Cyber Security News

Hacking Editorial Brief — October 23, 2026

PHP2Shell Exploitation Escalates to Millions of Attempts, Pre-Disclosure Activity Confirmed

Exploitation of the PHP2Shell vulnerabilities has surged to millions of attempts within 48 hours of public disclosure, with Cloudflare reporting attacks escalating from thousands before the announcement to millions afterward. Amazon Threat Intelligence revealed that exploitation attempts began at least four days before the October 21 public disclosure, with initial activity detected on October 17, indicating threat actors obtained exploit information through pre-disclosure channels. Despite the massive volume of exploitation attempts targeting the flaws in PHP—which powers 70% of websites globally—security researchers report minimal evidence of widespread successful compromises or damage, suggesting defensive measures and rapid patching efforts have been largely effective. Governments and organizations worldwide continue emergency patching operations as the attack surface remains significant.

China-Linked Storm-0940 Used ARTEX AI Framework in ConnectWise Supply Chain Attack

Microsoft formally attributed the ConnectWise supply chain compromise to Storm-0940, a China-state aligned threat group that leveraged ARTEX AI agents to conduct automated reconnaissance and exploitation at scale. The operation reached over 2,250 customer tenants with attack attempts occurring at rates exceeding 2,900 sign-in attempts per minute, demonstrating AI-enhanced operational tempo. The attribution confirms earlier reporting of AI-assisted techniques but provides specific details on the threat actor and tooling. Separately, Arista Networks disclosed active exploitation of a zero-day SQL injection vulnerability (no CVE assigned) in VeloCloud Orchestrator that allows attackers to escalate from read-only customer accounts to full operator privileges. Unit 42 researchers also reported that ransomware operators Spikey Scorpius and Tarnished Scorpius are actively exploiting the previously disclosed PAN-OS authentication bypass vulnerability CVE-2026-0257 in targeted campaigns.

Sources: NPR · ABC · Security Affairs · The Hacker News · CyberScoop · The Hacker News · Unit 42