October’s critical software vulnerabilities highlight the need for urgent patching, access controls and fraud prevention as payment businesses prepare for Black Friday.
October was Cybersecurity Awareness Month, which normally means a few familiar reminders: use stronger passwords, watch out for phishing emails and keep your software updated. Ironically, several critical incidents happened in October, providing a practical lesson in what “keep your software updated” means.
And with Black Friday approaching, that’s particularly worrying for businesses preparing for their busiest shopping days of the year.
What happened in October?
Probably the biggest incident was 2 critical flaws found in PHP—the programming language behind around 70% of websites—that could allow attackers to take over affected web servers. Fixes were released on 21 October, but Cloudflare had already spotted attempts to exploit them. Researchers used AI models to help discover weaknesses that had been hiding in PHP for years.
On the same day, a second vulnerability was found with AI assistance. Node.js disclosed a high-severity flaw in its Brotli decoder, which helps compress data. Attackers could potentially use specially crafted data to crash affected servers or run malicious code.
AI is changing the rules
AI helps developers search through large amounts of code, identify vulnerabilities and test them much faster than before. However, attackers can use the same technology to find security weaknesses and work out how to exploit them.
AI-assisted research is changing the pace of vulnerability discovery. But fixing those vulnerabilities still takes time: developers need to understand what’s wrong, work out how to fix it and make sure the update doesn’t break something else.
With security threats moving this quickly, waiting for the next monthly maintenance window can leave businesses exposed. Businesses should assess how critical each system is, how severe the vulnerability is and how easily it can be exploited, so they know what is truly critical. Based on that, build a process for applying updates according to their criticality and potential impact on your environment, with clear time frames for each level.
Why this matters if you handle payments
Every online payment involves several systems working together: the merchant’s website, the payment gateway, the acquirer, the card networks and the customer’s bank. A security weakness in one could disrupt payments, expose information or lead to fraud.
Black Friday makes things harder. Retailers spend weeks preparing, ensuring their websites can handle more visitors and their checkouts won’t fail when orders start coming in. Many also avoid making software changes during these busy days, since a poorly timed update could cause technical problems.
But what happens if a critical security flaw is discovered during that period?
Under PCI DSS requirements, critical security patches must be installed within one month of release. Yet, as October showed, attackers may try to exploit a flaw within hours. Businesses need to be prepared to make urgent security updates when necessary, even during busy periods.
What can you do before Cyber Five?
Cybersecurity doesn’t stop after Cybersecurity Awareness Month or pause for Black Friday. As businesses prepare their stock and payment systems for Cyber Five, security deserves attention too. A few practical tips for any business that handles payments:
Patch systems connected to the internet. Check which software versions your website, online shop and payment integration use. Update your VPN, firewall and email gateway too. If your hosting provider manages these systems, ask them to confirm the relevant security updates are installed. Agree in advance how you’ll handle urgent fixes during a code freeze.
Turn on MFA wherever possible. Start with your merchant dashboard, email, hosting accounts and VPN. Use an authenticator app instead of SMS codes where possible. That extra step can help stop someone from getting in with a stolen password.
Check who has administrator access. Remove accounts for former employees and contractors, shared logins, and temporary permissions that were never removed. Give people access only to the systems and information they actually need.
Check your backups. Keep at least one copy offline or separate from your main network, since ransomware attackers often try to destroy backups too. Test that you can restore your files, rather than assuming the backups work.
Double-check payment change requests. If someone asks you to change bank details or payout information, confirm it through another channel, such as calling a number you already have. AI-generated emails and voices can make fraudulent requests look and sound very convincing.
Keep reminding your team about phishing. Short, regular reminders can help employees recognise suspicious messages, especially during busy periods when it’s easier to overlook something unusual.
