Cyber Attacks on Small Business 2026: October Incidents

October 2026 gave small businesses one fix to chase this week: PHP2Shell, two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), disclosed by the PHP project on 21 October. If your site runs PHP, ask your host whether the PHP serving your domain is patched and was restarted. The other incidents only matter if you use that specific software.

Who among small businesses is actually affected?

It depends on what you run, not on how big you are. This table covers the incidents with a vendor or government page behind them.

The full list, with every incident and its status, is in the status of each incident.

What is the trap for a small business?

Three mistakes show up in the way people talk about these incidents.

1. Treating the news cycle as one event. These are separate vendors with separate fixes. A fix for one does nothing for another.
2. Updating the wrong layer. PHP2Shell is in PHP, so updating WordPress or plugins does not close it, as the PHP notice puts it for the runtime serving web requests. On shared plans you cannot patch it yourself.
3. Reading a number as proof. A version string can be a backport, and a package update does nothing for workers that were never restarted. Ask for the build and the restart time, not a reassurance. The UK NCSC also says not to limit your search to old PHP versions.

How do I fix it this week?

If a host manages your PHP

Send support this and keep the reply:

For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed package, build or backport identifier, confirm that all workers serving it have been restarted or replaced, and say whether I need to change anything.

• Send the question to your host, or to the developer who looks after the site
• Keep the written answer with the date
• If the host cannot answer, ask for a date and ask what they advise in the meantime
• Check that the site still works after any change, checkout included

If you manage the server or the code yourself

• Find every place PHP runs: web, queue workers, cron, staging, containers. The UK NCSC asks for this inventory first
• Update from your distribution or vendor and restart the workers. Rebuild container images that bundle PHP
• Upgrade GitLab, Plex or Node.js to the fixed versions in the table above
• If you host on Railway or Zeabur, replace every secret stored there, following each vendor's own list (Railway, Zeabur)

The ransomware advisory is general hygiene. CISA and its partners list multi-factor sign-in, prompt patching of internet-facing systems, and encrypted offline backups with tested restores.

Am I affected? Where you stand right now

Were small businesses actually hit?

Be precise about words here. Plex says its flaws are actively and widely exploited, and CISA lists them in its catalog of known exploited vulnerabilities. The GitLab notice describes two detections for self-managed customers, and does not say a compromise was confirmed. The Node.js notice makes no statement on exploitation, but CISA added its Brotli flaw, CVE-2026-111497, to the catalog on 27 October. For PHP2Shell, CISA added both CVEs to the catalog on 26 October, so exploitation in the wild is on record. The PHP notice says a demonstrated exploit exists for the mod_php path, and we found no primary source naming a compromised business. The difference between attempts and real compromise has its own page.

The ransomware figure needs care too. AA26-293A says the group has had "at least 600 separate victims" across sectors since August 2024. That is the agencies' estimate for a campaign, not a list of small businesses and not a count for October.

If your PHP was unpatched and reachable around 21 October, ask your host or developer to look for unexpected PHP files in upload folders, scheduled tasks you did not create, and new administrator accounts. Patching does not remove anything planted earlier.

What about the certificate and platform stories?

Mozilla says it received a report on 17 October that the private keys of eight eMudhra intermediate certificates were compromised, and blocked them in Firefox within hours. Mozilla's post does not say whether any fraudulent certificate was issued. On 25 October, a commenter on Mozilla's incident bug reported 107,107 certificates signed with six of the keys in public logs on 20 and 21 October, nearly all proofs of concept for google.com, and eMudhra said it had decided to exit the public TLS business. Mozilla says Firefox users with standard settings are covered by its OneCRL blocklist without updating or restarting (at our check on 24 October 2026). Its post does not speak for other browsers. The Node.js releases also remove the CA certificate. See the eMudhra explainer.

For platform breaches, the vendor's own words limit what we can say. Railway says at most 1.85% of workspaces had some environment variables potentially compromised, asks everyone who signed up before 21 October to rotate keys stored on Railway, and says on 26 October that the incident is resolved for existing users. Zeabur calls its report preliminary. Both are vendor statements, not independent findings.

How far does one PHP bug reach?

Further than most owners expect, because so many sites sit on it. The reason is covered in why PHP matters, and the same plan applies to a store in the ecommerce version of this page. The other landscape write-ups cover startups and agencies.