Black October 2026: Security Checklist for Microsoft 365 Businesses

In the past week, a long list of serious security problems landed at once: a critical PHP flaw, an exploited Windows zero-day, firewall and VPN attacks feeding ransomware crews, compromised WordPress plugins, a backdoored backup tool, cracked certificate authority keys and several developer-platform breaches. Social media has started calling it "Black October." The list is long, but most small and mid-sized businesses running Microsoft 365 need to do a short list of things this week.

Does this affect a cloud-only Microsoft 365 business?

Microsoft patches Exchange Online, SharePoint Online and Teams for you. Your Windows PCs, firewall, VPN, backup software, website and any app you host are still yours. Most of this week's incidents hit those systems, and credentials stolen from them are then used to sign in to Microsoft 365. That is why the checklist below starts on your own devices.

The checklist, in priority order

1. Install the October 2026 Windows and Microsoft updates

• Microsoft's October 13 release fixed about 1,400 CVEs, including CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass that is being exploited. Attackers use this kind of bug to make malicious downloads skip the usual warning.
• In the Intune admin center, check Reports > Windows updates (or your RMM's patch report) and chase any device that has not installed the October cumulative update (KB5127648 for Windows 11, KB5126657 for Windows 10).
• October was the last update for Windows 11 24H2 Home and Pro. Move those devices to a supported release.
• If you still run SharePoint Server on-premises, patch CVE-2026-65660 now. It is exploited and on CISA's Known Exploited Vulnerabilities list, and attackers chain it to skip sign-in on sites that allow anonymous access. Turn anonymous access off if you do not need it. On-premises Exchange also got a code-execution fix (CVE-2026-70571).

2. Patch firewalls and VPNs, and hide their admin pages

• Palo Alto Networks: CVE-2026-0322 (management-interface code execution) is exploited and was added to CISA's KEV list on October 14. Ransomware groups have also used the GlobalProtect bypass CVE-2026-0257 since June. Patch PAN-OS and restrict the management interface to trusted internal addresses.
• Other edge devices: the SafePay advisory lists Cisco ASA and FTD, SonicWall and Veeam as ways in. Make sure each is on the vendor's current fixed release.
• If you ran a vulnerable version while it was exposed, patching is not enough. Look for new admin accounts, unexpected VPN users and configuration changes, or ask your provider to.

3. Get ready for SafePay-style ransomware

On October 20, CISA, the FBI and partners published advisory AA26-293A on SafePay ransomware, which has hit more than 600 victims since 2024. It gets in with stolen or brute-forced passwords and VPN flaws, then factory-resets NAS boxes and deletes Windows shadow copies before encrypting.

• Require phishing-resistant MFA (passkeys, Windows Hello for Business or FIDO2 keys) on VPN, remote desktop and Microsoft 365 admin accounts.
• Keep at least one backup copy offline or immutable. A NAS on the same network is not a safe last copy.
• Restrict PsExec, WinRM and RDP to the admins and systems that need them.
• Check firewall logs against the indicators in the advisory.

4. Website: PHP and WordPress

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated code execution on PHP web servers. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host to confirm in writing. Our PHP2Shell guide has the full sequence.
• UpdraftPlus: UpdraftCentral remote-management keys were stolen on October 17 and 18 and used to plant backdoor plugins and admin accounts. Update to 1.26.13 (free) or 2.26.13 (Premium), delete keys created on October 18, and check for admin users and plugins you do not recognize.
• Rank Math PRO: version 3.0.123 downloaded on October 15 or 16 was trojanized. If it was ever installed, restore from a backup taken before October 15 and move to 3.0.124.

5. Backup and remote-access tools on PCs

• AOMEI Backupper: Google's threat intelligence team found its update servers handed out a backdoor in short windows between spring and July 2026. Fixing the servers did not clean PCs that were already infected. Check for a scheduled task named RadminComponentRuntime and network traffic to storage-data.com; rebuild any machine that has them.
• Plex Media Server: exploited since October 17. Update to 1.43.3.10861 or later. Plex says to treat older servers that were reachable from the internet as compromised and reinstall clean. Plex has no place on a business network; if staff run it at home on a work laptop, remove it.

6. Certificates and trust

Eight eMudhra intermediate certificate authority keys were found to be weak enough that their private keys could be worked out. Chrome, Firefox and Windows' downloaded disallowed-certificate list now block them. Keep Windows, Edge and Chrome updated, and make sure developer tools and older appliances that carry their own certificate store (Python, Node.js, Go, Java, Docker images) are updated too. See our eMudhra guide for the details.

7. AI tools, agents and developer platforms

• If your developers used LiteLLM 1.107.0, Railway, Zeabur or the OVHcloud CLI versions 0.11.0 to 0.15.0, rotate every secret those systems held and rebuild the affected hosts. The last safe LiteLLM version is 1.106.2.
• Review which AI apps and agents have access to your Microsoft 365 data. Our guide on controlling AI agents in Microsoft 365 walks through consent settings, grant reviews and Conditional Access for agents.

What you can mostly ignore

Several headline items matter a lot to specific groups but little to a typical Microsoft 365 business: the GitLab CVSS 10 flaw (unless you self-host GitLab), NGINX and HTTP/3 server bugs (unless you run your own web servers; your host should patch), hijacked Tor relays, and breaches at companies you do not use. If one of these applies to you, patch to the vendor's fixed version and move on.

How to verify you are done

1. Intune or your RMM tool shows every Windows device on the October cumulative update.
2. Your firewall and VPN show the vendor's fixed version, and the management interface is not reachable from the internet.
3. Your web host has confirmed the PHP version or backport in writing, and WordPress shows current UpdraftPlus and Rank Math versions with no unknown admins.
4. A restore test from your offline or immutable backup worked.
5. Entra sign-in logs show MFA on every VPN and admin sign-in, with no legacy authentication.

Frequently asked questions

What is Black October? An informal name for a cluster of serious security disclosures and breaches in mid to late October 2026. It is not an official name, and a few social posts exaggerate details, so check each item against the vendor's advisory.

Which Microsoft updates matter most? The October 13 cumulative updates (exploited Windows Shell bug CVE-2026-96951) and, for on-premises SharePoint Server, CVE-2026-65660.

We only use Microsoft 365 in the cloud. Are we affected? Microsoft patches the cloud services. Your PCs, firewall, VPN, backups and website are still yours, and that is where most of this week's risk sits.

What does SafePay ransomware target? Stolen or brute-forced credentials and VPN or edge-device flaws, followed by wiping NAS devices and shadow copies. Phishing-resistant MFA and offline backups are the main defenses.