Guide
Black October 2026: What the Security Incidents Mean for Your Small-Business Website
In the third week of October 2026, researchers disclosed a cluster of serious flaws in software that runs a huge share of the web. The press called the stretch Black October — an informal label, not the name of any single attack — after reports landed between 17 and 22 October. The Guardian, Washington Post, and CNBC all used the phrase by 23 October.
Most of it is someone else's problem. But three disclosures land directly on the website and tools you already run. This guide strips out the noise, explains the three, and hands you a checklist you can work through this week — no security team required.
Quick answer
The three Black October incidents that can touch a small-business website:
- PHP2Shell — two critical remote-code-execution flaws in PHP, the language behind WordPress, Drupal, and Joomla.
- A Brotli/Node.js memory bug — a decoder flaw patched through a Node.js release on 21 October.
- Weak eMudhra certificates — eight certificate-authority keys generated with too little randomness.
If you're on a managed site builder (Squarespace, Wix, Shopify, Webflow) or a managed WordPress host, you're most likely covered already. The work below is for anyone who controls their own PHP version, Node.js apps, or certificates.
What "Black October" was
The through-line is *how* the flaws were found. The worst one — PHP2Shell — was uncovered by Wiz using AI-assisted vulnerability research. The broader story: AI is accelerating discovery of bugs that have sat in widely deployed software for years.
The practical takeaway is simpler: the software under your website got patched in a hurry, and you should confirm the patch landed.
The three incidents that matter
PHP2Shell — the big one
On 21 October 2026, PHP shipped emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both allow an unauthenticated attacker to run arbitrary code on a vulnerable server, and both carry a CVSS 9.2 "critical" rating.
Why it matters to you: PHP is the engine behind WordPress, Drupal, and Joomla, which together run an enormous share of small-business websites. Wiz demonstrated the attack against all three — and describes PHP as powering "70% of the Internet." That's the vendor's estimate, not a census; treat it as "PHP is everywhere."
The fixes landed the same day:
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
Notice what's *not* on the list: PHP 7.x, 8.0, and 8.1 are end-of-life and got no patch. If your site is on one of those, the fix is an upgrade, not a patch.
Two more signals of how serious this is:
- The NSA issued an advisory on 22 October urging organizations to patch immediately.
- Security firms report the flaws are being exploited in the wild — Amazon Threat Intelligence saw an attempt on 17 October, before disclosure, and watchTowr reports the same. (Tenable, watchTowr)
The Brotli/Node.js decoder bug
The same day, a memory-corruption bug in Google's Brotli decoder (CVE-2026-111497) was patched. The decoder ships inside Node.js, Firefox, and Thunderbird; Red Hat nicknamed it "node2shell."
Why it matters to you: if you (or a contractor) run a Node.js app — a custom tool, a headless CMS, part of your site — you'll want the patched Node.js release from 21 October. For most owners, this is a "ask whoever maintains your site" item rather than a do-it-yourself one.
The eMudhra certificate issue
On 17 October a researcher reported that eight intermediate certificate-authority keys operated by eMudhra, an Indian digital-trust provider, had been generated with too little randomness — meaning the keys could potentially be recovered to mint fake certificates.
Chrome and Firefox blocked the keys within days, and eMudhra announced on 22 October it would exit the global SSL/TLS certificate business.
Why it matters to you: this one is narrow. The affected intermediates never issued end-entity certificates, and eMudhra found no customer-data breach. But if you bought a certificate from eMudhra — or use Java/Python environments with updated trust stores — a quick reissue is worth it, mostly for businesses serving India.
Who is affected (and who isn't)
| You are... | Your exposure |
|---|---|
| Self-hosting WordPress, Drupal, or Joomla | Act now — check your PHP version, patch or upgrade. |
| On a managed WordPress host or site builder | Likely auto-patched; confirm with a support ticket if unsure. |
| Running a Node.js app or custom tool | Update Node.js (or ask your developer). |
| Using an eMudhra-issued certificate | Reissue / confirm; narrow but real. |
| On Squarespace, Wix, Shopify, Webflow | Not affected by the PHP or Node.js flaws. |
5 checks to run this week
- Find your PHP version. In WordPress, use the Site Health screen or your host's dashboard. If it's 8.2+, confirm you're on the patched minor (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12+). If it's 7.x, 8.0, or 8.1, plan an upgrade — there's no patch for end-of-life versions.
- Ask your host one question. "Have you applied the 21 October PHP security update to my account?" Managed hosts usually do this automatically; one line removes the doubt.
- Check your certificate. If "eMudhra" appears in the issuer chain, reissue through your current provider. Otherwise, no action.
- Update Node.js if you use it. If a developer built you anything on Node.js, ask them to apply the 21 October release.
- Run a free technical check while you're in there. The Website SEO Checker catches the basics — a noindex left on, a missing title, a missing mobile viewport — in about ten seconds, no signup.
What else happened (and why it's a footnote here)
Two more incidents made headlines but matter less to a typical small-business owner:
- LiteLLM supply-chain attack. On 21 October, attackers pushed a malicious version (1.107.0) of LiteLLM — an open-source AI-routing gateway — to PyPI and Docker. It was online about three hours before being pulled. If you run your own AI stack on LiteLLM, read the incident report and rotate keys; everyone else is unaffected. See the Small Business AI Stack for how this tool fits an AI setup.
- GitLab remote code execution. A critical unauthenticated RCE in self-managed GitLab was fixed the same day. This only touches businesses that self-host GitLab — mostly developers and agencies.
Risks and caveats
- "Black October" is a label, not an event. It spread through social media before the press adopted it. Don't treat it as a formal advisory.
- Watch the sourcing. "70% of the Internet" is Wiz's estimate; "exploited in the wild" comes from security vendors' observations. Both are directional signals, not precise numbers.
- The patch list is the boundary. Only 8.2.35+, 8.3.36+, 8.4.27+, and 8.5.12+ are fixed. Everything older is end-of-life and unpatched.
- This is security guidance, not legal or financial advice. If your site handles payments or customer data, confirm your situation with the platform or a professional.
FAQs
Is my WordPress site vulnerable to PHP2Shell?+
Only if it runs on self-managed PHP that isn't patched. Patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12 (released 21 October 2026). PHP 7.x, 8.0, and 8.1 are end-of-life with no official patch. Managed WordPress hosts usually apply the fix automatically.
What is "Black October" exactly?+
An informal name for a cluster of October 2026 security disclosures — most notably the PHP2Shell flaws, a Node.js/Brotli decoder bug, and weak eMudhra certificate keys — concentrated between 17 and 22 October. It's a label journalists and researchers use, not an official incident name.
Do I need to do anything if I use Squarespace, Wix, or Shopify?+
No. Those platforms manage their own infrastructure and apply updates for you. The PHP and Node.js fixes matter for self-managed sites and custom builds, not hosted builders.
How do I check which PHP version my site runs?+
In WordPress, use the Site Health screen or your hosting dashboard. On shared or VPS hosting, your control panel (cPanel, Plesk, etc.) shows the active PHP version. If you can't find it, ask your host.
Is the LiteLLM attack going to affect my AI tools?+
Only if you or a developer run LiteLLM yourself as part of a custom AI setup. If you use ChatGPT, Claude, Canva, or another hosted product, you're not affected. If you do run LiteLLM, read the incident report and rotate exposed credentials.
Should I panic about "Black October"?+
No. Work the five-check list above. Most small businesses will find they're already patched, or one upgrade away from patched.
Sources
- Wiz — PHP2Shell: AI uncovers critical RCE vulnerabilities
- PHP — official release
- NSA — Advisory: Critical Patches Recommended for PHP Vulnerabilities
- Sophos — PHP2Shell advisory
- Cisco — Vulnerabilities in PHP Affecting Cisco Products
- Node.js — October 2026 security releases
- Red Hat — RHSB-2026-015 (node2shell)
- Google Security Blog — eMudhra intermediate CA certificates
- Mozilla Security Blog — eMudhra intermediate certificates
- eMudhra — Statement on Recent Certificate Security Incident
- LiteLLM — Contained: Oct 21, 2026 release v1.107.0 compromised
- The Guardian — 'Black October': cybersecurity experts sound the alarm
- Wikipedia — Black October (information security))
Free tools to try
Keep reading
Guide
The Small Business AI Stack: Tools for Every Job in 2026
A practical AI stack for small businesses — the tools that actually save time on marketing, content, SEO, and admin, organized by the job they do. Free where it counts.
Guide
Small Business SEO Audit Template (Free, Copy-Paste)
A free SEO audit template where every check cites Google's own documentation — no signup, no download, and honest limits on every free tool it uses.