Security briefings
October 2026 security incidents: what Chandler small businesses need to know
Several serious security disclosures landed in the same October week, and the headlines are scarier than they are useful. Here is what is actually confirmed, what it means for a small business, and what to do about it. No panic required.
What happened
In mid-October 2026, a cluster of security disclosures hit within days of each other. A widely shared social post branded the stretch "Black October", and some of the claims circulating in those posts are exaggerated or unverified. The confirmed events are serious enough on their own. Three of them matter directly to small businesses:
- PHP2Shell. Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Government agencies including the NSA urged immediate patching, and organizations including Wikimedia temporarily took services offline to patch. Widespread exploitation had not been confirmed at disclosure: the urgency is patching, not panic.
- WordPress and UpdraftCentral. Researchers report a roughly 18-hour campaign on October 18 to 19, 2026 in which an attacker used valid UpdraftCentral dashboard keys to install backdoor plugins on connected WordPress sites. No fixing update existed as of October 19; the advice is to remove the plugin connection and delete the keys.
- GitLab. CVE-2026-97229, scored a maximum CVSS 10.0, allows unauthenticated remote code execution on self-managed GitLab through the CI/CD regex compiler. GitLab patched it on October 12, 2026 (versions 19.4.2, 19.3.4 with 19.3.5 recommended, and 19.2.8). A public proof of concept followed on October 13, active probing has been reported, and Censys counted roughly 25,000 internet-facing vulnerable hosts.
Also that month: Mozilla blocked 8 certificates after a private-key compromise at the certificate authority eMudhra, and the hosting platform Zeabur reported a breach affecting 321,810 accounts. Neither needs action from most small businesses, but they added to the pile-up feeling.
What a small business should actually do
- Know what your website runs. If nobody at your business can answer that, start there.
- Ask your web host one question: is this server on a PHP version patched for PHP2Shell? One email covers it.
- If your site is WordPress: update core, themes and plugins, and look for plugins you don't recognize.
- If you (or a past web person) ever used UpdraftCentral to manage the site remotely: delete those keys now.
- Turn on two-factor authentication for your hosting, domain and site admin accounts.
- Verify your backups actually restore. A backup you've never restored is a hope, not a plan.
The three briefings
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP flaws, patched in an emergency release on October 21. If your website runs PHP (WordPress does), your host needs to have patched it.
The WordPress UpdraftCentral key campaign
Researchers report attackers used valid remote-management keys to push backdoor plugins to WordPress sites on October 18 to 19. The fix is deleting keys, not waiting for an update.
GitLab CVE-2026-97229 (CVSS 10.0)
A maximum-severity flaw in self-managed GitLab, patched October 12. If a contractor ever set up GitLab on a server for you, it needs updating now.
Not sure which of this applies to your website? Check it in 20 seconds.
Run the free exposure checkPassive, takes about 20 seconds, and we tell you honestly what we can and can't see from the outside.
Let's break your busywork.
Start with a $149 Busywork Breakdown, or a free 20-minute call to see if we're a fit. No pitch, no pressure.
Serving Chandler and the Phoenix East Valley on-site, the US remotely.