IT & AI brief, 27 October 2026: PHP flaws hit KEV, Canada time zones, AI Builder credits

The most urgent update is that CISA's 26 October alert now adds the two critical PHP flaws to its Known Exploited Vulnerabilities catalog, so unpatched PHP servers should be treated as a priority. Two Microsoft deadlines also arrive on 1 November: Canadian time zone changes and the end of seeded AI Builder credits.

CISA adds the PHP flaws to its exploited list

What changed: CISA's 26 October alert lists CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale request state) in the Known Exploited Vulnerabilities catalog. Both were fixed in the PHP releases of 21 October, covered in the previous brief. The new part is that CISA now flags them as exploited. The alert gives no due date.

Who is affected: Anything that serves web requests through PHP, including appliances and bundled web apps that carry their own PHP build.

What to do: If you have not yet installed 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's equivalent), do it today and restart all workers. Treat internet-facing servers that stayed unpatched since 21 October as possibly compromised and review their logs. Source: CISA alert.

Canada time zone changes take effect on 1 November

What changed: MC1526468, an update to MC1510951, says British Columbia, Alberta and Manitoba stop moving clocks back on 1 November 2026 and stay on UTC-07:00, UTC-06:00 and UTC-05:00. The Northwest Territories follow Alberta and Northwestern Ontario follows Manitoba. An Exchange Online PowerShell cmdlet to fix non-recurring meetings is targeted for 28 October.

Who is affected: Users and devices in those regions. Outlook, Exchange Online calendars and Teams Rooms on Windows are confirmed as affected. Teams clients, Bookings, Shifts, SharePoint and OneDrive are still under validation.

What to do: Install the October Windows updates on devices in the affected regions, and ask users to select the new time zone in Outlook. Existing events do not migrate on their own, so run the Exchange cmdlet once released and test recurring meetings. Update Edge and WebView2 on Teams Rooms. For calendar scripting, see /blog/calendar-permissions-exchange-online-powershell and /blog/exchange-online-powershell-app-only-certificate.

AI Builder credits are replaced by Copilot Credits

What changed: MC1526652 says that on 1 November 2026 AI Builder capacity add-ons reach end of life, and new or renewed Power Platform and Dynamics 365 licences stop including seeded AI Builder credits. Credits from earlier purchases last until their contract ends. AI Builder features themselves are not retired. Usage draws on AI Builder credits first, then Copilot Credits, and runs are blocked if neither is available.

Who is affected: Organisations running AI Builder in Power Apps and Power Automate, such as document processing flows.

What to do: Find the expiry dates of add-ons and licences, turn off add-on auto-renewal if needed, and check consumption in the Power Platform admin center. Credits do not convert at a fixed ratio, so size Copilot Credits from the capability rate table before the old entitlements run out. Background: /blog/ai-builder-document-processing-credit-costs.

Teams will warn about malicious QR codes

What changed: MC1526651 (26 October) says Teams will check where QR codes in inline images point and warn users when a code is malicious, in chats, meeting chats and channels, for internal and external messages. External QR images are already blurred by default. Rollout starts early November and should finish by mid-November 2026.

Who is affected: All Teams messaging users. The post lists no licence requirement.

What to do: No action is required. The feature follows the Malicious URL protection setting, which is on by default; confirm it under Teams admin center, Settings and policies, Messaging Safety. Brief the help desk so a new warning does not cause confusion. Related: /blog/teams-app-agent-permission-policies.

GitHub Copilot: assisted permissions and GPT-6.1 Terra

What changed: On 26 October GitHub made assisted permissions generally available in Copilot CLI, the Copilot app and VS Code. A model reviews requests to run commands, reach file paths or open URLs, lets clearly safe ones proceed, and holds the rest for approval. The same day GPT-6.1 Terra became generally available in Copilot, billed at provider list price under usage-based billing.

Who is affected: Copilot Business and Enterprise admins, plus developers using agentic features.

What to do: In enterprise-managed settings, decide whether to block Allow All, keep or disable Assisted, and set the default permission mode. If new models turn on by default in your model policy, review whether you want Terra enabled. Sources: assisted permissions, GPT-6.1 Terra.

Also worth knowing

• Cloud Update for Microsoft 365 Apps gets richer device exports from early November, including a Cloud Update Status column: MC1526661.
• Microsoft has published a Power Platform notice on the same Canadian time zone changes: MC1526712.
• The updated October 2026 Scan Cab for Windows is available: MC1525374.