# IT Daily Roundup: October 13, 2026

> Oct 13, 2026 · #security #wordpress #windows #microsoft #ai

Bricksforge plugin (CVSS 10.0) actively exploited since October 7, Windows 11 23H2 Enterprise losing patches in November, and employee AI assistants accessing corporate accounts without IT oversight.

## 1. WordPress Plugin Bricksforge: Patch Now, Active Exploitation Since October 7

The Bricksforge plugin for the Bricks WordPress page builder contains CVE-2026-85097, rated CVSS 10.0. Through the `/wp-json/bricksforge/v1/form_submit` endpoint, an unauthenticated attacker can upload a PHP file disguised as an image and execute arbitrary code on the server. Patchstack has tracked active exploitation since October 7, 2026.

The fix is in version 3.1.8.10, and the current release is 4.0.1. If your site runs an older version, check the `/wp-content/uploads/bricksforge/tmp/` directory for unexpected PHP files and review the admin user list for unfamiliar accounts.

> **Why this matters:** Any company running a WordPress site carries direct responsibility for patching it. Your site serves content to clients, so a compromised site exposes not only you but the people visiting it. Updating through the WordPress admin takes minutes. We would not delay this.

## 2. Windows 11 23H2 Enterprise and Education Editions Lose Patches at End of November

Microsoft announced on October 12, 2026, that Windows 11 23H2 in the Enterprise, Education, and IoT Enterprise editions will receive its final security patch in November 2026. After that update, no more. Home and Pro editions of 23H2 already lost support in November 2025.

Upgrading to Windows 11 26H2, available since September 2026, is free through Windows Update. Devices with "get the latest updates as soon as they're available" enabled will receive it automatically. Other devices need a manual check under Settings.

> **Why this matters:** You have 30 days. Auditing Windows versions across your network shows which machines are still on 23H2. Without upgrading, those devices stop receiving security fixes and every new vulnerability found in them stays open.

## 3. Employee AI Assistants Are Logged Into Corporate Accounts Without IT Knowing

Staff install personal AI assistants on their own devices, and these tools connect to corporate accounts through OAuth grants or saved passwords. Muse for Mac can request Full Disk Access and reads emails, calendars, and files. The Dia browser accesses open tabs and connected Slack. GrokBot can sign in anywhere a browser works by using a virtual computer.

From an IT administrator's view, these tools are invisible until someone audits OAuth grants and sign-in logs.

> **Why this matters:** Personal AI agents are another form of shadow IT, one that arrived faster than policy could keep up with. Audit third-party OAuth access in Google Workspace or Microsoft 365, set up alerts for new consent grants, and let employees know what tools are approved and what are not. A list of approved tools works better than a blanket ban people will route around anyway.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-13-it-daily-roundup.html