If you only skim one security update this week, make it this one. October 2026 has been busy: Microsoft shipped its biggest Patch Tuesday ever, a China-linked group was caught using a zero-day in remote support software, and a popular WordPress SEO plugin was briefly shipped with malware inside it.
I already covered the PHP2Shell flaws in my previous post, so this roundup looks at what else is making headlines. Here is what happened, in plain language, and what you can do about it today.
1. Microsoft's record October Patch Tuesday
On October 13, Microsoft released fixes for 1,411 vulnerabilities, which BleepingComputer describes as a record. About 70 of them are rated Critical, and most of those are remote code execution bugs. Three are zero-days:
- CVE-2026-96951 is a Windows Shell flaw that bypasses Mark of the Web, the warning Windows shows on files downloaded from the internet. It is the one confirmed as actively exploited.
- CVE-2026-108398 is a .NET Framework bypass that can sidestep Windows Defender Application Control. It was found by Google Project Zero's James Forshaw and was publicly disclosed before the fix.
- CVE-2026-92707 is a denial-of-service issue in MessagePack-CSharp, rated Moderate.
What to do: install the October updates, starting with internet-facing servers and domain controllers. If you manage a lot of machines, prioritise the actively exploited one first.
2. BeyondTrust Remote Support zero-day (CVE-2026-102764)
CISA added this authentication bypass to its Known Exploited Vulnerabilities catalog on October 16. It carries a CVSS score of 9.3 and affects Remote Support and Privileged Remote Access versions 24.3.1 through 26.2.3. An unauthenticated attacker can perform arbitrary file operations, which can lead to full root access.
Reports tie the exploitation to a China-nexus espionage group tracked as UNC5221 and WARP PANDA, with activity going back to late August. BeyondTrust's cloud instances were patched on October 8, but self-hosted appliances need a manual update (advisory BT26-05).
What to do: update self-hosted appliances now. Patching does not remove a webshell that is already planted, so also review logs and look for unknown files or tunnels.
3. Rank Math PRO supply chain attack
This one matters to a lot of WordPress site owners. Rank Math reported that attackers injected malware into Rank Math PRO version 3.0.123, available between October 15 (20:02 UTC) and October 16 (07:12 UTC). Rank Math pulled the files and released a clean 3.0.124.
The malicious code could give attackers persistent access, expose credentials and API keys, recreate a hidden backdoor on page visits, and even modify other plugins and themes.
What to do:
- Check whether 3.0.123 was installed and active during that window.
- If it was, treat the site as compromised. Restoring a clean backup from before the incident is the safest route.
- Look for unknown admin users, odd
.cachefiles, changes to.htaccessand new cron jobs. - Rotate all passwords and API keys, then install 3.0.124 or newer.
4. Bricksforge: a CVSS 10.0 WordPress plugin flaw
Bricksforge (CVE-2026-85097) allows unauthenticated attackers to upload a disguised PHP file through its form handling and run it on the server. Patchstack has seen automated attacks from dozens of IP addresses. Versions up to 3.1.8.9 are affected. Update to the latest release from the vendor, and check /wp-content/uploads/bricksforge/tmp/ for PHP files that should not be there.
5. A WordPress backdoor that rebuilds itself
Sucuri documented a backdoor that stores copies of itself in at least eight places, including drop-ins, theme files, the database and even shared memory on some servers. Delete one copy and the others rebuild it. It can also create a hidden administrator and inject JavaScript to skim payment details from visitors.
The lesson is that cleanup has to be complete. If you suspect an infection, work with your host, check every location, and restart the server so memory-resident copies are cleared. Sucuri also notes that wpForo versions up to 2.4.14 have an actively exploited SQL injection flaw (CVE-2026-1581), so update that plugin if you use it.
The trends behind the headlines
- Volume is exploding. A record Patch Tuesday means patch triage matters more than patching everything at once.
- Supply chain attacks are the new normal. Even a trusted premium plugin update can be poisoned for a few hours.
- Remote access tools are favourite targets. Espionage groups keep going after appliances that sit on the network edge.
- Persistence beats cleanup. Attackers now plan for you deleting a file.
A simple weekend checklist
- Install the October Windows updates and verify them.
- Update BeyondTrust if you self-host it.
- Check Rank Math PRO, Bricksforge and wpForo versions.
- Turn on automatic backups and keep one copy off the server.
- Delay plugin auto-updates by a day for critical sites, so a bad release can be caught first.
- Use a security plugin or host-level scanning and review admin users.
Staying safe does not need perfect effort. A few steady habits cover most of the risk.
Need help securing or cleaning a WordPress site? Visit expertwebdeveloper.in or growsmartwithai.com. This roundup is also on expertwebdeveloper.in, Grow Smart with AI, Medium, Substack and LinkedIn.
Sources: BleepingComputer on October Patch Tuesday · BeyondTrust CVE-2026-102764 analysis · SecurityWeek on Rank Math PRO · The Hacker News on Bricksforge · The Hacker News on the self-rebuilding backdoor
