Issue 004: October was hard for security, so keep yourself safe

Welcome to the October newsletter. If you work in security, or if you have some colleagues who do, you've seen them a bit stressed this month. Some security issues are showing up thanks to AI, and they could affect you as well. If you use any service, self-host something or have a WordPress blog, for example, please update it as fast as possible, since someone could be doing some nasty stuff to it.

A quick warning about the clocks. Europe moved its clocks back on October 25, but the US and Canada only do it on November 1. Until then, the time difference is one hour shorter than usual. If you have meetings with people on the other side of the Atlantic this week, double-check the time in your calendar.

So let's take a look at some cool things that you need to know.

Black October: AI found a critical hole in PHP

PHP is the programming language that runs a huge part of the web. WordPress, Drupal and Joomla are all built on it. Wiz, the security company that found the problem, estimates that around 70% of the internet uses it.

Here's what happened:

• Researchers used AI to find two critical bugs in PHP itself. Wiz Research found the first one on August 19, 2026, with help from AI models (Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol). The AI also helped turn the bugs into working attacks against WordPress, Drupal and Joomla (Wiz's write-up).
• It's as bad as it gets. Someone on the internet can run their own code on your server without logging in. Both bugs score 9.2 out of 10, and every PHP version from the last 10 years is affected by at least one of them.
• The fix shipped on October 21, 2026. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and asked everyone to "update immediately" (PHP's announcement).
• Attacks have already started. Amazon Web Services reported that the bugs are "now being broadly exploited in the wild" (Fortune).

Updating WordPressor its plugins doesn't fix this. The bug is in PHP, the engine underneath. If you use a hosting company, send them a quick email and ask if they have already updated PHP on your server. If you run your own server, update PHP today.

The part that I find most interesting is the speed. These bugs were hiding in PHP for 10 years, and AI helped find them in a few months. The good news is that the same tools work for the people fixing the bugs. That's why I keep saying that with AI you need to know more, not less. Someone has to understand what the AI found and apply the fix.

Windows 10 gets another year of free security updates

If you, or someone in your family, still uses a Windows 10 computer, here's some good news. The security updates were supposed to end on October 13, 2026, but Microsoft quietly extended them until October 12, 2027.

These updates come through a program called Extended Security Updates (ESU). You need to enroll your computer, and there are three ways to do it:

• Free, if you turn on Windows Backup to sync your settings with your Microsoft account.
• Free, if you have 1,000 Microsoft Rewards points to redeem.
• $30, as a one-time purchase.

To enroll, go to Settings > Update & Security > Windows Update and select "Enroll now". Your computer needs Windows 10 version 22H2 and the latest updates installed. Child accounts can't enroll (Microsoft's page).

A computer without security updates is an easy target. If yours can run Windows 11, use this extra year to plan the move.

Watch out for AI shopping scams before Black Friday

Black Friday is on November 27, 2026, and scammers are getting ready too. On October 15, 2026, the Canadian Centre for Cyber Security warned that scammers use AI to build fake stores, fake checkout pages and convincing emails that look like they come from real brands (MobileSyrup).

One warning stood out to me. If you use an AI assistant to help you shop, it can't tell you if a store is real. In their words, "AI tools cannot reliably determine whether a seller, website or offer is trustworthy." So use AI to compare products, but check the store yourself.

Here's how (their full guide):

• Read the address carefully. Fake stores use names that look almost the same as the real ones.
• Don't click store links in emails or text messages. Type the store's address yourself or use their app.
• Never pay with gift cards, bank transfers or crypto. Real stores don't ask for those.
• Be suspicious of huge discounts and countdown timers. Pressure to buy right now is a classic trick.

This will happen more and more, so be suspicious in all communications. The probability of being a scam is high, especially if they ask for money. We need to start getting used to it since AI is speeding things a lot.

Outlook will check your spelling before you send

Two small but useful changes are coming to Outlook:

• Spell check before sending. The new Outlook for Windows and Outlook on the web can check your spelling automatically before an email goes out. It reaches everyone between mid-November and early December 2026. You need to turn it on yourself, and it only works if your company allows Microsoft's online features, which Microsoft calls "connected experiences" (MC1479509).
• Duplicate a calendar event on your phone. In Outlook for iPhone and Android, open an event and select "Duplicate event" to create a copy without typing everything again. It should reach everyone by the end of October 2026 (MC1492166).

What happened to the October deadlines

Last month I gave you a list of things to check before October ended. Here's a quick update:

• Project Online retired on September 30, 2026. If you missed exporting your data, contact your IT team or Microsoft support right away to see what can still be recovered.
• Publisher left Microsoft 365 on October 1, 2026, and Office 2021 stopped getting security updates on October 13, 2026. If you still have Office 2021, plan your upgrade, especially with everything happening in security right now.
• People outside your company lose the email code to open your files by October 31, 2026. Microsoft planned to retire it between October 1 and October 31. If a client tells you they get "access denied" on a file you shared before, share it again. That creates the guest account they now need (MC1243549).
• Exchange Web Services (EWS) started shutting down on October 1, 2026. More on this in the technical section below.

Power Platform and other changes to look out for

• AI Builder credits end on November 1, 2026. This is the last reminder, I promise. AI Builder powers things like reading invoices or extracting text in your Power Automate flows. After that date, new premium licenses don't include AI Builder credits anymore. The credits you already have last until your contract ends, and nothing converts to Copilot Credits automatically. When the AI Builder credits run out, your flows use Copilot Credits instead. If you have neither, those actions fail. Check with whoever handles your licenses (Microsoft's page).
• Microsoft Ignite runs from November 17 to 20, 2026. Ignite is Microsoft's big yearly conference, and it's where Microsoft usually announces a lot of new features for Power Automate, SharePoint and Microsoft 365 Copilot. It's in San Francisco, but you can watch online. I'll tell you what matters in the next issue.

For your IT team (technical)

This part is technical. Skip it if it's not your area, or forward it to whoever manages Microsoft 365 and the Power Platform in your company.

• October's Patch Tuesday broke a record. Patch Tuesday is the second Tuesday of each month, when Microsoft releases its security fixes. On October 13, 2026, it fixed 1,411 vulnerabilities, the most ever in a single month. One of them, CVE-2026-96951 in Windows Shell, is already being used by attackers, so deploy that one first (BleepingComputer). If you run SharePoint Server or Exchange Server on your own servers, there are fixes for both as well (Dark Reading).
• The PHP fix, in more detail. The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older don't get official fixes anymore, so ask your Linux distribution or vendor whether they have a patched version. Updating is the only complete fix. On October 23, PHP also suggested setting session.upload_progress.enabled=0 until the next regular release, to close a smaller related issue (CVE-2026-115560). One more date: PHP 8.2 stops getting security fixes on December 31, 2026, so plan that upgrade too (PHP's announcements).
• Targeted release enrollment freezes in November 2026. Targeted release is the setting that gives some users new Microsoft 365 features before everyone else. From November, you can't add or remove people from it, and it retires completely in January 2027. Frontier, Standard release and Deferred release replace it. If you use Targeted release for a pilot group, Microsoft recommends switching to Deferred release and adding your pilot users to Standard release. That keeps the same "pilot first" setup. This applies to Teams, SharePoint, OneDrive, Outlook on the web, the new Outlook for Windows and Office for the web (Microsoft's guide).
• EWS is being turned off in phases. Since October 1, 2026, Microsoft blocks Exchange Web Services in Exchange Online for companies that haven't configured it. You can allow specific apps for now, but EWS stops for everyone on April 1, 2027. If a script or app suddenly can't read a mailbox, this is the first thing to check. The replacement is Microsoft Graph (MC1227454).

Some updates to the site

The site continues to get some updates, some of them invisible to you, but things that, hopefully would be great for all of us.

I'm preparing some changes to the site, focused on getting more stuff to you, the reader, and protecting against bots. The account system is live, so give it a shot, and if you have any issues or suggestions, please let me know.

More to come next month, hopefully.

Random Stuff

• The age signal law comes into effect soon. Starting January 1, 2027, California's Digital Age Assurance Act requires operating systems to tell apps the age range of the user. Microsoft already added this to Windows 11, but it doesn't return any information yet (TechRepublic). If you build apps, keep an eye on it.
• The Introvert Travel Agency. The holidays are coming, and Sweden has a travel agency just for introverts. It only sells one destination, and you can guess which. Answer a few questions about how introverted you are, and they'll find your ideal getaway.

Save the date: M365 Con 27

If you want to learn something new at the start of the year, M365 Con 27 runs from January 11 to 22, 2027. It's a free, global, 10-day virtual community event covering everything from Copilot to Azure AI. There's a day for each topic, including Power Platform, Copilot Studio, Power BI and security.

Free registration is open at m365con.net.

See you all in November!

Photo by Yuka Tanaka on Unsplash