If you’ve seen “Black October” on your feed this week, it’s the name people gave to a pile of security disclosures that landed around Oct 19-22. Most of the coverage is aimed at big companies, but a lot of it hits the exact tools people here use for blogs, niche sites and small apps.

The good news is that most of these bugs were already patched by the time the news broke. The risk is mostly for sites and servers nobody has touched in a while (which, for a lot of passive income setups, is kind of the point).

Here’s what I’d check:

1. Your WordPress (or any PHP) site. Two critical PHP bugs (people are calling them PHP2Shell) let an attacker run code on a web server without logging in. Fixed versions came out Oct 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you’re on shared hosting you probably can’t update PHP yourself, so check the PHP version in your hosting dashboard or ask your host if they’ve patched.…