AI Weekly for IT Pros: October 17–23, 2026

This week the most important AI story for IT teams was not a model launch but a patch: PHP2Shell, two critical unauthenticated remote code execution flaws in PHP that researchers found and weaponised with help from AI models, and which attackers began probing within hours of disclosure. Around it, the signals all point the same way — AI is speeding up both attack and defence, and frontier models are becoming just another line item on your existing cloud bill.

AI in Microsoft & Azure

Storm-0940 used AI agents against 2,250+ Microsoft 365 tenants. Microsoft disclosed on October 21 that the China-linked group abused compromised ConnectWise application credentials and the open-source ARTEX framework to automate reconnaissance and credential attacks, sometimes reaching privileged cloud access in under three hours. Review consented enterprise applications and service principals in Entra ID, especially those belonging to MSP and backup tools.
Foundry fine-tuning expands. Microsoft Foundry Managed Fine-Tuning added four open-source models plus MAI-Code-1.1-Flash, and introduced shared multi-LoRA deployments in public preview — relevant if you are paying for several separately hosted fine-tuned variants.
New open-weight models in Foundry. This week’s Model Mondays roundup added Meta Muse Spark Open, NVIDIA Nemotron 3.5 Super VL and Reflection Beam to the Foundry catalogue, aimed at coding and agentic workloads.
Copilot updates to put on the change calendar. Microsoft introduced Copilot Code, a coding experience inside Microsoft Copilot, expanded plugins and role-based skills in Copilot Cowork, and a Microsoft 365 Insights Agent for reviewing agent feedback in Copilot Chat with admin-controlled sharing. Check the Message Center for rollout timing and licensing before users ask.

Tools for admins and developers

GitHub Copilot model policies are now scriptable. A new REST API (GET and PATCH) manages which models are allowed at enterprise, enterprise-team, agent-app and organisation level, so model allow-lists can live in infrastructure-as-code instead of the web UI.
Copilot model retirements on October 19. GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, Gemini 3.7 Flash and Grok 4.5 were deprecated; GitHub notes admins may need to enable replacement models (such as GPT-6.1 Sol and GPT-6 Luna) in their model policies.
Copilot usage metrics now name MCP servers and custom agents. The usage metrics API reports configured names of custom skills, agents, MCP servers, slash commands and plugins instead of lumping them into “other” — useful for finding which MCP servers are actually in use across your organisation.
Claude API version 2026-10-21 brings breaking SDK changes. New Anthropic SDKs and the ant CLI 2.0.0 send the new API version by default and switch from the MIT to the Apache 2.0 licence; pin SDK versions and test before upgrading in CI. Claude Code also added a Linux sandbox option and a hook setting that can block on failure.
DeepSeek open-sources its inference stack. DeepInfer, the serving framework behind V4.1-Flash, is now Apache 2.0 on GitHub with support for NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs — another option for teams self-hosting open-weight models.

AI security and compliance

Malicious MCP servers could run code during sign-in in OpenCode. Pillar Security found that OpenCode 1.0.137–1.18.32 on Windows and WSL passed an MCP server-supplied OAuth URL into an unescaped PowerShell command. It is fixed in 1.18.33 but has no CVE, so scanners will not flag it — check developer machines manually and remove unvetted remote MCP servers.
AI agent permissions are outrunning controls. A survey of 1,100 IT and security decision-makers reported by Help Net Security found 70% let AI take actions that previously needed human approval, but only 49% can audit every agent action. The practical takeaway: enforce allow-lists of systems and actions outside the agent, and give every production agent a named owner.
Treat AI-assisted vulnerability discovery as the new baseline. PHP2Shell and the Storm-0940 campaign both show AI compressing the gap between disclosure and exploitation. Revisit how quickly you can identify every instance of a component (an accurate software inventory or SBOM) — that is now the bottleneck, not the patch itself.

Try this week

Quickly check a Linux web server for PHP2Shell exposure. Remember that the CLI may use a different binary and php.ini than PHP-FPM or mod_php, so verify the version your web server actually runs (for example with a temporary, access-restricted phpinfo page) and remove it afterwards.

# PHP version of the CLI binary
php -v

# Settings used by the temporary mitigations (CLI config shown)
php -i | grep -E '^(memory_limit|post_max_size|upload_max_filesize|session.upload_progress.enabled) '

# Distros often backport fixes without changing the version number:
# Debian/Ubuntu (adjust the package name to your PHP version)
apt changelog php8.3-fpm 2>/dev/null | grep -E 'CVE-2026-10961[89]'
# RHEL/Alma/Rocky
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'

No CVE match and a version below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35? Patch first. Mitigations such as session.upload_progress.enabled=0 only reduce exposure and must be set in php.ini or the FPM pool, followed by a restart of all workers.

Sources

Questions about using AI in your IT environment? Get in touch.

Share this content:

AI Weekly for IT Pros: October 17–23, 2026