Black October: 4 Cyber Threats to Act On Before Cybersecurity Awareness Month Ends

By gentec

October is Cybersecurity Awareness Month, and this year it has lived up to the name. Security researchers have started calling it “Black October” because of how many critical disclosures landed in just a few weeks. Most of the headlines involve software that small and mid-size organizations rely on every day: the engine behind their websites, the tools IT uses to support them remotely, and the apps connected to Microsoft 365.

Here are the four we would act on this week, and exactly what to do about each.

1. Patch the PHP engine behind your website (PHP2Shell)

On October 21, the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell.” Both are rated 9.2 out of 10 and can be triggered by an anonymous web request. Researchers demonstrated remote code execution against WordPress, Drupal and Joomla sites, and security firms reported exploitation attempts within days. Amazon’s threat intelligence team observed an attempt against a honeypot as early as October 17, before the fixes were public.

Why it matters: PHP powers a large share of the web, including most WordPress sites. Updating WordPress or your plugins does not fix this. The PHP runtime on the server has to be updated, which is usually your hosting provider’s or IT team’s job.

What to do:

• Ask your host or IT team which PHP version actually serves your site, and confirm it is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or a vendor-patched build.
• If you are still on PHP 8.1 or older, plan an upgrade. Those versions no longer receive official fixes.
• If your server was exposed before patching, review logs back to October 17 and rotate the database passwords and API keys your site can reach.

2. Lock down remote access tools

Remote support and VPN products are a favorite target because they sit at the edge of the network with privileged access. On October 15, BeyondTrust disclosed that a flaw in its Remote Support product (CVE-2026-102764) had been exploited since late August. CISA added it to its Known Exploited Vulnerabilities catalog the next day. Earlier in the month, researchers at Volexity reported attackers chaining zero-day flaws in Ivanti Connect Secure VPN appliances to steal Active Directory credentials and BitLocker recovery keys.

What to do:

• Inventory every remote access, VPN and remote support tool in use, including ones a vendor installed.
• Patch self-hosted appliances immediately. BeyondTrust patched its cloud customers; self-hosted customers must apply the BT26-05 patch themselves.
• Patching does not remove an attacker who is already inside. Review recent admin changes, rotate stored credentials and require MFA on every remote access path.

3. Audit the apps connected to Microsoft 365

On October 15, a credential tied to ConnectWise’s Cloud Backup service was used to reach customers’ Microsoft 365 environments. Huntress identified suspicious sign-ins across 162 organizations. Because the access came through a trusted application rather than a person, there was no password or MFA prompt to stop it. In one environment, a second connected app granted itself Global Administrator rights within minutes.

What to do:

• Review Enterprise applications and consented permissions in Microsoft Entra ID, and remove apps you no longer use.
• Check for unexpected admin role assignments, new application credentials and mailbox forwarding rules.
• Treat backup, monitoring and security vendors as part of your attack surface. They often hold the keys to everything.

4. Update every phone

Apple’s iOS 27.2 update, released in late October, fixes more than 160 security vulnerabilities. Phones hold email, MFA apps and company data, so they deserve the same urgency as laptops.

What to do: install iOS 27.2 and the latest Android security updates, and use mobile device management to enforce updates on company phones.

The pattern behind the headlines

Every major story this month follows the same pattern: attackers go after the systems with the most access, such as web servers, remote access tools and trusted integrations. The controls that stop most attacks have not changed: patch within days, not months; require MFA everywhere; limit admin rights; monitor every endpoint; and keep tested, offline backups.

Sources

• Unosecur: PHP2Shell exploitation timeline and remediation
• DeployHQ: PHP2Shell patch guide
• Rapid7: CVE-2026-102764 BeyondTrust Remote Support exploited in the wild
• Volexity: Chained exploitation of Ivanti Connect Secure zero-days
• CSO Online: ConnectWise backup credentials exposed multiple Microsoft 365 tenants
• Cybersecurity News, October 27, 2026 (citing MacRumors on iOS 27.2)