Black October: the supply chain attacks of October 2026, and what to do now

"Black October" is the name going around for a run of software breaches in October 2026. Between October 5 and October 21, attackers slipped malware into popular code packages, a WordPress plugin and a command-line tool, stole secrets from hosting platforms, and pushed backdoors through a backup service. Big security fixes for PHP and Node.js landed the same week.

Most of these were supply chain attacks: instead of breaking into one business, attackers broke into a supplier that thousands of businesses trust. We checked every item on the viral list against the company's own notice. Here is what happened, what was overstated, and what to do.

What happened in Black October?

Incident	Date	What happened	Who should act
Node.js	Oct 21	Security releases fix 10 flaws, including a remote code execution bug in its Brotli decoder	Anyone running Node.js: update to 22.23.4, 24.22.1 or 26.12.1
PHP (php2shell)	Oct 21	Two critical flaws let attackers run code on web servers without logging in	Every PHP site: update now (our guide)
tensorlake	Oct 8	Version 0.5.144 of the npm package, published from a hijacked account, carried a credential-stealing worm	Developers: go back to 0.5.143; if 0.5.144 ran, rebuild the machine
LiteLLM	Oct 21	A malicious 1.107.0 release on PyPI and Docker stole credentials	Teams using it: reinstall 1.106.2 and rotate every reachable credential
Railway	Oct 21	An intruder may have accessed encrypted environment variables, some decrypted, for a subset of users	Customers: rotate all environment variables and keys
Zeabur	Oct 14 to 15	Plaintext admin credentials let an attacker read customer secrets across 9 regions; the service closes December 31, 2026	Customers: rotate everything and move off
OpenCode	Oct 16 to 17	A legacy console was breached; keys for outside AI services of 1.4% of console users with linked providers may be exposed	Users who got the company's email: revoke those keys
OVHcloud CLI	Oct 19	Release binaries v0.11.0 to v0.15.0 were swapped for code that steals cloud credentials and SSH keys	Users: delete them, install v0.16.0, rotate secrets
Rank Math PRO	Oct 15 to 16	PRO 3.0.123, downloaded in an 11-hour window, carried malware	WordPress sites: see the next section
TeamUpdraft	Oct 17 to 18	Customer data and UpdraftCentral keys were stolen; the keys were used to push backdoor plugins to connected sites	UpdraftCentral users: see the next section
ConnectWise	Found Oct 14	Attackers got app identities and credentials for its Cloud Backup service, now suspended	IT providers using it: review sign-ins since October 13
SubQuery	Oct 5	@subql/common 5.8.3 on npm stole credentials and opened a remote shell	Developers: remove 5.8.3, rotate secrets, rebuild
GhostAction	Oct 7 to 9	Hijacked GitHub accounts added fake "security" workflows that send repository secrets to the attacker	Teams on GitHub: search for those workflow files
eMudhra	Oct 17 to 20	Weak private keys for eight intermediate certificates could let attackers forge website certificates; browsers and operating systems now block them	Everyone: install system updates

Two corrections to the viral list. GhostAction is not new: it was first reported in September 2025 and came back this autumn. And Tailscale was not breached. It published a bulletin about the eMudhra certificates, says traffic between devices on a tailnet is not affected, and asks users to update to version 1.104.2 or later.

Which incidents matter for a small business?

Most of the list hits software developers. Four items reach ordinary business websites and offices.

• WordPress sites. If your site installed Rank Math PRO 3.0.123 and activated it, Rank Math says to restore the site and database from a backup made before the incident, then change passwords, database credentials, salts and API keys. If you use UpdraftCentral, TeamUpdraft says to delete the connection keys, check users and plugins (including must-use plugins), change admin passwords, and restore from a backup made before October 17 if anything looks wrong.
• PHP. WordPress runs on PHP, so the php2shell fix applies to every WordPress site too.
• Hosting platforms. If your app or website runs on Railway or Zeabur, treat every secret stored there as exposed.
• Backups. If an IT provider backs up your cloud email and files with ConnectWise Cloud Backup, ask what they found when they reviewed sign-ins.

Why are attackers going after software suppliers?

Because one break-in reaches thousands of customers. Three patterns repeat across October:

1. Hijacked developer accounts. tensorlake, the OVHcloud CLI and GhostAction all started with a stolen account. The official release then carried the malware.
2. Secrets held by platforms. Railway, Zeabur, OpenCode and ConnectWise all held keys and passwords for their customers. One theft opens many businesses at once.
3. Worms. The tensorlake malware belongs to the Shai-Hulud family of npm worms, which steal a developer's tokens and use them to spread.

The lesson is uncomfortable: a trusted update can be the attack. Pin the versions you install, keep a list of every secret and where it lives, and be ready to change them all in an afternoon.

What should you do this week?

1. Ask your web person three questions: which WordPress plugins and versions you run, whether PHP is patched, and when the last clean backup was made.
2. Update Node.js wherever your systems run it, to 22.23.4, 24.22.1 or 26.12.1.
3. Install operating system updates on every computer and server, so they stop trusting the eMudhra certificates. Tailscale users should be on 1.104.2 or later.
4. Rotate secrets stored on any platform named above, starting with payment, email and cloud keys.
5. If you have developers, have them check lockfiles for tensorlake 0.5.144, litellm 1.107.0 and @subql/common 5.8.3, check for OVHcloud CLI v0.11.0 to v0.15.0, and search repositories for workflow files named security-audit.yml or github_actions_security.yml.
6. Write down where every key lives. A list of each secret, who owns it and what it opens turns a bad week into a few hours of work.

Is a third of the internet really affected?

No source supports that number. It seems to mix up how widely software is used with how many sites were harmed. PHP and the big web servers run a large share of websites, which is why a flaw in them matters, but a patched site is not affected. The incidents are real. "A third of the internet is broken" is not.

How Raileon helps

On a free 20-minute call with the founder, we'll go through this list against what your business runs and put the fixes in order. For systems we build and run, monthly care (hosting, monitoring, fixes and updates) starts from $1,999 a month.

FAQ

What is Black October?

Black October is the nickname for a run of software supply chain attacks and breaches in October 2026, including malicious npm and PyPI releases, a backdoored WordPress plugin and stolen secrets at hosting platforms.

What is a supply chain attack?

It is an attack on a supplier, such as a code package, plugin, update server or hosting platform, so that the supplier's own updates or systems carry the attack to its customers.

Was Tailscale hacked?

No. Tailscale published a bulletin about the compromised eMudhra certificates and says traffic between devices on a tailnet is not affected. It asks users to update to version 1.104.2 or later.

Do I need to do anything if I don't write code?

Yes, if you have a website or online accounts. Install system updates, ask your web person about PHP and WordPress plugins, and change any secrets stored on an affected platform.

Sources

1. Node.js: October 2026 security releases, October 21, 2026.
2. CISA: Critical Vulnerabilities in PHP Require Immediate Patching, October 21, 2026.
3. Tensorlake: security advisory GHSA-8g63-53c9-65j2, October 2026.
4. LiteLLM: Security incident, October 21, 2026.
5. Railway: Security disclosure, Wednesday, October 21st.
6. Zeabur: October 2026 security incident, October 19, 2026.
7. TechCrunch: Hackers hit AI coding tool OpenCode, October 19, 2026.
8. OVHcloud: ovhcloud-cli security advisory GHSA-862f-55f5-vmvw, October 2026.
9. Rank Math: PRO 3.0.123 security incident, October 2026.
10. TeamUpdraft: Security incident, October 2026, October 19, 2026.
11. ConnectWise: Trust Center advisories, updated October 22, 2026.
12. GitHub Advisory Database: GHSA-9333-3c4x-x3h5, @subql/common, October 2026.
13. GitGuardian: GhostAction returns, October 2026.
14. eMudhra: Certificate security incident, October 20, 2026.
15. Tailscale: Security bulletin TS-2026-013, October 21, 2026.

Start with one list

Write down every website, plugin, platform and key your business depends on. It is the first thing you will need the next time a supplier is hit. If you'd like help with it, book a call.

Book a free 20-minute call