Black October: what happened in October 2026’s cyber incidents and what UK websites should do

“Black October” is the name X users gave to a run of serious security disclosures in the third week of October 2026. It was not one attack but a cluster of flaws, breaches and supply chain compromises, and many were found by AI, sped up by AI or aimed at AI tools. If you run a website, the job that cannot wait is patching PHP on your server.

Correction: Unit 42 withdraws its PHP2Shell attribution

Added on 26 October 2026. On 25 October Palo Alto Networks’ Unit 42 retracted its report that an attack on a European government agency came through PHP2Shell, saying it is “unable to confirm that initial access is associated with the specific PHP2Shell CVEs”. The change came shortly before this post was published and we missed it. We have corrected the PHP2Shell section and the FAQ, and added the OpenCode attack of 17 October, which we left out at first.

The answer in brief

• The name spread on X late on 21 October 2026 and was in CNBC and the Guardian by 23 October. It describes a wave of disclosures, not a single campaign.
• Every site running on PHP must act on PHP2Shell. Your server needs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a host build confirmed to carry the fix. Updating WordPress does not fix it.
• Two WordPress plugin businesses were hit in one week. Rank Math PRO shipped a poisoned update, and attackers who breached TeamUpdraft, the company behind UpdraftPlus, used its remote-management keys to push backdoors to connected sites.
• Reuters reported one hacker using AI agents to break into the websites of more than 100 companies for an estimated $5,000 (US dollars) of AI tokens.
• Anthropic, OpenAI and the UK’s National Cyber Security Centre (NCSC) all say prompt injection is unsolved.

Where does the name “Black October” come from?

The earliest security use we could find is an X post by @DevMuzzammil at 23:57 BST on 21 October 2026: “We can call it Black October for the security breaches”. At 04:42 BST on 22 October the AISafetyMemes account posted “‘Black October’ they’re calling it” over a longer list, and that post travelled. On 23 October CNBC wrote that “some have dubbed the moment ‘Black October'”, and the Guardian and the Washington Post used it too.

SecurityToday and Forkast both note that many listed incidents began weeks or months earlier and were simply disclosed together. Forkast calls it “a disclosure wave, not an attack wave”.

What is PHP2Shell, and is my website affected?

If your site runs on PHP, as every WordPress site does, assume it is affected until your host confirms otherwise. PHP2Shell is a pair of critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), rated 9.2 on CVSS v4.0. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for 7.4, 8.0 and 8.1. It says “there are no complete mitigations, updating is the only safe choice”. Wiz, one of the teams that found them, says nearly every PHP version back to 5.4 is affected by at least one. Our PHP2Shell news post covers the disclosure.

The fix lives on the server. As the BBC put it, the patch “must be applied to PHP itself and cannot be resolved by updating WordPress or its plugins”. Hostinger, for example, says builds dated 21 October or later carry the fix even where the version still reads 8.5.11.

Amazon saw an exploitation attempt in its MadPot honeypots dating to 17 October, four days before disclosure, though “it’s unclear if any of these attempts would have succeeded in real-world systems”. After disclosure the probing became mass scanning: Cloudflare counted millions of attempts by early 22 October, some of them trying to install a Mirai-based botnet, The Hacker News reported. The BBC reported that as of Friday morning, 23 October, no successful attacks had been reported, and the UK Government still took 32 sites down as a precaution. Palo Alto Networks’ Unit 42 at first linked an attack on a European government agency to PHP2Shell, then withdrew that on 25 October because it could not confirm the attackers got in through either flaw. SecurityWeek, updating its coverage the same day, said no successful compromise had been confirmed so far. The NCSC tells organisations that cannot update or disable a system straight away to check it for evidence of compromise before upgrading or mitigating, and those that cannot apply the temporary mitigations to consider taking it offline.

On 23 October PHP also published an informational advisory on a third flaw, CVE-2026-115560, with a full advisory due with the next release. Until then it suggests setting session.upload_progress.enabled to 0. PHP says the flaw needs an unusual combination of configuration and application code.

What happened to WordPress plugins in October 2026?

Rank Math says malicious copies of Rank Math PRO 3.0.123 were downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 (CVE-2026-111862, rated 9.8). Version 3.0.124 is clean, and the free plugin on WordPress.org was not affected. If a PRO site updated in that window, follow Rank Math’s incident page.

TeamUpdraft says there was unauthorised access to its systems over the weekend of 17 to 18 October, and it believes its customer database was accessed, including UpdraftCentral, Vault and Clone keys. Patchstack then tracked backdoors pushed to connected sites on 18 and 19 October under 99 plugin names, with Editor accounts given extra rights. UpdraftPlus 1.26.13 and 2.26.13, released on the evening of 19 October, revoke connections made before 13:07 BST on 18 October. TeamUpdraft has told the Information Commissioner’s Office, and says the speed of the exploits and “initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack”. That is its inference, not a confirmed finding. Our UpdraftPlus guide explains why updating alone is not enough and what to check on each connected site.

How are attackers using AI?

Wiz found PHP2Shell using its own Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol, and says “a single researcher completed in a week what previously would have taken a world-class team months of work”. Amazon’s CJ Moses warned that “AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit”, and told defenders to “measure patch and mitigation timelines in hours”.

Reuters reported on 19 October that a hacker used AI agents on a platform called Cairn to break into websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins, in a campaign that began on 25 September. Snorre Fagerland of NorForge estimated that it cost roughly $5,000 (US dollars) in AI tokens, about $50 per successful hack, and that the hacker appeared to use a mix of DeepSeek and Claude Code. Deere said it had “no indication that sensitive information was accessed”.

OpenCode, an open-source coding agent, was hit the same week by an attack aimed at the keys that pay for AI. On 17 October it said it had suffered a breach the night before “related to a large scale distillation attack” that affected 1.4% of OpenCode Console users, those who had linked their own Anthropic, OpenAI or Google API keys. OpenCode has not described a software flaw; it says the attackers broke into an older system it was retiring. Distillation means training one model on another’s answers, and stolen keys let attackers collect those answers at someone else’s expense: some developers reported overnight charges of hundreds of dollars, and a few above $1,000. TechCrunch reported co-founder Dax Raad saying the attackers kept at it non-stop for two days, so his team had to run its own AI agents around the clock, and that the AI models helping them began refusing mid-investigation until OpenCode got access to OpenAI’s Daybreak programme.

AI tooling is now a target too. On 21 October a poisoned LiteLLM 1.107.0 carrying credential-stealing malware was on PyPI from 11:39 to 13:23 UTC; LiteLLM traces it to a master key committed to a public repository on 27 May and never revoked. The same day Railway disclosed an attack, part of “a series of attacks recently targeting platform companies with the aim of compromising AI inference providers”. Its preliminary report of 22 October says the attacker “accessed Railway’s internal systems and decrypted stored environment variables for a subset of workspaces”.

What did Sam Altman say about the attacks?

Altman did not say attacks are rising, but he did say patching can’t keep up. In a View From The Top interview that Stanford Graduate School of Business published on 21 October, he said:

“This cybersecurity… I don’t even know what a dramatic enough word to use, but the problem coming towards us, I think is still something that we have not, as organizational leaders or countries or individuals, taken seriously.”

And: “I no longer think we’re going to be able to just patch all the bugs. I think we’re going to have to completely switch the defense model to sort of using the same technology for sort of a new kind of defense shield.” The Guardian quoted the shorter line “I no longer think we’re going to be able to patch all bugs” on 23 October.

The closest real statement to “attacks are increasing” is OpenAI’s, not Altman’s. Its Patch the Planet page of 21 October says “we expect similar findings to increase sharply in the coming months”. That is about bugs found, not attacks, but it still means more urgent patches.

Will prompt injection ever be solved?

Probably not completely. Prompt injection is when hidden instructions in an email, page or document hijack an AI agent.

We could not find Dario Amodei saying it will never be solved. The closest real statement came at HubSpot’s INBOUND 2025 in September 2025, about Anthropic’s Claude browser extension: “we’ve made some progress against these prompt injection attacks, but we don’t feel that we’re bulletproof yet”.

The firmer statements come from elsewhere:

• Anthropic, 24 November 2025: “prompt injection is far from a solved problem”.
• OpenAI, 22 December 2025: “Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’.”
• The NCSC, 8 December 2025: “it’s very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be”.

October added examples. In early October Salt Labs showed how one email hijacked a Manus agent, which ran code and reached connected email, storage and code accounts; the flaw is resolved. BeyondTrust showed on 21 October how a hidden comment on a GitHub issue could take over the Copilot coding agent and pull out tokens; GitHub “determined the findings do not present a security risk”. Our Claude Cowork guide covers agent access.

Ars Technica reported on 20 October that researchers at Claroc had found 6,800 Meta Muse share links through public DNS records, and Meta paused sharing. On 22 October The Verge reported that sharing was back with new links, and that Meta says the flaw was in shared artifacts rather than chat sharing. See what Meta Muse is and what UK businesses can use.

Which other incidents were part of Black October?

Source: the publishers listed, checked 25 October 2026.

For scale, CISA added 26 flaws, including Arista VeloCloud Orchestrator and Collabora Online on 23 October, to its Known Exploited Vulnerabilities catalogue between 1 and 23 October 2026. PHP2Shell was not among them in catalogue version 2026.10.23.

What should UK businesses and website owners do now?

1. Confirm your PHP version today. Ask your host in writing whether PHP2Shell is patched, and get the version or build date.
2. Check for signs of intrusion. Patching does not remove an attacker who is already in. Ask your host to check logs and files back to 17 October, the date of the first attempt Amazon saw, for web shells, unfamiliar files and new admin accounts.
3. Check Rank Math PRO and UpdraftPlus. PRO should be on 3.0.124 or later, UpdraftPlus on 1.26.13 or 2.26.13 or later. If you use UpdraftPlus Premium, look for unknown plugins and Editor accounts even if you never used UpdraftCentral, as TeamUpdraft advises.
4. Rotate AI and platform keys. If you use LiteLLM, Railway, OpenCode Console or any tool holding OpenAI, Anthropic or Google API keys, rotate them and check for unexplained spend. If LiteLLM 1.107.0 was ever installed, rebuild that environment from scratch, as LiteLLM recommends.
5. Give AI agents less access. An agent that reads email or web pages should not also hold your inbox, CRM or deployment tokens. Keep a human approval step before it sends, buys or publishes.
6. Write down who patches what. Name who owns PHP, plugins and third-party marketing tools.
7. Plan for more. The NCSC told organisations on 1 May 2026 to prepare for a “vulnerability patch wave”.

What happens next?

Watch for the full PHP advisory on CVE-2026-115560, and for the first confirmed PHP2Shell compromise, if one comes. Watch Patchstack’s advisories too.

The real lesson from Black October is that the patching gap is now measured in hours, and it is widest for small businesses that assume someone else is handling it. If you’re not sure who looks after your server, plugins and AI tool keys, talk to AIWIZ.