Technology
Some professionals call October's AI-linked attacks and PHP flaws 'Black October'
Fox News reports that Microsoft linked an AI-powered testing tool to a China-aligned group as federal agencies warned of PHP2Shell flaws.
The short version
- Microsoft said on Oct. 21 that China-state-aligned group Storm-0940 used the AI-powered ARTEX penetration testing framework.[Fox News]
- Between Oct. 10 and 14, Microsoft recorded more than 151,000 failed login attempts targeting 327 accounts at eight organizations.[Fox News]
- OpenCode disclosed an Oct. 17 incident that may have exposed some users' third-party AI provider keys, and reportedly advised customers to revoke credentials.[Fox News]
- PHP2Shell flaws drew emergency patches on Oct. 21 and a CISA exploited-vulnerability listing on Oct. 26, but assessments of how widely they are exploited differ.[Fox News]
Key facts
- Microsoft Threat Intelligence said on Oct. 21 that China-state-aligned group Storm-0940 used the ARTEX AI-powered penetration testing framework.[Fox News]
- Microsoft recorded more than 151,000 failed login attempts from Oct. 10 to 14 in one campaign targeting 327 accounts across eight organizations.[Fox News]
- OpenCode disclosed on Oct. 17 a security incident involving its Console service that may have exposed third-party AI provider keys for some users.[Fox News]
- Developers released emergency fixes on Oct. 21 for two critical PHP vulnerabilities collectively known as PHP2Shell.[Fox News]
- The FBI issued a public alert on Oct. 23 urging organizations to patch affected systems immediately.[Fox News]
- CISA added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 26.[Fox News]
What remains uncertain
- The Netherlands' National Cyber Security Centre said on Oct. 23 that exploiting the PHP2Shell flaws appears more complicated than initially feared and lowered its assessment of widespread exploitation.[Fox News]
- CrowdStrike reported seeing attempted PHP2Shell attacks but said it had not observed successful exploitation in its investigations at that point.[Fox News]
- Security researcher Adel Karimi documented successful PHP2Shell exploitation against honeypot test servers on Oct. 24; the reporting does not establish how far exploitation extends beyond such systems.[Fox News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.