In October 2026, a wave of serious security flaws surfaced in some of the most widely used software on the internet. It moved so quickly that some cybersecurity professionals started calling the month “Black October.”

The biggest story involved PHP, the programming language that powers WordPress and a large share of the web. The bigger trend behind it is speed. AI is helping researchers and attackers find weaknesses faster than ever, so the time between a problem being discovered and someone trying to exploit it keeps shrinking.

The good news is that the best defenses aren’t complicated. They just need to happen consistently.

What Happened During Black October

On Oct. 21, the PHP team released updates for two critical vulnerabilities, nicknamed PHP2Shell, and urged everyone running PHP to update immediately. The team rated both flaws 9.2 out of 10 for severity. In plain terms, they could let an attacker take control of a web server without ever logging in.

The response showed how seriously the issue was taken:

The NSA issued an advisory the same day, stating the risks were serious enough to require immediate patching across U.S. government departments and agencies. It also recommended taking systems offline if they couldn’t be updated right away.
Security agencies in other countries issued their own alerts, including the United Kingdom, Australia and the European Union.
Well-known websites went offline temporarily, including the Internet Archive and several Wikimedia services, so they could be updated safely.
Attackers moved fast. Cloudflare’s CEO shared that his company saw thousands of attempts to exploit the flaws in the hours before they were publicly announced, climbing into the millions soon after.

There is a reassuring side to this story. As of 404 Media’s reporting, most of the impact came from organizations patching or pulling sites offline as a precaution rather than widespread successful attacks. That is what being proactive looks like.

Other Cybersecurity Issues to Watch

PHP2Shell got the headlines, but it was only one of many serious issues in a short span. A few others give a sense of how much ground the risks now cover:

Rare flaws are becoming less rare. In July, WordPress forced automatic updates to fix a critical flaw in its core software that could let attackers take over a site without logging in. Wordfence described it as the first critical issue of its kind in WordPress core in nearly a decade.
The volume is hard to keep up with. In a single week in October, Wordfence added 497 newly disclosed vulnerabilities in WordPress plugins and themes to its database. Twenty-three were rated critical, and 69 had no fix available yet.
Problems spread across many platforms. 404 Media reported major issues in the same stretch affecting a software development platform, a media server, a cloud provider and a website security certificate provider.
Trusted downloads can be compromised. In October, Wordfence flagged malicious code found in some downloads of a popular WordPress SEO plugin.
Encryption is under new scrutiny. Online payments and secure logins rely on math problems that are too hard to solve in a reasonable amount of time. After an AI company released hundreds of new math proofs in a single day, Wordfence warned that today’s encryption could need upgrading sooner than planned. Its advice to business owners is to stay informed and keep software updated, since the fix may arrive as an update.
AI agents are raising accountability questions. A public interest law nonprofit sued OpenAI in September, alleging its AI agents accessed another company’s systems without permission during testing. The case points to California law stating that an AI acting on its own is not a valid defense, which raises the question of who is responsible when AI tools cause harm.

How AI Is Speeding Up Cyber Threats

The PHP flaws weren’t found by a lone hacker digging through code. Security researchers discovered them with the help of AI. One security company’s CEO even said his team found the same bugs on its own after asking an AI model to look for serious vulnerabilities in PHP.

This is the shift experts are paying attention to. 404 Media compared it to having a tool that can try every door in a building to see which ones are unlocked, including doors no one had bothered to check before. Much of the software running the internet is older or hasn’t been updated in years, and AI makes those weak spots much easier to find.

AI cuts both ways. The same tools help defenders find and fix problems faster. Security firms are now using AI to uncover critical flaws in popular website software before attackers do. In one October week, Wordfence’s AI research tool was credited with finding more WordPress vulnerabilities than any individual researcher. The catch is that a fix only helps once it is installed, which puts more responsibility on website owners to keep up.

How to Protect Your Website

Your website is often the first place customers go to learn about your business. A compromised site can send visitors to scam pages, trigger browser warnings and undo years of trust you’ve built. Staying ahead of threats comes down to a few regular habits:

Keep everything updated. That includes your content management system, plugins, themes and the server software behind them. Wordfence noted that a fully updated WordPress site can still be exposed if the PHP software behind it hasn’t been patched. Older PHP versions (8.1 and earlier) no longer receive updates from the PHP project, and PHP 8.2 stops receiving security fixes at the end of 2026.
Use a content delivery network (CDN) with a web application firewall (WAF). A CDN helps your site load quickly and stay online during traffic spikes. A WAF filters out malicious traffic before it reaches your site. During PHP2Shell, some WAF providers had protections in place hours before the flaws were publicly announced.
Scan your site regularly. Ongoing scans help catch vulnerable plugins, suspicious files and malware early, before they turn into larger problems.
Keep reliable backups. If something does go wrong, a recent backup can get your site back online quickly.

A firewall adds an important layer of protection, but it doesn’t replace updates. Both work best together. Learn more about the benefits of web maintenance and the hidden value of quality web hosting.

When the PHP vulnerabilities were announced, our team immediately got to work deploying mitigation measures and patches for the websites we host and maintain. Having a partner who watches for these issues means you don’t have to track every security alert yourself.

How to Protect Your Business and Yourself

Website security is only part of the picture. The devices and accounts you and your team use every day are just as important. These practices are simple to put in place and make a big difference for your business and your personal accounts:

Turn on multi-factor authentication (MFA) or passkeys. A stolen password alone won’t get someone into an account protected this way. Make it a requirement for business email, banking and any system with customer data.
Use a password manager. It makes unique, strong passwords for every account easy to manage, so one breached password doesn’t open the door to everything else.
Turn on automatic updates. Set computers, phones, browsers and apps to update on their own so security fixes are installed as soon as they’re available.
Install antivirus software with ransomware protection. It adds a safety net against malicious files and attacks that lock up your data.
Use a VPN on public Wi-Fi. Hotel, airport and coffee shop networks are convenient but not always secure. A VPN helps keep your connection private.
Back up important files. Store copies of critical business files somewhere separate from your main computer or network.
Talk with your team. Make sure employees know these expectations and feel comfortable asking before clicking a suspicious link or sharing information.

Stay Proactive to Protect Your Brand

No one can predict exactly where AI and cybersecurity are headed next. What is clear is that problems are being found faster, and the businesses that fare best are the ones that already have good habits in place.

A secure website and well-protected accounts help safeguard more than data. They protect your reputation, keep your customers’ trust and let you focus on growing your business instead of recovering from a setback.

If you have any questions about website security or hosting, we’d love to help.

SOURCES

PHP: Security Advisory, Critical Remote Code Execution Vulnerabilities

NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

404 Media: AI Is Changing Everything About Hacking

Cloudflare: Protections Against the PHP2Shell Vulnerability

Wordfence: PSA, PHP Security Updates Available for Two Critical Vulnerabilities

Wordfence: Why It’s Urgent to Update PHP on Your WordPress Site

Wordfence: Weekly WordPress Vulnerability Report, October 12 to 18, 2026

Wordfence: Cybersecurity Imperatives Will Demand AI Math

Wordfence: wp2shell Aftermath, the First Critical Unauthenticated WordPress Core RCE in Nearly a Decade

Business Wire: LASST Sues OpenAI Over Autonomous AI Agent Hacks