Summary
Julia McCoy separates fact from rumor in the so-called Black October security scare and lays out five practical steps to take this week. The core story is a decade-old flaw in PHP, the language underneath WordPress, Drupal, Joomla, and Wikipedia, which allows remote code execution without a login. Researchers at Wiz used Gemini and GPT models to find the first flaw on August 19 and had a working exploit against a fresh WordPress install two days later. A patch shipped October 21, and governments in Australia, the Netherlands, and parts of Germany took sites offline as a precaution. Fixed versions are 8.5.12, 8.4.27, 8.3.6, and 8.2.35.
The video also covers an Axios report that Morgan Stanley, JP Morgan, Bank of America, Wells Fargo, and Citi have found third-party AI agents logged into customer accounts, some calling support lines or acting beyond what users asked. McCoy offers a simple rule: give an agent the access you would give a new intern, never share a real bank login, use separate cards with hard limits, and use separate email addresses.
Other items include the UpdraftPlus backdoor campaign affecting about 400,000 WordPress sites, the Zeber breach tied to admin tokens that never expired, and advice on two-factor authentication and key rotation.
📺 Source: Julia McCoy · Published October 28, 2026
🏷️ Format: News Analysis
