October 2026: the security updates small businesses should make now
What was attacked in October 2026 and what a small business should update: Synology NAS, PHP websites, Windows, Plex, Magento and backup software.
October was a busy month for attackers. A crypto exchange paused withdrawals, owners of Synology storage boxes found their files locked by ransomware, and the US cyber agency CISA added 34 flaws to its list of bugs it has confirmed are being used in real attacks.
Most of those 34 affect gear that only bigger companies run. Below are the five on that list most likely to matter to a small business, plus two late-October incidents: Synology NAS ransomware and the Binance withdrawal pause. Each entry below says who it affects, what can happen and what to do.
The seven that matter to a small business
1. Synology NAS (the storage box in the office) Who: anyone with a Synology NAS, especially one you can reach from outside the office. What happens: attackers break into older DSM versions and encrypt your files, which end in .L0CK3D, then ask for a ransom. Synology says the attacks use a flaw it fixed in December 2024. What to do: update DSM to the latest version and turn on automatic updates. Close outside access (port forwarding, UPnP and QuickConnect) until you're sure it's patched.
2. PHP websites (most WordPress sites) Who: websites built on PHP, which includes most WordPress sites and most budget web hosting. What happens: two flaws, nicknamed PHP2Shell, let an attacker run commands on the server without logging in. CISA confirmed attacks on 26 October. What to do: ask your web host or developer to confirm PHP has been updated. Synology owners should update PHP, Mail Station and Synology Calendar in Package Center. PHP 7.3 won't get a fix, so move to a newer PHP version.
3. Windows computers Who: every business running Windows. What happens: a flaw in Windows Shell lets an attacker get around a security protection over the network. CISA confirmed attacks on 13 October. What to do: run Windows Update, install everything and restart.
4. Plex Media Server Who: anyone running Plex on a NAS or a spare computer. What happens: four flaws can be chained together so the server is pushed into reaching other addresses and writing files that then run. What to do: update Plex and keep it off the open internet.
5. Adobe Commerce and Magento online shops Who: businesses selling through a Magento store. What happens: an attacker can upload a dangerous file and run it, which can mean control of the store or the server. What to do: ask your developer to apply Adobe's fix now.
6. Ahsay backup software (AhsayCBS) Who: businesses using a backup service built on Ahsay. What happens: two flaws chained together let an attacker skip the login and run system commands, which puts your backups within reach. What to do: ask your backup provider whether they've updated, and keep the admin page off the internet until they have.
7. Binance (crypto exchange) Who: anyone holding crypto on Binance. What happens: Binance paused withdrawals on several networks after a security incident. It hasn't said how it happened or how much was taken. What to do: turn on 2FA, follow only Binance's official announcements, and don't click any "compensation" or "refund" link. Scammers move fast after news like this.
If your IT is outsourced
The rest of October's list is mostly firewalls, VPNs and server software: Fortinet, Palo Alto Networks, Cisco, Ivanti, Citrix NetScaler, BeyondTrust, VMware ESX, the Linux kernel, GitLab and Atlassian. If someone manages these for you, send them one line: "Have we checked CISA's October additions?"
Five habits that protect you next month too
- Turn on automatic updates for computers, phones, NAS and website plugins.
- Use 2FA (an authenticator app or passkey) on email, your domain, banking and social accounts, and keep the backup codes.
- Keep one backup offline: unplug the external drive once the backup finishes.
- Don't open admin pages to the internet. Use a VPN if you need access from outside.
- If an email says a supplier's bank details have changed, call them on the number you already have.
Check your own domain in a minute
Our free security self-check looks at your domain's public email settings (SPF, DMARC, DKIM) and whether common admin addresses are exposed. It runs in your browser, and we don't receive what you type.
Questions we get asked
What is the CISA Known Exploited Vulnerabilities list?
It's a public list kept by the US Cybersecurity and Infrastructure Security Agency of software flaws it has confirmed attackers are using. It's a useful "patch these first" list for any business, wherever you are.
I've been hit by ransomware. Who do I call in Australia?
Call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) or report it at cyber.gov.au. Unplug the affected device from the network first, and don't restart it or delete anything.
Should I pay the ransom?
Talk to the hotline before you do anything. Paying doesn't guarantee you'll get your files back.
Does changing a port number keep my NAS safe?
Not really. It stops some automated scans, but anyone searching on purpose will still find it. Keep admin pages off the internet instead.
How do I know if my website runs PHP?
If it's built on WordPress, it does. For anything else, ask your web host or developer.
Rather not chase updates every month?
Most of this list is fixed by one habit: someone checking that updates were installed. If you'd like help setting that up for your website and email, get in touch.
Sources (fetched 2026-10-30): CISA Known Exploited Vulnerabilities catalogue (version 2026.10.29); CISA alerts of 13, 14, 20, 26 and 27 October 2026; Synology statement of 29 October 2026 and advisories SA-24:20 and SA-26:14; TechCrunch, 29 October 2026; cyber.gov.au.
