What is "Black October"?
On October 22, a widely shared post on X called the previous 48 hours the worst stretch the security world had seen. The nickname stuck. It is not one attack. It is a pile of disclosures that all landed between October 19 and 22: two serious flaws in PHP, a backdoor campaign aimed at WordPress sites running UpdraftPlus, tampered software downloads, and a run of data breaches at developer and hosting platforms.
One summary of the week makes a useful point. The surge was mostly in how much was announced. Plenty of the attacks behind those announcements had been running for weeks or months before anyone noticed. That matters for the rest of this post, because it means the date a problem becomes public is not the date it began.
If you run a WordPress site, two of these stories touch you directly. The rest are worth knowing about, but they are less likely to land on your site.
PHP2Shell: the flaw in the language WordPress runs on
PHP is the programming language behind roughly 70 percent of the websites whose server language is known, and WordPress is one of them. On October 21, the PHP project released security updates for two critical flaws, together nicknamed PHP2Shell. In plain terms, they could let an attacker take control of a web server without any legitimate access, then read data or run their own code.
The bugs are reported to be more than a decade old. They stayed hidden because exploiting them took complicated technical work. This time, AI tools found them: researchers at Wiz, Calif and OpenAI report using AI to find the bugs, and the security company Chainguard says it found the same ones on its own by asking a frontier AI model to look for serious PHP vulnerabilities.
The reaction was fast. Cloudflare's CEO said the company saw thousands of exploit attempts in the ten hours before the announcement and millions by the time the story was written. The NSA and other governments told organizations to patch immediately or take services offline until they could. Several well-known sites, including Archive.org and some Wikimedia services, went down temporarily while they updated.
It is worth keeping some perspective. At least one security researcher called PHP2Shell far less exploitable than Log4j or Heartbleed, two of the worst flaws in recent memory, and many of the exploits posted online appear to be low-effort code that probably does not work. So far, most of the disruption has come from patching and takedowns, not from mass compromise. That could change, which is why patching quickly still matters.
One report lists the fixed PHP releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. I only found those numbers in a single source, so check them against the PHP project before relying on them. The reports I read do not say WordPress itself is being targeted. The practical point is simpler: your WordPress site is only as safe as the PHP version your host runs, and that is a decision your host makes, not something a plugin update changes.
The UpdraftCentral backdoor: a backup plugin turned against its users
UpdraftPlus is one of the most popular WordPress backup plugins, with more than four million active installs. It includes a feature called UpdraftCentral, which lets a dashboard manage your site remotely. Each connection is protected by a private key.
TeamUpdraft, the company behind the plugin, said on October 19 that someone had broken into its own website over the weekend of October 17 and 18, and that connection keys were in the database that may have been accessed. Starting around October 18, attackers used stolen keys to send signed commands that installed hidden backdoor plugins on sites that trusted them. Because the commands carried a real signature, the sites accepted them as legitimate.
The backdoor plugins let the attacker create a hidden account and log in without using the normal login page, which means two-factor authentication and login-protection plugins never get a chance to stop them. The hidden account stays on the site even after the plugin that created it is deleted. Patchstack found 99 different disguised plugin names, so removing one suspicious plugin does not prove you are clean.
The company has since released UpdraftPlus 1.26.13 (free) and 2.26.13 (premium), which disconnect keys created before the breach. A first attempt, 1.26.12, was reported to contain a bug that stopped it from working. Updating does not remove a backdoor that is already on a site, and reports describe a short window on October 18 where keys were not revoked automatically. Estimates of how many sites were affected vary, and one report put it at around 400,000. I could not find a count confirmed by a security firm.
TeamUpdraft said the database that may have been accessed held names, email addresses, billing addresses, order history, hashed passwords and two-factor settings, and that it holds no payment card data. If you have a TeamUpdraft account, change that password, and anywhere else you reused it.
The rest of the pile-up
The other items are less likely to touch a typical business website, but together they show how this week looked:
- Tampered software. Attackers changed the files behind AOMEI Backupper so its updater installed a backdoor, hijacked a developer account to publish altered versions of the OVHcloud command-line tool, and put credential-stealing code into a LiteLLM package release.
- Network equipment and servers. A Palo Alto firewall flaw patched in May was reported to be under attack by ransomware groups from the middle of May. Three memory bugs were fixed in NGINX, a web server used by a very large share of the internet.
- Platform breaches. Developer platforms Zeabur and Railway disclosed problems with stored credentials, and the database company PingCAP reported attackers using stolen service credentials for about a month.
The pattern across all of them is the same. Most did not start with a clever technical trick. They started with a trusted key, token or update channel getting into the wrong hands.
Is WordPress itself affected?
None of the reports I read say WordPress core is vulnerable this week. The risk to a WordPress site comes from three places around it: the PHP version your host runs, plugins like UpdraftPlus, and the tools and services you use to manage the site. A site can be fully updated inside WordPress and still be exposed through any of the three.
What to do this week
None of this needs a developer to start. Here is the order I would work in:
- Ask your host about PHP. Find your PHP version under Tools, then Site Health, then Info, then Server in your WordPress dashboard. Then ask your host whether they have applied the October 21 PHP security release. A managed host should be able to answer that in one reply.
- Deal with UpdraftPlus. If it is installed, update to version 1.26.13 or 2.26.13, then go to Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, and delete every key. You are exposed if a key exists, even if you never used the feature.
- Look for anything you did not add. Check your plugin list and your user list for names you do not recognize. Patchstack and Nethemba publish the specific plugin and account names to look for.
- Reset the keys to the kingdom. Change administrator passwords, turn on two-factor authentication, and if UpdraftPlus connects to cloud storage, re-authorize that storage and rotate its access keys.
- Keep a backup from before October 17. If you do find a backdoor, treat the site as fully compromised and restore from a copy taken before the breach window, rather than trying to patch around it.
If you find something, or you are not sure whether you have, our emergency support team can step in. We covered the UpdraftPlus side in more detail in UpdraftPlus Backdoor Attack: What to Do Now, and if you suspect a break-in more generally, see what to do when WordPress is hacked.
What this week really shows
Three lessons apply to any business that depends on a WordPress site, whatever happens next week.
Speed is the new baseline. One summary of this week's events cites a Rapid7 measurement of about three days, on average, from a severe flaw being disclosed to attackers using it. Cloudflare's CEO said PHP2Shell exploit attempts started before the official announcement. A monthly maintenance routine cannot keep up with that for serious flaws.
Every remote-access feature is a front door. The UpdraftCentral story is a reminder that a feature you may not know you have, holding a key you did not knowingly create, can be the way in. Somebody should know which remote-access features are switched on, and who holds the keys.
Updating is necessary, not sufficient. Updating UpdraftPlus cuts off the stolen keys, and it still leaves behind anything already installed. Patching fixes the hole. Checking whether anyone came through it first is a separate job, and it is the one most often skipped.
That gap between "patched" and "verified clean" is exactly where an owner is needed. We wrote about it in why WordPress needs someone accountable. A defined party who owns updates, security monitoring and incident response is the difference between reading about this week in the news and having someone already working on it.
Sources
This post draws on reporting from Axios, 404 Media, SecurityToday, The Hacker News and Patchstack. This is a fast-moving situation, and details may change.
