In the space of three days in October 2026, AI helped find a flaw in the language that runs most of the web, a hacking group used an AI tool to walk into Microsoft 365 accounts through an IT provider, a popular AI tool was poisoned to steal passwords, and America’s biggest banks found AI agents wandering around inside customer accounts. People in security started calling it Black October.
None of it was aimed at creative companies. All of it affects them. If you run an agency, a production company, a post house, a studio or a publisher, here is what happened and what to check this week.
What happened in Black October
A flaw in PHP, the language under most of the web
PHP is the programming language underneath almost three-quarters of the world’s websites, including every WordPress site. On October 20 and 21, two critical flaws known as PHP2Shell became public. They let an attacker take over a web server without a password, and they were found with the help of AI.
The plan was the grown-up one: fix it quietly, then announce. Instead, the security firm Calif accidentally released a video of the exploit working. It spread on social media, attackers used it to build their own versions, and the PHP team had to bring the fix forward by about a day.
Then came my favorite government advice in years. The NSA told organizations that couldn’t update straight away to take affected systems offline. Several governments did exactly that with some of their own services.
Here is the part that matters for most creative companies: WordPress automatic updates will not install this fix. The flaw is in PHP, not WordPress, so your hosting company or whoever manages your server has to update it. About a third of WordPress sites run a version of PHP that no longer gets security fixes at all.
Do you know who that person is at your company? We have a team of thirty and I had to check. If your honest answer is “I think it was Dave, he set up the website in 2019,” you already have a problem.
An AI attack tool, let in through the IT provider
The same week, Microsoft reported that a China-linked group it calls Storm-0940 used ARTEX, a free AI-driven penetration testing tool, against more than 2,250 Microsoft 365 organizations. Penetration testing is what security firms do to find weak spots before the bad guys do. This was the bad guys using the good guys’ tool.
The way in was ConnectWise, a company that sells IT management and cloud backup services. The attackers used access that customers had already granted to those services. In some cases they went from choosing a target to privileged access in under three hours.
So the door they used was the company you pay to keep you safe, through the backup app you installed in case anything went wrong. That’s like burglars getting in through the panic room.
A poisoned AI tool
LiteLLM is the switchboard many companies use to connect their apps to OpenAI, Anthropic, Google and other AI models. On October 21, attackers used stolen developer credentials to publish a poisoned version. For about two hours on the main download site, anyone who installed it got malware that stole credentials: cloud keys, AI provider keys and the passwords to the systems around it.
AI agents inside bank accounts
Then Axios reported that JPMorgan, Bank of America, Morgan Stanley, Wells Fargo and Citi are finding unauthorized AI agents inside customer accounts. Executives described some of what the agents tried to do as “horrifying”. Some were even contacting the banks’ call centers.
Somewhere in America, an AI agent dialed a bank, was told its call was very important, and waited on hold. We built a machine that can pass the bar exam, and its first independent act was to queue for customer service.
In fairness, these were mostly not hackers. They were people’s own AI assistants, logging in with passwords their owners had handed over. No money was reported stolen. But the banks can no longer tell the difference between a customer, a customer’s helpful robot and somebody pretending to be either. Jamie Dimon told analysts that customers who let outside agents into their accounts need to understand the “liability transfer” involved. In plain English: your robot, your problem.
Why this matters to creative companies
You’re not a bank. But your website probably runs on WordPress. Your client portal might run on PHP. If you’ve built anything with AI, there may be a LiteLLM box humming away somewhere holding every API key you own. And you almost certainly have an outside IT provider with the keys to your Microsoft 365.
Behind all of that sit the unreleased scripts, the rough cuts, the campaign strategy, the talent deals, your HR records and your company’s finances. That’s not just your data. That’s your company.
This is why KoobrikLabs is as much an IT and cybersecurity company as it is an AI development shop. Every time a company plugs AI into its business, it opens a door, and somebody has to decide who’s allowed through it. These systems were built by taking whatever they could reach. Now we’re handing them the keys to our email, our files and our bank accounts, and acting surprised when they wander in.
That doesn’t mean don’t use AI. I use these tools every day and build with them. It means treating them with the same care you’d give any new person you let into the building.
What to check this week
- Find out who patches your servers. Name the person or company responsible for your website’s hosting and PHP version, and confirm the PHP2Shell fix is installed. WordPress won’t do it for you.
- Review what you’ve already clicked “allow” on. List the apps and IT providers with access to Microsoft 365 or Google Workspace, including backup tools. Remove anything you don’t use. That’s how Storm-0940 got in.
- Treat an AI agent like a new hire you met yesterday. Give it its own login, never yours. Let it read before you let it act.
- Don’t keep every key in one drawer. If your team uses AI tools or a gateway like LiteLLM, keep API keys in a proper secrets store, limit what each key can do, and rotate them now if you installed LiteLLM on October 21.
- Write down who is allowed to connect AI tools to company data. A one-page AI policy is enough to start.
None of that is clever. It’s boring. That’s the point.
The bottom line
Black October was a warning shot, and a fairly polite one. Nobody woke up to a zero in their bank account. But AI is making it faster to find the holes, faster to exploit them and faster to walk through once you’re in.
The thing that hasn’t sped up is us: the patching, the checking, the deciding who gets the keys. That still happens at human speed. This month we mostly let the agents in ourselves, and the scariest thing one did was wait on hold. Next time they may not be so well behaved.
If you’re not sure where your company stands, our 2-Week Security & IT Sprint finds your biggest IT and AI risks and fixes the most urgent ones, and our managed IT service keeps the patching and access reviews from slipping. Book a free discovery call.
This article is adapted from the October 26, 2026 Week in Review episode of Technically Creative.
