Black October hacks: what they mean for your website

If you opened social media this week and saw “Black October”, “everything is getting hacked” and a list of company names you have never heard of, you are probably wondering one thing: is my business website in danger?

The honest answer is that one of these incidents can reach almost any website, a few can reach some, and most do not touch you at all. This page separates them, says what is still unknown, and gives you a short list of things to check this week.

What “Black October” actually is

It is a nickname, not an official event. It was coined in a widely shared post on 22 October 2026 that called the previous 48 hours the worst in cybersecurity history. Security writers then used it as a label for a cluster of incidents reported between about 17 and 22 October. The sources we read do not agree on exactly which incidents belong, and several of them are unrelated to each other. One analysis argues it was mainly a wave of disclosures, not a wave of new attacks: some of the break-ins underneath it began months earlier.

That matters, because a scary label makes everything sound equally urgent. It is not. Here are the incidents that come up most, sorted by whether they affect a website like yours.

1. PHP2Shell: this one can reach you

PHP is the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento, Moodle and most small business websites. On 21 October the PHP team released emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, which let a stranger run their own code on a web server without logging in. (A CVE number is simply the public reference for a known security flaw.)

What makes it different from the usual warning:

• The weakness is in the server, not in your website. Updating WordPress, your theme or your plugins does not fix it. The fix is a newer version of PHP, installed by your host or developer.
• Attacks began before the fix. Reports put the first attempt on 17 October, and exploit details leaked on 20 October, which pushed the release forward by a day.
• Many sites switched themselves off. Several governments took websites offline on purpose while they patched. Most of the outages were precautions, not break-ins.
• Old PHP may never be fixed. PHP 8.1 and older are past their end of life. Some hosts have copied the fix into their own builds, and some have not.

We wrote a full guide to this one: PHP2Shell: what the PHP flaw means for your website and what to do. If you read only one thing, read that.

2. eMudhra certificates: check only if you use them

A certificate is what gives your site the secure connection (https). An Indian certificate authority called eMudhra generated the keys for eight of its internal certificates so badly that anyone could work them out from public information. Researchers reported it on 17 October. Mozilla, Google and Apple then blocked the affected certificates in their browsers, and Chrome is removing the related root certificate from its list of trusted ones on 27 October.

Reported facts: eMudhra says none of the affected certificates issued a website certificate, and Google said none had been logged before the block. About 30,000 legitimate certificates may need to move to a different authority. If your site’s certificate came from eMudhra, ask your host or developer which authority issued it. If it came from Let’s Encrypt or from your host’s standard setup, this is very unlikely to concern you. Whether anyone abused the keys is, at the time of writing, not reported.

3. AI-driven attacks on online shops: a warning, not a new flaw

Several reports describe attackers using an open-source AI tool called Cairn to attack payment and e-commerce websites automatically. One news headline put the number of organisations hacked at more than 100, while other coverage says hundreds of sites, so the exact count is unsettled. Cairn is an open-source tool, and the reports do not claim everyone who uses it is an attacker.

The lesson for a shop owner is simple. Automated tools find weak websites faster than people do, and being small does not hide you. The basics decide whether you are on the easy list: the software on your server, your plugins, your admin accounts and your passwords.

4. Developer-tool breaches: only if your developer uses them

Two incidents hit tools that developers use behind the scenes: a hosting platform called Railway, which told users to change their keys after secrets may have been exposed, and a release of an AI gateway tool called LiteLLM that shipped with a password stealer. The Railway report says secrets “may have” been taken, so treat the full scope as unknown.

If your website is a normal WordPress or similar site on ordinary hosting, you are unlikely to use either. If a developer built something custom for you, send them one question: “Did you use Railway or LiteLLM, and have you changed the keys?” We will cover this in its own post.

What to check this week

Ten minutes, in this order:

1. Find out your PHP version and whether it has the 21 October fix. Ask your host in writing. A good host answers with a version number and a date.
2. Run your site through a free scan. Our PHP2Shell checker reads what your server announces about itself. It cannot see a version your server hides, and it does not attack your site to test the flaw, because no honest outside tool can. A clean result is one part of the picture, not proof you are patched.
3. Look at your administrator list. Any account you do not recognise is a reason to act the same day.
4. Ask who issued your site’s certificate, if you have never checked.
5. Change the admin and hosting passwords, and switch on two-step login if either is missing. This will not stop PHP2Shell, but it closes the door attackers use afterwards.

Patching closes the door. It does not remove anything an attacker planted before the patch. That is why the signs of a hack matter: pages you never wrote, visitors sent to other sites, strange files in the places that should only hold images, or a warning from Google or your host.

What is still unknown

Be wary of anyone who sounds certain right now. At the time of writing, nobody has published how many websites were actually broken into through PHP2Shell, as opposed to attacked and unharmed. Which incidents are connected to each other is also unsettled, and some of the loudest claims come from companies that sell security products. Details will change over the coming days, and we will update our guides when they do.

Want us to check yours?

We run security checks on websites for a living, and we are happy to look at yours.

• Free: scan your website now. It takes about a minute and explains each finding in plain English.
• Done for you: our website security service covers checking the server, finding signs of a break-in, fixing what we find and bringing a site back online if it is down.

Then reach us:

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

If your site is down or you think it has been hacked, say so in the first line and we will look at it first.

Sources and further reading

• Security Boulevard: Black October was an investigation problem before it was a patching problem
• D3 Security: Black October, what PHP2Shell, eMudhra and AI-powered attacks mean
• Breezy Scroll: Black October hacks explained, what is AI, what is not, what to do
• CSO Online: Google and Mozilla revoke eMudhra intermediates after private key compromise