'Black October': a giant web flaw has sites scrambling. Here's what it means in Albuquerque

A viral post online gave this month a new name: “Black October.”

The biggest reason is a pair of flaws in PHP, the code that runs more than 70% of websites by some estimates. The flaws, nicknamed “PHP2Shell,” let an attacker take over a website’s server without a password. From there, they could read what the site holds, like passwords and keys to other systems.

A fix came out on Oct. 21. The federal cybersecurity agency, CISA, told anyone who can’t install it fast to take their PHP sites offline until they can. Hundreds of websites went dark that day, some of them government sites.

You don’t need to update anything on your phone or computer for this one. The flaw lives on the servers that run websites. The risk to you is that a site holding your name, address or payment card gets broken into before it’s fixed.

Is anyone being hacked yet?

Not for sure. CISA said it had not seen attacks when it posted its warning. Security firms say attackers are already trying. Jake Knott of the security firm watchTowr told The Record that nobody had gotten in yet, but “we don’t expect that will last long.”

What about sites here?

If a site runs on PHP, that doesn’t mean it’s open to attack. It means the people who run it had to install the fix.

If a city, county or school website is down this week, this may be why. CISA told anyone who couldn’t patch right away to pull their sites offline, and at least one company that hosts city and town websites, CivicPlus, did just that on Oct. 21 as a safety step. A site that’s down for a fix is a good sign, not a bad one. If you need to pay a bill or reach an office, call instead.

A separate attack up the road

The Town of Bernalillo was hit by a cyberattack this month. It froze online water bill payments and closed the town’s motor vehicle office. The town waived late fees and stopped shutoffs while it recovers. Nothing ties that attack to the PHP flaw.

What you can do

1. Watch your email for breach notices from local offices, schools or stores. If you get one, change that password.
2. Don’t reuse passwords. If one site leaks, a reused password opens your other accounts.
3. Turn on two-step login for email and banking.
4. Be careful with “urgent” emails or texts about your account. Scammers use news like this to sound real. Go to the site yourself instead of tapping the link.

Got a website? Here’s how to check it

If you run a website for your business, church, club or family, take five minutes on this.

1. Find out who runs your server. If you built the site on a service like Squarespace, Wix or Shopify, that company runs the server, so ask it whether your site needs anything. If you pay a web host, like GoDaddy or Bluehost, for a WordPress site, keep going.
2. Look up your PHP version. On WordPress, log in and go to Tools, then Site Health, then Info, then Server. Your hosting control panel usually shows it too.
3. Compare it to the fixed versions. The fix is in PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or anything newer on the same line. If your site runs PHP 8.1 or older, PHP no longer puts out new versions for it. Ask your host to move you to a newer version, or take the site down until they do.
4. Not sure? Ask your host one question: “Is my site patched for PHP2Shell?” Some hosts install the fix without changing the version number, so they are the ones who know for sure.

Or send us your website and we’ll check it for you. Use our tip page and put “website check” in your note. We’ll look only at what your site shows the public, and we’ll write back with what we find. We won’t publish your site or your name.

What else is in “Black October”

The name came from a widely shared post on X on Oct. 22 that bundled a string of recent hacks together, including one where attackers copied California public school students’ data from a state testing contractor between May and September. Some had been running for weeks or months before anyone said so.