What GPs and LPs Should Do About This Month's AI Attacks

On October 21, the PHP Foundation shipped emergency fixes for flaws in software behind roughly 70% of websites, and U.S. agencies told organizations to patch or take their servers offline. The same day, Microsoft disclosed that a China-aligned group had used AI agents to break into ConnectWise's cloud backup service and then try to sign in to more than 2,250 organizations' Microsoft 365 environments. This month, attackers also stole keys and credentials from four AI platforms. Security professionals are calling it "Black October."

While these attacks didn't center on any private markets firms, most of them run on the impacted technology: a website on PHP, an outsourced IT provider, Microsoft 365, emailed wire instructions and a growing set of AI tools. Private markets investors need to adjust to the greater speed of cybersecurity patching driven by AI. AI helped find the PHP flaws, AI agents ran the ConnectWise intrusion, and CrowdStrike says likely agent-driven intrusions doubled every month from July to September. As the Five Eyes cyber agencies warned in June, "the timeline is not years, it is months." Here is what GPs and LPs should check this week, and who should own each item.

For Fund Managers

1. Check whether the firm's website runs PHP and is patched. Owner: Head of Marketing, with the CTO.

• Many firms' websites are WordPress sites run by an outside agency. Security researchers at Wiz showed that the PHP flaws let attackers take over WordPress, Drupal and Joomla sites without logging in and read server memory that can hold passwords and API keys. Even a marketing site with nothing sensitive on it can expose credentials the firm uses elsewhere.
• Ask the agency in writing whether the site is patched for CVE-2026-109618 and CVE-2026-109619 (fixed versions are in PHP's advisory), and whether it has applied PHP's interim setting for a third, lower-risk flaw that affects even patched versions. If the site runs PHP 8.1 or older, CISA's advice is to take it offline.
• Once patched, have the agency change database and admin passwords and any API keys the site or its plugins store.

2. Find out whether ConnectWise had access to the firm's Microsoft 365. Owner: CIO or CTO (COO if IT is outsourced).

• Many firms outsource IT, and the provider may back up Microsoft 365 with ConnectWise Cloud Backup, formerly SkyKick. ConnectWise warns that a provider checking its own environment hasn't checked the firm's.
• Get written confirmation that the firm's Microsoft 365 tenant was checked for all seven application IDs in ConnectWise's guide, including Cloud Management. Match on IDs, since older installations show SkyKick names, and include dormant connections.
• ConnectWise shut off Cloud Backup on October 17, so firms that use it haven't had a backup since. On October 23 it said the archives show "no indication of compromise" and restores should start this week, with full service to follow in phases. Keep the connections disabled until ConnectWise says to reconnect, and ask the provider what covers the gap.

3. Save Microsoft 365 records before they expire and run the published checks. Owner: CIO or CTO (COO if IT is outsourced).

• On Microsoft 365 Business Premium, E3 and E5 licenses, Entra keeps sign-in and directory audit records for 30 days. ConnectWise's review starts October 13, so those records begin expiring around November 12. Unless the IT provider already keeps them longer, export them now, because a license upgrade later "does not recover expired history."
• Then run the checks Microsoft and ConnectWise published for activity since October 13: new credentials on apps or service principals, new privileged roles and consent grants, and unusual mail or file access. In the cases Microsoft investigated, attackers gave an app Global Administrator rights and read stored secrets in bulk.
• Disable affected apps, but don't delete them. Both companies say to preserve the app configuration as evidence. ConnectWise's own shutdown doesn't disable the apps in the firm's tenant, and tokens already issued "may remain usable."

4. Rotate keys and credentials exposed in this month's AI platform breaches. Owner: Chief AI Officer, Head of Data or CTO.

• Attackers took stored keys from Fireworks AI, OpenCode and Railway, and slipped credential-stealing malware into a LiteLLM release. At OpenCode, stolen keys ran up charges on users' accounts overnight. Ask whether the firm's data or engineering team, or any outside developer who built its tools, used any of them.
• If they did, rotate everything stored there: AI provider keys, database passwords and cloud credentials. Railway told customers to check for unusual activity in AWS, Google Cloud, GitHub, Stripe, OpenAI and Anthropic. LiteLLM says anyone who installed version 1.107.0 should treat that machine's credentials as stolen and pin 1.106.2.
• In each AI provider's admin console, check who created each key and when it was last used. Revoke unused keys and set spend limits.

5. Keep AI agents away from staff logins to fund bank accounts. Owner: CFO, with the Chief AI Officer or CTO.

• Reuters reported on October 22 that U.S. banks and brokerages are blocking third-party AI agents from customer accounts, and that transactions made with credentials a customer shared "cannot be deemed unauthorized." To the bank, an agent using your login is you.
• At a fund, that breaks dual approval. An agent running on an approver's login turns two approvals into one, and bank treasury terms, such as Bank of America's, may leave the client liable when its own controls fail.
• Block bank and treasury sites for AI agents. An agent usually gets a staff login by running in a browser signed in to the bank. Claude Team and Enterprise admins can blocklist sites in Claude in Chrome, ChatGPT Enterprise keeps agent mode off by default and can limit it by role, and managed browser settings can block unapproved AI extensions.
• If an agent needs bank data, give it its own read-only access, which is where most banks are heading.

6. Check that your wire call-backs and bank controls hold up against deepfakes. Owner: CFO, with the Head of Fund Operations.

• The SEC's exam priorities, published October 23, name deepfake voice and video as threats examiners will ask about. Most firms already call back before changing wire instructions, as the FBI has recommended since 2015, but a familiar voice or face no longer proves who is calling.
• The call only counts if the firm places it, to a number already on file. An inbound call, a number from the request or a recognized voice proves nothing now, and neither does a video call. For capital calls, distributions, deal closings and vendor payments, hold any changed account until the call is logged with who called, which number and who confirmed.
• The strongest controls don't depend on recognizing anyone. Require a second approver for new or changed wire beneficiaries, turn on real-time alerts for outgoing wires, and confirm who owns any new account before the first wire. J.P. Morgan's validation service, for one, checks the holder's name.

7. Ask the fund administrator, investor portal and data room provider three questions. Owner: COO, with the Head of Fund Operations.

• These providers hold your investors' records, the funds' documents and often the wire details for capital calls and distributions. Provider breaches already reach investors: files stolen from one outside law firm exposed fund investors' Social Security and passport numbers.
• The three questions: Are your client-facing portals patched for the October 21 PHP flaws? Do you or your IT providers use ConnectWise Cloud Backup or Cloud Management? Did any of your teams use Fireworks AI, OpenCode, LiteLLM or Railway, and have those keys and credentials been rotated?
• Ask in writing about anything their client updates don't cover. If they say "not affected," ask what they checked.

8. Treat the SEC's new exam priorities as this year's checklist. Owner: Chief Compliance Officer, with the COO.

• The SEC's exam priorities for its 2027 fiscal year, which began October 1, aren't new rules, but they show where examiners are looking. For private fund advisers that includes "third parties to access clients' accounts, where existing controls may be insufficient," and for all firms, third-party providers and how firms prepare for and use AI.
• List every third party that can reach client or fund accounts, including any AI agent, and the control on each. Add AI-driven attacks and the firm's AI use to this year's compliance review, with a written policy and a named owner. Where Regulation S-ID applies, add AI risks and stolen credentials to its red flags.
• Amended Regulation S-P requires firms to have service providers report a breach within 72 hours. If the IT provider or administrator was hit by the ConnectWise campaign, ask whether that notice came and whether the contract requires it.

9. Check what the firm's insurance would pay for this month's risks. Owner: General Counsel or CFO, with the firm's broker.

• Wire fraud usually falls under the crime policy or fidelity bond, not the cyber policy, often as a social engineering sublimit. Ask the broker whether it covers the firm's largest wires and the funds' money, not just the management company's. Many endorsements require a documented call-back, making that log a condition of coverage.
• If a provider goes down, as ConnectWise's backup service did, any loss depends on contingent business interruption cover. Ask whether the policy has it, whether the IT provider and fund administrator count as covered providers, and what waiting period and sublimit apply.

10. Ensure portfolio companies have made the same fixes. Owner: Operating Partners or the Head of Value Creation.

• Kroll found 80% of PE firms have had cyberattacks cause disruption at a portfolio company during the hold period. Get written confirmation this week that each company has patched internet-facing PHP, checked for ConnectWise Cloud Backup or Cloud Management, and rotated keys and credentials exposed in this month's AI platform breaches.
• From next quarter, add patch speed to the monitoring request: how long it takes to patch a system that faces the internet. EY argues even a 24-hour window for critical patches is now "too slow." That is oversight through channels the firm already uses, not running the companies' IT.

For Limited Partners

Most of the checks above apply to institutional investor operations, as well: the website, the IT provider, Microsoft 365 and any AI keys. What's different is exposure through managers, in the form of wire payments, the data they have about investors and the security they maintain around their own technology systems.

1. Verify capital calls against one record, not each email. Owner: Head of Investment Operations or Treasury.

• Luxembourg's financial intelligence unit found that 60% of its suspicious-activity reports on fraud in the investment sector involved fake capital call notices, averaging €1.5 million per report, and 70% used lookalike email addresses. With dozens of managers calling capital, checking each notice from scratch doesn't scale.
• Keep one record of each manager's wire instructions, confirmed through a known contact, and share it with any custodian that sends payments for you. Treat any difference as a stop until a call-back you place clears it.

2. Find out whether a manager or administrator lost your data. Owner: Head of Operational Due Diligence, with General Counsel.

• Managers and administrators hold your banking, tax and identity records. A breach disclosed in early 2025 at one large growth investor reached "banking and tax information" for more than 12,000 people, including LPs, according to Thomas Murray.
• Ask each manager whether PHP2Shell or the ConnectWise campaign touched systems holding your data, and check what your LPA and side letters require them to tell you, and when.

3. Ask how your document aggregator gets into managers' portals. Owner: Head of Investment Operations.

• Services such as Bloomberg's Canoe collect capital call notices, distribution notices and statements for LPs, and Canoe says it connects to more than 3,000 GP portals. One third party can hold your access at every manager.
• Ask whose credentials it uses at each portal, where they are stored, and whether any of its systems were exposed this month.

4. Look at your managers' security from the outside. Owner: Head of Operational Due Diligence.

• In September, Thomas Murray, which sells these assessments to LPs, scored 558 private equity firms from public data alone and found 29% below "good," including a manager with more than $150 billion in assets. It concluded that managers' cybersecurity "is not yet routinely assessed by LPs."
• "A single exposed, unpatched vulnerability" moved its scores more than anything else, and a server still on unpatched PHP is often visible from the outside. A score like this isn't an audit, but you don't need a questionnaire to get it.

5. Add five questions to your due diligence on managers. Owner: Head of Operational Due Diligence

• ILPA's due diligence questionnaire, the industry standard, already covers cyber policy, testing and third-party data, and ILPA plans to review it on a more regular cadence. Until then, investors can ask additional questions to cover important topics like AI tools and agents, patch speed, IT provider access and wire fraud.
• Five questions to ask now are: Were you exposed to the PHP flaws or the ConnectWise campaign? How many hours do you need to patch internet-facing systems? Which outside software and AI tools can reach your systems? Who controls the credentials your AI tools and agents use? How quickly would you tell us? Push back on any answer that could have been written last year.

6. Check how your own team uses AI on managers' documents. Owner: Head of Technology or Data, with General Counsel

• LPAs and their confidentiality clauses "were drafted in a pre-AI environment," as Hogan Lovells put it in a piece on AI in secondaries. Putting GP reports into AI tools raises a confidentiality question as well as a security one.
• If staff do, or the team has built tools on platforms like LiteLLM or Railway, confirm the tools are approved, any stored keys and credentials have been rotated, and the use fits the confidentiality terms you signed.

The wrong lesson

The wrong lesson from this month is to pull back from AI. The PHP flaws were found by researchers using AI, and the SEC's new priorities examine how firms oversee AI, with nothing in them telling firms to stop. This month's risks came from how firms run their tools, AI included: unpatched websites, trusted apps with too much access, keys left on developer platforms and agents working on someone else's login.

None of the fixes means waiting for new technology. Each one comes down to three questions: what can reach the firm's systems and money, who controls each key and login, and how fast a known gap gets closed. Attackers are already using AI to find those answers first. Firms that put the same tools to work, with their own credentials and clear owners, can answer them in a day rather than a quarter.