Threat briefing

October 2026 website security threats, and what to do about each one.

The second half of October 2026 brought critical flaws in PHP, Node.js, Next.js and nginx, two WordPress supply-chain backdoors, a certificate authority whose private keys could be guessed, and server software exploited within a day of public exploit code. This is the plain-language briefing, with sources, kept current as the facts change.

Last updated 25 October 2026.

PHP2Shell: two critical PHP flaws under active attack

CVE-2026-109618 and CVE-2026-109619 let an attacker run code on an unpatched PHP server with no login. Patched on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; exploit attempts reached the millions within 48 hours, with Mirai botnet payloads attached. Full detail, affected versions and the fix are on the PHP2Shell page.

What to do: confirm the PHP version serving your site, update to a fixed release or vendor backport, restart every worker, then test the pages that take money.

Node.js "Node2Shell": a compressed file that runs code

On 21 October Node.js shipped ten fixes across the 22, 24 and 26 lines. The serious one is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says can lead to remote code execution; researchers demonstrated it on a stock Node.js 24.22.0 build. It is easy to reach because fetch() and Express 5 decompress Brotli responses automatically. Three further high-severity fixes close TLS hostname-verification bypasses. The same Brotli library ships inside Python packages and other software, so the fix extends beyond Node.

What to do: update to Node.js 26.12.1, 24.22.1 or 22.23.4. If you build startup snapshots or single-executable applications, rebuild them; upgrading alone does not clear the cached entropy values. Node.js advisory

Next.js, nginx and Apache in the same week

• Next.js (14 October): a remote code execution flaw in "use cache" functions affecting 16.0.0 to 16.4.0, a second unauthenticated RCE through SVG image optimisation (CVE-2026-96889, fixed in sharp 0.35.5), and a Server Actions denial of service. Fixed in 16.4.1 and 15.5.28. Next.js security update
• nginx (14 October): five advisories that let unauthenticated requests crash worker processes, on top of a July heap overflow in map and regex handling that can lead to code execution. Fixed in 1.30.6 stable and 1.31.7 mainline. nginx advisories
• Apache HTTP Server 2.4.69 (1 October) fixed 20 CVEs, and Apache Tomcat fixed eight on 20 October, including an authentication bypass. httpd advisories

What to do: ask who manages your web server which build is running. Distribution packages often carry backported fixes without changing the version number, so get the answer in writing.

WordPress: backdoors delivered through trusted channels

• Rank Math SEO PRO 3.0.123, downloaded or auto-updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October, carried a backdoor that rebuilds itself after cleanup (CVE-2026-111862). Clean release: 3.0.124. Installing it replaces the plugin but does not remove planted files, accounts or scheduled tasks. SecurityWeek
• UpdraftPlus / UpdraftCentral: on 18 and 19 October, stolen UpdraftCentral dashboard keys were used to push signed commands that installed 99 backdoor plugin variants with hidden administrator access. No plugin version stops it while a key remains stored. Patchstack
• Bricksforge CVE-2026-85097 (CVSS 10.0), exploited since 7 October; fixed in 3.1.8.10. Ninja Forms (fixed 3.15.4) and WPC Product Bundles (fixed 8.6.7) stored-XSS flaws were used from 4 October to install a disguised plugin and create administrator accounts. Elementor Pro CVE-2026-32475 (fixed 4.2.2) has been exploited since August.

What to do: update the named plugins, delete every stored UpdraftCentral key, then review users, plugins, uploads and scheduled tasks for anything added since 4 October. Updating alone does not remove an existing backdoor.

eMudhra: a certificate authority with guessable keys

On 17 October a researcher found that eight eMudhra intermediate certificates had private keys that anyone could compute from public data; one key was the number 4. Chrome and Firefox blocked them the same day, Apple and Microsoft within the week, and Mozilla removed trust in the emSign ECC Root CA - G3. Sites on those chains now produce browser errors, and eMudhra has announced its withdrawal from public TLS issuance. The Hacker News

What to do: check who issued your certificate. Our free check reads the chain and flags eMudhra and emSign issuers. If you are on one, replace the certificate with another authority now.

Plex, Collabora and CISA's exploited list

Four chained Plex Media Server flaws went from public exploit code to live attacks dropping crypto-miners and proxy backdoors within a day; CISA added all four to its Known Exploited Vulnerabilities catalog on 20 October, followed by Collabora Online (CVE-2026-110447, used to plant web shells on Nextcloud servers), the SiteGuard Server Edition WAF and Arista VeloCloud. CISA alert

What to do: anything on CISA's list that faces the internet gets patched or taken offline the same day.

Hosting platforms and stolen AI keys

Railway (21 October) and Zeabur (14 October) both had customer environment variables accessed, with some decrypted; the attacker targeted AI provider API keys. Zeabur is shutting down. LiteLLM 1.107.0 on PyPI and Docker Hub (21 October) shipped a credential stealer that runs at Python startup even if the package is never imported.

What to do: if you deploy on either platform or installed LiteLLM 1.107.0, rotate every secret those environments held, not only the AI keys.

Questions people ask

My website looks fine. Does that mean it is not affected?

No. None of the attacks above change what a homepage looks like. Backdoors, data theft and spam relays run underneath a working site; most owners find out from a customer, a payment provider or a Google warning.

I only run WordPress. Do I need to care about PHP and nginx?

Yes. WordPress runs on PHP, behind a web server, on a Linux machine. A flaw in any layer exposes the whole site, and a plugin update does not patch the layers underneath.

How do I know which of these applies to my site?

Run the free check on the home page. It reads your server software, PHP version, WordPress add-ons and certificate chain from the outside and tells you which of these incidents is relevant and what to do next.