Cybersecurity Awareness Month is almost over.
Attackers don’t care what month it is anyway. Here’s our short look at what happened this month, why it matters if you take or process payments, and a few things worth doing this week.
What happened in October
Critical vulnerabilities always take priority, and October was hit hard by them. Most were in internet-facing systems, and most already had a patch. Newest first:
| Date | What | In short |
| Oct 21 | PHP (“PHP2Shell”) | Critical. Attackers can take over web servers without logging in. PHP runs about 70% of websites. Already exploited in the wild. |
| Oct 24 | Python | Critical. Python could trust fake HTTPS certificates. |
| Oct 21 | Node.js | High. A bug that lets attackers run code on servers. |
| Oct 20 | SafePay Ransomware | 600+ victims. Gets in through leaked passwords and VPNs, then goes after backups. |
| Oct 1–14 | Email gateways (Cisco, Fortinet) | Already exploited. |
If you see a pattern here, you’re right. Attackers keep going for things that face the internet (VPNs, firewalls, mail gateways, web servers) and for weak or reused passwords.
The biggest bug of the month was found by AI. PHP2Shell was discovered by researchers at Calif using OpenAI’s GPT-5.6 Sol model and Google’s Gemini 4 Argon, PHP vulnerability wasn’t the only one. The Node.js bug in the table was also uncovered with AI help. That’s good news and bad news. Defenders found it first this time. But the same tools help attackers too: once a patch is public, AI can work backward from it to a working exploit fast. PHP2Shell was being broadly exploited soon after disclosure. The gap between “patch released” and “you’re being attacked” is now hours, not weeks.
Expect more of this: AI is turning up old bugs in software everyone uses, much faster than before. That means one practical change: patching can’t wait for the monthly maintenance window anymore. When a critical fix comes out for something your website or payment integration runs on, plan to install ASAP.
Why this matters if you handle payments
Every payment passes through a chain of parties: the merchant, the payment provider, banks and card schemes. The chain is only as secure as its weakest link. A compromised website, admin panel or mailbox at any point can lead to fraudulent transactions, changed bank details, exposed card data and lost customer trust.
So if you’re anywhere in the payment chain, it’s worth reviewing the vulnerabilities above and checking whether any affect your environment. Applying available security updates promptly remains one of the most effective ways to reduce risk.
What to do this week
Idea behind cybersecurity awareness month is simple – consistency is key.
This year’s awareness campaigns come down to four habits: strong unique passwords, multi-factor authentication, spotting phishing and keeping software updated. Here’s how that looks in practice for a business taking payments:
✅ Patch what faces the internet. Check which PHP, Node.js and Python versions your website, online shop and payment integration run on, and update your VPN, firewall and mail gateway. If a hosting provider manages your servers, ask them to confirm the October updates are applied.
✅ Turn on MFA everywhere it exists. Start with your merchant dashboard, email, hosting control panel and VPN. Use an authenticator app instead of SMS codes where possible. Leaked passwords were a top way in for this month’s ransomware attacks.
✅ Check who has admin access. Remove accounts of former employees and contractors, shared logins and “temporary” access that became permanent. Admin rights should stay with the people who actually need them.
✅ Look at your backups. Keep at least one copy offline or separate from your main network, since ransomware groups go after backups first. Test restoring one, not just creating it.
✅ Double-check payment change requests. If someone asks by email, chat or phone to change bank details or payout info, verify it through a different channel, for example by calling a number you already have rather than one from the message. AI-generated emails and voices make these requests look very real.
✅ Remind your team about phishing regularly. Short, periodic reminders help employees stay alert, since most phishing succeeds through human error, and people get better at spotting it with practice.
You don’t need to do all of it by Friday. Pick two to start with, and remember that security is daily work, not a one-time task.
Prepared by PAYSTRAX Information Security Manager Akvilė Venskavičiūtė and the Information Security team
