In This Article
- What "Black October" means for credit unions
- The PHP flaws CISA says to patch now
- Attacks that run at machine speed
- Move staff sign-in to passkeys and phishing-resistant MFA
- Know what you expose to the internet
- Plan for the vendor that gets hit
- The NCUA 72-hour clock
- A plan for the next seven days
- How ABT helps credit unions harden Microsoft 365
- Frequently Asked Questions
By October 29, 2026, the month already had a name. That day, Keith Schostag, head of compliance at America's Credit Unions, wrote that "Black October" describes "a series of cybersecurity crises that arose in October, mostly due to AI actors." In three weeks, the federal government urged immediate patching of the programming language behind a huge share of the web, a credit union in Michigan took its website and digital banking offline as a precaution, and an attacker running an open-source AI hacking agent broke into financial organizations in South Korea.
The common thread is time. CISA issued its PHP alert on October 21 and added both flaws to its list of actively exploited vulnerabilities on October 26, and the South Korean campaign used an AI tool to run its intrusions. A monthly patch meeting is too slow for either. The good news for a credit union is that the defenses that matter most this month are concrete and mostly in hand already: patch what faces the internet, make staff sign-in resistant to phishing, know which vendors hold member data, and know the reporting clock before you need it.
ABT, a Tier-1 Microsoft Cloud Solution Provider serving 750+ financial institutions, manages the Microsoft 365 tenants of credit unions, banks, and mortgage companies. This guide walks through what happened in October, what each event means for a credit union, and a seven-day plan your IT team and leadership can work through together.
What "Black October" means for credit unions
"Black October" is an informal label, used by America's Credit Unions and others in the industry, for a cluster of October 2026 incidents that America's Credit Unions says arose mostly due to AI actors. Three of them matter most to a credit union.
An unknown actor used ARTEX, an open-source agentic penetration testing tool, against South Korean financial organizations from late September into early October, and data was exfiltrated.
Two critical PHP flaws allow remote code execution without a login. CISA tells organizations to patch internet-facing systems first, or take them offline.
The Michigan credit union pauses its website, online and mobile banking to apply security updates, and restores online and mobile banking the next afternoon, with other features following in phases.
CISA adds both vulnerabilities to its Known Exploited Vulnerabilities Catalog.
Its compliance blog lays out what credit unions should do: patch, adopt passkeys, audit internet exposure, and plan for vendor breaches.
The America's Credit Unions post is worth reading in full. Its recommendations map to four jobs for this week, and the rest of this guide takes them one at a time.
The PHP flaws CISA says to patch now
PHP is the programming language underneath a large share of websites, content management systems and web applications, including many credit union public sites, member portals and vendor tools. On October 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an alert on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. They let an attacker run code on a server that serves web requests through PHP, with no login required.
CISA's guidance is direct:
- Inventory every system that runs PHP, including PHP embedded inside other software.
- Patch right away to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, internet-facing systems first.
- Take PHP-based systems offline until they are patched if you cannot update right away, or if they run PHP 8.1 or earlier.
- Use a web application firewall for interim protection, and watch for PHP worker processes launching shells or downloading tools.
On October 26, CISA added both flaws to its Known Exploited Vulnerabilities Catalog, the list it reserves for vulnerabilities attackers are already using.
MSU Federal Credit Union showed what a precautionary response looks like. On Wednesday, October 21, it took its website, online and mobile banking, and its ComputerLine service offline. A spokesperson tied the decision to a warning from the FBI's cyber division, and the credit union told WILX News 10 the actions were taken "intentionally to ensure we can implement all recommended security updates, patches and protections before restoring service." Online and mobile banking came back the next afternoon, with more features restored in phases, and the credit union said it had no indication that members' personal information had been compromised.
A precautionary, announced outage of about a day costs some member goodwill. A compromised member portal costs far more. The decision only works, though, when someone at the credit union can answer one question within hours: which of our internet-facing systems need an update, and who patches each one?
Attacks that run at machine speed
The second thread of Black October is the attacker's toolkit. On October 7, CrowdStrike published research on a campaign that used ARTEX, a recently released open-source agentic penetration testing tool, against South Korean financial organizations. An agentic tool chains the steps of an intrusion on its own: find an exposed system, test it, exploit it, move on. According to the industry reports CrowdStrike cites, at one bank the attacker breached a loan progress inquiry service used by financial brokers. At another, the target was an employee mobile work-support system. CrowdStrike says the campaign resulted in exfiltrated data.
Look at what was hit: a portal for outside brokers and a system staff use on their phones. Those are exactly the edges a credit union runs too, in the form of indirect lending portals, member-facing sites and staff email on mobile devices. An automated tool can probe each of them repeatedly, at any hour. The defenses that hold up against that are the ones that make the attacker's first step fail: a patched server, and a sign-in that a stolen password alone cannot complete.
Move staff sign-in to passkeys and phishing-resistant MFA
America's Credit Unions recommends passkeys, and for staff accounts in Microsoft 365 that is a setting your team controls today. Microsoft Entra ID supports passkeys (FIDO2): device-bound passkeys in Microsoft Authenticator or on a FIDO2 security key, and synced passkeys. A passkey is bound to the real sign-in site, so a look-alike phishing page has nothing to capture and replay.
Turning passkeys on is the first half. The second half is requiring them. Conditional Access in Entra ID offers a built-in "Phishing-resistant MFA strength", applied through the "Require authentication strength" grant control. Start with the accounts that can do the most damage: administrators, then staff with access to member data and wire or ACH systems.
Microsoft ships three built-in authentication strengths in Conditional Access: multifactor authentication, passwordless MFA, and phishing-resistant MFA. Only the third limits sign-in to methods that require an interaction between the authentication method and the sign-in surface, such as a FIDO2 security key or passkey, Windows Hello for Business, or certificate-based authentication. A text message code meets the standard MFA strength and falls short of the phishing-resistant one. Before you raise the bar for a group, count who in that group already has a passkey or security key registered, so nobody is locked out on Monday morning.
A practical rollout for a credit union with a small IT team looks like this:
Turn on passkeys (FIDO2) in the Entra ID authentication methods policy, scoped first to a pilot group.
Give every admin a passkey in Microsoft Authenticator or a FIDO2 security key, and keep emergency access accounts documented and protected.
Create a Conditional Access policy for admin roles with the built-in phishing-resistant strength, in report-only mode first, then switch it on once every admin has signed in with a passkey and your emergency access accounts are excluded.
Move staff who handle member data, wires and ACH next, once their passkeys are registered.
For credit unions that license Microsoft 365 through ABT, this work starts from the M365 Guardian Foundation baseline, which already covers Entra ID Conditional Access and MFA. The phishing-resistant policy for admins becomes the next step on a tenant ABT already manages, and ABT can help plan the passkey pilot before you require it.
Our guides to phishing-resistant MFA for financial institutions and Entra passkeys and the retirement of text and voice MFA cover the rollout in more depth.
Members are a separate decision. Member sign-in runs through your online banking platform, so offering members MFA or passkeys is a conversation with that provider. America's Credit Unions adds one caution worth passing to compliance: where passkeys use biometrics, review state biometric privacy laws, such as Illinois's, before launch.
See where staff sign-in stands in your Microsoft 365 tenant
A free, read-only review of your Microsoft 365 tenant covers MFA coverage, legacy sign-in methods, admin hygiene and Conditional Access gaps, delivered as a written report.
Know what you expose to the internet
The hardest question in the php2shell response is the first one: where does PHP run? The answer usually spans three places, each with a different owner.
| Where PHP may run | Who patches it | What to ask for |
|---|---|---|
| Public website and blog | Your web host or marketing agency | The PHP version, the patch date, and confirmation in writing |
| Member portals, loan application sites, indirect lending portals | The platform vendor | Whether the product uses PHP, and if so its patch status |
| Servers and appliances you run yourself | Your IT team or IT provider | An inventory of every PHP install, including PHP embedded in other software |
For devices you manage, Microsoft already gives you part of the inventory. The software inventory in Microsoft Defender Vulnerability Management lists the software installed across devices onboarded to Microsoft Defender, refreshed every three to four hours. A server running PHP shows up there once it is onboarded. Websites a vendor hosts live in the vendor's environment, so for those the written answer from the vendor is your record. Our guide to Defender Vulnerability Management for financial institutions explains how to read that inventory.
The alert lands, and the team spends two days finding out which sites run PHP, emailing vendors one at a time, and guessing at the public website.
The alert lands, and the team already has a list of internet-facing systems, their owners and contacts. Patches are requested within the hour and confirmed by the end of the day.
Plan for the vendor that gets hit
America's Credit Unions puts it plainly: plan for vendors being hacked. Credit unions rely on core processors, digital banking platforms, credit union service organizations (CUSOs), card processors and cloud providers, and an attacker who reaches one of them can reach many credit unions at once. Black October's PHP flaws exposed any vendor running an unpatched PHP site.
Three questions to send each critical vendor this week:
- Does any system that stores, processes or displays our member data run PHP, and has it been patched against CVE-2026-109618 and CVE-2026-109619?
- Who on your team will notify us of a security incident, how, and how fast?
- If your service is disrupted, what is the fallback for our members, and how long can it run?
Keep the answers in the vendor file. They are evidence of oversight for your examiner, and they are the contact list you will want at 2 a.m. Our vendor due diligence guide and our look at vendor risk after the Marquis breach go further.
The NCUA 72-hour clock
The last job is the one to settle before anything happens. Since 2023, federally insured credit unions have had to report certain cyber incidents to the National Credit Union Administration (NCUA), and the clock is short.
The rule itself sets out when the clock starts and how notice reaches NCUA.
Each federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe. The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident or, if reporting pursuant to paragraph (c)(1)(i)(C) of this section, within 72 hours of being notified by a third-party, whichever is sooner.
NCUA defines a reportable cyber incident as a substantial cyber incident that leads to one or more of three outcomes, and two of them are worth checking against any incident this month. The first is a disruption of business operations, vital member services or a member information system resulting from a cyberattack or the exploitation of a vulnerability. The second is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, the compromise of a CUSO, cloud service provider or other third-party data hosting provider. In that second case, the 72 hours can start when the vendor tells you.
Whether a given event is reportable is your credit union's call, made with counsel. The work to do now is making that call fast: name who decides, who files, and how the NCUA contact is reached, and put it in the incident response plan. Our guide to cyber incident notification deadlines compares the NCUA rule with the bank regulators' 36-hour rule.
A plan for the next seven days
Here is the whole response on one page, split between the people who own each piece.
| Day | Task | Owner |
|---|---|---|
| 1 | List every internet-facing system and who hosts it | IT |
| 1 | Patch or take offline any PHP system you run yourself, starting with internet-facing ones | IT |
| 1 to 2 | Get written PHP patch status from your web host and platform vendors | IT and vendor management |
| 3 | Register passkeys for every administrator | Each administrator, guided by IT or by ABT for tenants it manages |
| 4 | Turn on a Conditional Access policy requiring phishing-resistant MFA for admins in report-only mode, then enforce it once every admin has a working passkey | IT, or ABT for tenants it manages |
| 5 | Send the three vendor questions to every critical vendor | Vendor management |
| 6 | Confirm who decides, files and calls NCUA under the 72-hour rule | Compliance and leadership |
| 7 | Brief staff on phishing and brief the board on the response | Leadership |
For the board briefing, our guide to credit union board IT reporting shows how to present it, and the Microsoft 365 security checklist for credit unions carries the longer list once this week is done.
How ABT helps credit unions harden Microsoft 365
Staff sign-in is the Black October job that lives entirely in Microsoft 365: who can sign in, with what, and from which devices. That is the part ABT manages. When a credit union licenses Microsoft 365 through ABT, M365 Guardian Foundation is included at no additional charge: a hardened tenant baseline covering Entra ID Conditional Access, MFA, Intune device compliance, data loss prevention and Defender for Office 365 configuration. The paid plans build from there. Guardian Contain adds round-the-clock detection and automated containment. Guardian Respond adds ABT security engineers on covered incidents during business hours and a written incident timeline suitable for an examiner or an insurer, the record you want in hand when your team and counsel weigh the NCUA 72-hour question. Guardian Resolve adds human response at any hour.
The starting point is free. ABT's Security Assessment is a read-only review of your Microsoft 365 tenant that covers MFA coverage, Conditional Access, legacy authentication, admin hygiene, device compliance and more, delivered as a written report. Most are complete within two weeks.
Turn this week's list into a standing posture
Two ways to get started
See where you stand
A read-only review of MFA coverage, Conditional Access, legacy sign-in methods and device compliance in your Microsoft 365 tenant, with a written report.
Request the assessmentTalk it through
Walk through passkeys, phishing-resistant MFA and your incident plan with an ABT engineer.
Talk to an expertFrequently Asked Questions
Black October is an informal name America's Credit Unions used on October 29, 2026 for a series of cybersecurity crises that arose in October 2026, mostly due to AI actors. It covers the php2shell PHP vulnerabilities, an AI-driven campaign against South Korean financial organizations, and other hacking campaigns that month.
php2shell is the name for CVE-2026-109618 and CVE-2026-109619, two PHP flaws that allow remote code execution without a login. Any website or application you or a vendor run on unpatched PHP is exposed. Ask your web host and vendors for their patch status, and patch any PHP system you run yourself.
It can. Under 12 CFR 748.1(c), a substantial cyber incident that disrupts business operations or gives someone unauthorized access to sensitive data through the compromise of a CUSO, cloud provider or other third-party host is reportable. NCUA must hear as soon as possible, and no later than 72 hours after the vendor's notice or your own reasonable belief, whichever is sooner. Decide reportability with counsel.
Phishing-resistant MFA is sign-in with a method bound to the real site, such as a passkey in Microsoft Authenticator or a FIDO2 security key. In Microsoft Entra ID, Conditional Access enforces it with the built-in phishing-resistant MFA strength through the require authentication strength grant control.
America's Credit Unions recommends offering members MFA or passkeys. Member sign-in runs through your online banking platform, so start with that provider's options. Where passkeys use biometrics, have compliance review state biometric privacy laws, such as Illinois's, before launch.
ABT manages Microsoft 365 tenants for credit unions. M365 Guardian Foundation, included when you license Microsoft 365 through ABT, hardens Conditional Access, MFA and device compliance. ABT's free, read-only Security Assessment shows where your staff sign-in and device settings stand today, in a written report.
