Update, October 31: Patchstack published a note on October 30 that changes what I said about the Brotli flaw (CVE-2026-111497) and WordPress. WordPress does not bundle Brotli; it uses whatever copy the server's operating system provides, so there is nothing to update in WordPress or a plugin. But Patchstack says a standard WordPress site is reachable through the pingback feature in xmlrpc.php, which needs no login, and that plugins or themes that fetch web addresses supplied by visitors can be reached the same way. It scores the flaw 9.2 and says CISA added it to its Known Exploited Vulnerabilities list on October 27. The fix is to have your host or server administrator update the Brotli library (fixed in 1.0.10, 1.1.1 and 1.2.1, or the distribution's own security update, and check the package revision rather than the version number). Patchstack also says the official WordPress Docker image still ships a vulnerable copy, so rebuilding from it is not enough on its own. Until that is done, blocking xmlrpc.php at the web server is a stopgap, not a fix. Ask your host whether your servers are patched. This comes from one source, Patchstack, so treat the details as unconfirmed until others report it; I have not seen reports of WordPress sites being attacked this way.
Update, October 28: The US cyber agency CISA added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities list on October 26, which means it considers them to be under active attack, and it has told federal agencies to fix them by October 29. Cyfirma, a security firm, reports scanning and attempted web-shell installs against unpatched servers and links the activity to a suspected North Korea-linked group; that attribution comes from one firm, so treat it as unconfirmed. The reports I read do not mention WordPress specifically, and I have not seen a confirmed WordPress-specific attack. The advice is unchanged but more urgent: ask your host to confirm PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a backport), or that session upload progress is off. This comes from The Hacker News, Security Affairs and Federal News Network.
Update, October 26 (Brotli): A separate flaw disclosed this week, CVE-2026-111497, is in Brotli, a data-compression library used by Node.js, Python, Bun, .NET and other software. It is a different bug from PHP2Shell, found by different researchers, and the sources I read at the time did not link the two or mention WordPress (see the October 31 update above, which does). It does touch PHP: PHP has re-released its Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) with a fixed Brotli, and the version number does not change, so php -v will look the same. If your site runs on PHP for Windows, ask your host to confirm the "-1" build; most WordPress hosting runs on Linux, where I have not seen this reported. Researchers have working exploits, Microsoft rates exploitation as "more likely", and I have seen no reports of attacks yet. This comes from Wiz, The Hacker News and The Register.
Update, October 26: Most major hosts say they have now patched PHP2Shell, but not all, and not every plan type. Hosts that report finishing include WP Engine, Kinsta, Cloudways, DreamHost and, per the host notices, Namecheap's shared servers; WordPress.com, Pressable and WP Cloud say they were protected before the October 21 release. Bluehost, HostGator and Liquid Web were still rolling out fixes as of October 24 and 25, and several hosts leave self-managed VPS plans to the customer, who has to apply the fix or turn off session upload progress themselves. This comes from the hosts' own notices as relayed by The Repository and a third-party status tracker, ActiveSet, and statuses change daily, so confirm with your own host rather than relying on this list. I have not found any new PHP flaw beyond CVE-2026-115560, which still has no fix date.
Update, October 24: PHP has published an advisory for a further issue, CVE-2026-115560, which the October 21 releases do not fix. According to The Hacker News, it could allow code execution only on unusual setups: an application that sets the session handler in the server configuration, switches it with ini_set() before starting a session, and still has session upload progress turned on. PHP calls exploitation unlikely, has not issued an emergency release and, per that report, no attacks have been seen; a fix is due in a routine release with no date given. The mitigation is the same one PHP gave for PHP2Shell, turning off session upload progress (session.upload_progress.enabled=0), so hosts that already did that need nothing more. I have not confirmed whether WordPress core or common plugins use this setup, and I have only seen it from one news report so far, so treat the details as unconfirmed. Separately, one analysis of WordPress.org's PHP statistics, read on October 21, puts about 20 percent of WordPress installs on PHP 7.x and about 36 percent on PHP 8.1 or older. Those are the versions with no official PHP2Shell release, so ask your host whether a vendor backport covers you. The figure counts installs that check in for updates, so it is not a count of vulnerable sites.
Update, October 23 (evening): Exploit code for the PHP flaws is now reportedly circulating. Security company Sophos says proof-of-concept code is publicly available, and Bitsight describes a leaked exploit tool going around, though neither gives a date for when it first appeared. Sophos also cautions that some researchers' successful tests may only work in lab conditions. On live attacks the reports differ: Sophos first reported a successful exploitation, then corrected itself, saying it has seen scanning and a small number of failed attempts but no evidence of a successful compromise, while Bitsight says only that security vendors have reported early signs of exploitation without naming them. Neither mentions WordPress specifically. The practical advice does not change: ask your host to confirm the patched PHP version today.
Update, October 23 (latest): More detail is out on the Rank Math PRO incident. Only version 3.0.123 of the paid plugin was affected, and only when downloaded from Rank Math's own website during roughly 11 hours between October 15 and 16, according to BleepingComputer's report of the vendor's advisory. The free Rank Math plugin from WordPress.org was not affected. Patchstack lists it as a backdoor (CVE-2026-111862) that needs no login, and says a firewall rule cannot block it, so the only fix is version 3.0.124 or later. Updating or deactivating does not remove it: if 3.0.123 was ever activated, treat the site as compromised. Things to ask your host or developer to check: a file called wp-includes/class-wp-cache-util.php, traffic to rank1cdn[.]com, and new administrator accounts starting with "wpsupport_" and using @wp-mail.net addresses. The vendor has not said how many sites were hit. These indicators come from one news report quoting the vendor, so treat the details as unconfirmed until others verify them.
Update, October 23 (later): Patchstack's PHP2Shell alert, which cites research from Wiz, now says Wiz demonstrated code execution without a login against the latest WordPress container image, so WordPress sites on an unpatched PHP version are exposed, not just in theory. Patchstack also warns that the flaws sit below WordPress itself, so your site's own logs may show little. Signs to ask your host to check: unusual upload requests followed by memory-limit errors or repeated server errors (HTTP 500), very large or malformed session cookies (PHPSESSID), and PHP processes restarting for no reason. If you see those, treat the server as possibly compromised and change the passwords and keys stored on it. Patchstack also notes that PHP 8.2 only receives security fixes until December 31, 2026. I have not seen a WordPress-specific exploit used against live sites, and most disruption so far has come from patching and takedowns.
Update, October 23: Three things have changed. Security company Tenable now lists the same fixed PHP versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and says PHP 7.4 to 8.1 got no official release, only source-code backports, while PHP 7.3 and older get no fix at all, so ask your host which applies to you. Tenable also reports that Amazon's security team saw an exploit attempt on October 17, four days before the public announcement, and that researchers at Calif say they confirmed the flaw against popular PHP software including WordPress. That last claim comes from one summary, so treat it as unconfirmed. Separately, the Rank Math PRO plugin had a compromised release (version 3.0.123, downloadable October 15 to 16) that carried a backdoor; if you use it, update to 3.0.124. It looks like a different incident from UpdraftCentral.
What is "Black October"?
On October 22, a widely shared post on X called the previous 48 hours the worst stretch the security world had seen. The nickname stuck. It is not one attack. It is a pile of disclosures that all landed between October 19 and 22: two serious flaws in PHP, a backdoor campaign aimed at WordPress sites running UpdraftPlus, tampered software downloads, and a run of data breaches at developer and hosting platforms.
One summary of the week makes a useful point. The surge was mostly in how much was announced. Plenty of the attacks behind those announcements had been running for weeks or months before anyone noticed. That matters for the rest of this post, because it means the date a problem becomes public is not the date it began.
If you run a WordPress site, two of these stories touch you directly. The rest are worth knowing about, but they are less likely to land on your site.
PHP2Shell: the flaw in the language WordPress runs on
PHP is the programming language behind roughly 70 percent of the websites whose server language is known, and WordPress is one of them. On October 21, the PHP project released security updates for two critical flaws, together nicknamed PHP2Shell. In plain terms, they could let an attacker take control of a web server without any legitimate access, then read data or run their own code.
The bugs are reported to be more than a decade old. They stayed hidden because exploiting them took complicated technical work. This time, AI tools found them: researchers at Wiz, Calif and OpenAI report using AI to find the bugs, and the security company Chainguard says it found the same ones on its own by asking a frontier AI model to look for serious PHP vulnerabilities.
The reaction was fast. Cloudflare's CEO said the company saw thousands of exploit attempts in the ten hours before the announcement and millions by the time the story was written. The NSA and other governments told organizations to patch immediately or take services offline until they could. Several well-known sites, including Archive.org and some Wikimedia services, went down temporarily while they updated.
It is worth keeping some perspective. At least one security researcher called PHP2Shell far less exploitable than Log4j or Heartbleed, two of the worst flaws in recent memory, and many of the exploits posted online appear to be low-effort code that probably does not work. So far, most of the disruption has come from patching and takedowns, not from confirmed mass compromise, although CISA now lists both flaws as actively exploited. That could change, which is why patching quickly still matters.
The fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to more than one report, but check them against the PHP project before relying on them. Most reports I read do not say WordPress itself is being targeted, but Patchstack reports that Wiz demonstrated the flaw against the latest WordPress container image, and one summary says researchers at Calif confirmed it against popular PHP software, WordPress included. The practical point is simpler: your WordPress site is only as safe as the PHP version your host runs, and that is a decision your host makes, not something a plugin update changes.
The UpdraftCentral backdoor: a backup plugin turned against its users
UpdraftPlus is one of the most popular WordPress backup plugins, with more than four million active installs. It includes a feature called UpdraftCentral, which lets a dashboard manage your site remotely. Each connection is protected by a private key.
TeamUpdraft, the company behind the plugin, said on October 19 that someone had broken into its own website over the weekend of October 17 and 18, and that connection keys were in the database that may have been accessed. Starting around October 18, attackers used stolen keys to send signed commands that installed hidden backdoor plugins on sites that trusted them. Because the commands carried a real signature, the sites accepted them as legitimate.
The backdoor plugins let the attacker create a hidden account and log in without using the normal login page, which means two-factor authentication and login-protection plugins never get a chance to stop them. The hidden account stays on the site even after the plugin that created it is deleted. Patchstack found 99 different disguised plugin names, so removing one suspicious plugin does not prove you are clean.
The company has since released UpdraftPlus 1.26.13 (free) and 2.26.13 (premium), which disconnect keys created before the breach. A first attempt, 1.26.12, was reported to contain a bug that stopped it from working. Updating does not remove a backdoor that is already on a site, and reports describe a short window on October 18 where keys were not revoked automatically. Estimates of how many sites were affected vary, and one report put it at around 400,000. I could not find a count confirmed by a security firm.
TeamUpdraft said the database that may have been accessed held names, email addresses, billing addresses, order history, hashed passwords and two-factor settings, and that it holds no payment card data. If you have a TeamUpdraft account, change that password, and anywhere else you reused it.
The rest of the pile-up
The other items are less likely to touch a typical business website, but together they show how this week looked:
- Tampered software. Attackers changed the files behind AOMEI Backupper so its updater installed a backdoor, hijacked a developer account to publish altered versions of the OVHcloud command-line tool, and put credential-stealing code into a LiteLLM package release.
- Network equipment and servers. A Palo Alto firewall flaw patched in May was reported to be under attack by ransomware groups from the middle of May. Three memory bugs were fixed in NGINX, a web server used by a very large share of the internet.
- Platform breaches. Developer platforms Zeabur and Railway disclosed problems with stored credentials, and the database company PingCAP reported attackers using stolen service credentials for about a month.
The pattern across all of them is the same. Most did not start with a clever technical trick. They started with a trusted key, token or update channel getting into the wrong hands.
Is WordPress itself affected?
None of the reports I read say WordPress core has its own vulnerability this week, although one summary says the PHP flaws were demonstrated against WordPress running on vulnerable PHP. The risk to a WordPress site comes from three places around it: the PHP version your host runs, plugins like UpdraftPlus, and the tools and services you use to manage the site. A site can be fully updated inside WordPress and still be exposed through any of the three.
What to do this week
None of this needs a developer to start. Here is the order I would work in:
- Ask your host about PHP. Find your PHP version under Tools, then Site Health, then Info, then Server in your WordPress dashboard. Then ask your host whether they have applied the October 21 PHP security release. A managed host should be able to answer that in one reply.
- Deal with UpdraftPlus. If it is installed, update to version 1.26.13 or 2.26.13, then go to Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, and delete every key. You are exposed if a key exists, even if you never used the feature.
- Look for anything you did not add. Check your plugin list and your user list for names you do not recognize. Patchstack and Nethemba publish the specific plugin and account names to look for.
- Reset the keys to the kingdom. Change administrator passwords, turn on two-factor authentication, and if UpdraftPlus connects to cloud storage, re-authorize that storage and rotate its access keys.
- Keep a backup from before October 17. If you do find a backdoor, treat the site as fully compromised and restore from a copy taken before the breach window, rather than trying to patch around it.
If you find something, or you are not sure whether you have, our emergency support team can step in. We covered the UpdraftPlus side in more detail in UpdraftPlus Backdoor Attack: What to Do Now, and if you suspect a break-in more generally, see what to do when WordPress is hacked.
What this week really shows
Three lessons apply to any business that depends on a WordPress site, whatever happens next week.
Speed is the new baseline. One summary of this week's events cites a Rapid7 measurement of about three days, on average, from a severe flaw being disclosed to attackers using it. Cloudflare's CEO said PHP2Shell exploit attempts started before the official announcement. A monthly maintenance routine cannot keep up with that for serious flaws.
Every remote-access feature is a front door. The UpdraftCentral story is a reminder that a feature you may not know you have, holding a key you did not knowingly create, can be the way in. Somebody should know which remote-access features are switched on, and who holds the keys.
Updating is necessary, not sufficient. Updating UpdraftPlus cuts off the stolen keys, and it still leaves behind anything already installed. Patching fixes the hole. Checking whether anyone came through it first is a separate job, and it is the one most often skipped.
That gap between "patched" and "verified clean" is exactly where an owner is needed. We wrote about it in why WordPress needs someone accountable. A defined party who owns updates, security monitoring and incident response is the difference between reading about this week in the news and having someone already working on it.
Sources
This post draws on reporting from Axios, 404 Media, SecurityToday, The Hacker News and Patchstack, Tenable, TeamUpdraft, Patchstack (PHP2Shell alert), Patchstack (Brotli), SecurityWeek, BleepingComputer and Patchstack (Rank Math PRO entry), Sophos Bitsight, The Hacker News (CVE-2026-115560) Sandbanks Digital (PHP version statistics), The Repository and ActiveSet (host patch status), plus Wiz, The Hacker News and The Register (Brotli, CVE-2026-111497), plus Security Affairs and Federal News Network (CISA listing, October 26). This is a fast-moving situation, and details may change.
