May to 18 September, a set well above the current 5.7 million pupils. A Medi-Cal billing provider reported more than 970,000 people affected from access in October 2025.
  • Ransomware warning. On 20 October the FBI, CISA, and partners warned about the SafePay group, with at least 600 victims. Entry points they named: stolen or guessed passwords, bugs in security products, and phishing.

Rapid7's third-quarter note, cited in the same report, puts the average gap between a severe disclosure and exploitation at three days. Waiting for a calm week is how a marketing site becomes someone else's server.

What to check today

A one-person team does not need a security department to do the first pass. Work from the outside in.

  1. Find every PHP surface. The public site, the blog, the landing-page host, and any old campaign microsite. If PHP is older than the fixed releases above, update it or take that host offline. Do not stop at "we use a modern stack." A plugin, a form tool, or a forgotten subdomain can still be PHP.
  2. Update WordPress keys, not just WordPress. If the site uses UpdraftPlus, UpdraftCentral, or the Migrator, install the 19 October releases and treat any connected key as burned.
  3. Rotate secrets that can publish. API keys for the CMS, the email tool, the form tool, and any AI gateway. Railway's advice was to rotate variables, API keys, and registry credentials. Zeabur's failure mode was a token that never expired. Set an expiry. Then rotate.
  4. Distrust the last update you did not watch. The OVHcloud and AOMEI cases were short windows where a trusted download was not the file the vendor meant to ship. If a tool updated itself on 19 October, reinstall it from the vendor's current release and change the keys it stored.
  5. Do not install LiteLLM 1.107.0. If that exact version is already on a machine that holds marketing credentials, remove it and rotate those credentials.
  6. Write down what you could not patch. A host you cannot update this week is a host that should not stay on the public internet. The NCSC's order is explicit: offline beats a workaround you will forget.

What this is not

Black October is not one attack, and it is not proof that every PHP site was broken into on 22 October. Several of the worst cases started in May, July, or last October. The name is a disclosure calendar. Treat it that way: patch what was named, rotate what those vendors told customers to rotate, and ignore the accounts that turn a vendor PDF into a movie.

The same habit belongs on the marketing desk. A post, a plugin, or a new tool should not go live because a feed said it was urgent. Someone still has to approve the change. The human-in-the-loop marketing automation guide is the operating version of that rule. The security version, this week, is shorter: identify PHP, install the fixed release, rotate the keys, or switch the host off.

Sources