Security4all

Cyber security specialist, based in APAC. My tweets are my own.

[Florian Roth ⚡️ @cyb3rops]

And as if all these critical vulnerabilities weren't enough, we've also had several reports about threat actors using AI agents to compromise systems at scale.
This is actually the part that worries me even more.

Some interesting reports from the last few days:

01) ARTEX / ConnectWise

Microsoft reports that Storm-0940 used ARTEX in a large-scale campaign targeting more than 2,250 Microsoft 365 tenants. Up to 2,900 authentication attempts per minute, with privileged cloud access achieved in under three hours in some cases.

https://t.co/vPafbvD1oG

02) ARTEX / South Korean Finance

CrowdStrike found evidence of AI-driven attacks against South Korean financial organizations, including exposed Claude Code sessions and ARTEX configurations. DeepSeek, GLM and Grok were used in the attacker's setup.

https://t.co/kOiEqSEwUi

03) Cairn / 100+ Compromised Companies

NorForge investigated exposed Cairn instances used for autonomous hacking campaigns. More than 1,100 attack projects in one cluster alone. Reuters identified over 100 companies whose websites had been compromised.

Estimated AI costs: around $5 per task, according to NorForge. That's ridiculously cheap.

https://t.co/54Ir7IeY4Q

04) Four More Agentic AI Campaigns

CrowdStrike documented four additional threat actors using AI agents for real intrusion campaigns, including attacks against healthcare organizations and government entities.

https://t.co/rte8LIYL90

What concerns me is how quickly the economics of offensive operations are changing.

Finding vulnerabilities, testing attack paths, adapting payloads, trying something else when an exploit fails, and eventually deploying a webshell. Much of this can now be delegated to agents that keep working for hours.

And with open-weight models and freely available agent harnesses, the cost of running these operations is dropping significantly.

We've been talking about AI changing offensive security for quite a while. These reports show that it's already happening in real-world intrusions.

And I'm pretty sure we're only seeing a fraction of it.

[Florian Roth ⚡️ @cyb3rops]

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:

1. Discovery with Nmap

Common and alternative web ports; HTTP headers that may expose PHP versions:

nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>

Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.

2. Huntress: Monitoring and detection

• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility

https://t.co/XLx8za50cZ

3. Vincent Schmalbach: Hardening and patching

• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise

https://t.co/30YfHmqIcR

Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.

[Dane Knecht 🦭 @dok2001]

PHP changes are live. Start patching. https://t.co/MyHFZgOZrc

Huge thanks to coordinated work by @ThePHPF!

[Cyber Security News @The_Cyber_News]

‼️ PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing

Details: https://t.co/wk2fJWlRlx

A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws, tracked by researchers as CVE-2026-109618 and CVE-2026-109619, are reported to affect PHP’s session.upload_progress feature and could lead to remote code execution under certain conditions.

The release adds technical detail to a fast-moving security issue. PHP’s security team announced that an emergency release would address two critical vulnerabilities, each rated 9.2 under CVSS v4.0, and urged users to prepare to upgrade.

#CyberSecurityNews #CybersecurityAwarenessMonth

[Florian Roth ⚡️ @cyb3rops]

PHP
Patch, take it offline, or put it behind a WAF and hope it filters the exploit requests. I wouldn’t count on a configuration-only fix unless one is confirmed.

For inventory, this Nmap command can reveal PHP versions exposed in HTTP headers:

nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>

Only scan systems you’re authorized to test. This finds advertised versions, not every PHP server, and doesn’t confirm vulnerability.

[OrcaRouter 🐳 @OrcaRouter]

🚨 PHP2Shell is extremely dangerous. And AI just changed the game.

We tasked OrcaCyber Zero 1.5 (https://t.co/HwAp9B4NHT) with investigating the critical PHP RCE vulnerabilities.

It autonomously built a complete working proof-of-concept (PoC).

Due to the severity of these vulnerabilities and their potentially massive impact across the web, we've decided NOT to publish the exploit code or technical details.

Here's what makes this particularly scary:

Your WordPress could be fully updated. Your plugins could be patched. Your website could STILL be vulnerable because the flaw is in PHP itself.

Millions of PHP-powered websites may be exposed. Not every PHP installation is necessarily exploitable, but the potential attack surface is enormous.

If you're running PHP, upgrade to a supported, security-fixed version ASAP.

[Visegrád 24 @visegrad24]

🇫🇷🇷🇺 French intelligence agencies have confirmed that Russia-linked bot networks are weaponizing the past weekend's violent riots by flooding social media with old, recycled, and AI-generated fake videos of police brutality to provoke the rioters even further.

Russian networks like "Matryoshka" are acting as digital opportunistic arsonists, intentionally exaggerating the scale of the chaos to simulate nationwide civil unrest.

[John @Big_Bad_W0lf_]

Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221).

https://t.co/v1fGotYhM8

[Silas Cutler (p1nk) @silascutler]

The Vast and Volatile Internet | 2026 Censys State of the Internet Report https://t.co/1MuME07OAL

[Cyber_OSINT @Cyber_O51NT]

Experts say a wave of cyberattacks on critical infrastructure in Japan is rising due to artificial intelligence, potentially making ransomware more effective. https://t.co/mVlPoJZSte

[Cyber_OSINT @Cyber_O51NT]

The Com ecosystem is expanding into a modular, multi-layered network where access, services, and personas drive operations across Hacker, IRL, and Extortion groups, with brand continuity, shared tools, and affiliate dynamics shaping attribution. https://t.co/DSaqjNvwEh

[NICTER 解析チーム @nicter_jp]

NICT CYNEXの脅威情報分析チームLETTICEが昨今の不正アクセス事案に関連する攻撃手法 A2B (App-to-Backend) 攻撃についてまとめたレポート（PDF）を公開しました。
https://t.co/4cucO4zRHF

[NetAskari @NetAskari]

Chinese hackers have been facilitating AI for offensive operations for a while. Frameworks like CyberStrikeAI or ARTEX. But it is not just full attack-orchestration-chains, but often it is MCP tooling like EclipseRecon. Read up on it here: https://t.co/fOiJMGR1jO

[Andrew Curran @AndrewCurran_]

Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.

[三上洋 @mikamiyoh]

ランサム集団キリンの中心メンバー、日本で拘束　アサヒにも「攻撃」(朝日新聞)
#Yahooニュース
https://t.co/SRjXyksFiH

[Byron Wan @Byron_Wan]

🚨 More than 100 academics linked to British institutions have unwittingly assisted China's espionage operations against the UK via 🇨🇳 China General Technology Research Institute (CGTRI; 中国通用技术研究院), a front company working for China’s intelligence and security services.

MI5 warns universities and academics that continuing ties with CGTRI could ultimately lead to criminal charges for aiding a foreign state.

CGTRI, sometimes translated as the China Academy of General Technology (CAGT), has "very strong ties" to the 🇨🇳 Ministry of State Security (MSS).

“MI5 has identified that the primary purpose of CGTRI is to fund academic research that directly improves MSS technical capability for espionage.”

More than 100 UK-linked academics have contributed to projects funded by 🇨🇳 MSS via CGTRI. In some cases the researches would not be aware of the front company's role in their project.

UK academics have contributed to CGTRI-funded projects on topics including AI, cyber-security, covert communications systems and steganography, which means hiding a secret message or file inside an ordinary message or object.

“This activity supports Ministry of State Security espionage, which poses a threat to UK national security.”

Many academic institutions and individuals will have engaged with the CGTRI "in good faith" because the link back to Chinese state security had been obfuscated.

UK academic institutions are strongly advised to immediately review any ongoing or planned collaboration with CGTRI. This is to ensure MSS derives no further benefit from UK universities or research institutions.

https://t.co/4JRk9Pq3JY

https://t.co/o7wczbqoxJ

[Eugenio Benincasa @eubenincasa]

Today MI5 issued its first publicly published espionage alert, warning UK universities about CGTRI (中国通用技术研究院). MI5 says it has very strong ties to China's MSS and 100+ UK-linked academics contributed to CGTRI-funded projects, incl. AI and cybersecurity.

The "One Network, Two Systems" published with @ukctransparency maps UK-China university cyber partnerships, highlighting institutions embedded in China's military and security system👇

[高市早苗 @takaichi_sanae]

近年、サイバー攻撃は急速に巧妙化・高度化しており、国家を背景とする攻撃グループによる活動も活発化しています。

こうした情勢の中、明日（10/1）、昨年の通常国会で成立した『サイバー対処能力強化法』及び『サイバー対処能力強化法整備法』の一部が施行されますので、その内容をご紹介します。

＜「官民連携の強化」について＞

『サイバー対処能力強化法』により、「官民連携の強化」の新たな枠組みとして、「サイバー協議会」が新たに設置されるほか、「資産届出」、「インシデント報告」の義務付けが新たに導入されます。

「サイバー協議会」は、関係省庁、自治体、電力・ガスなどの基幹インフラ事業者などが参画する協議体です。
協議会を通じ、国が入手した脅威情報などを含め、積極的な情報共有が可能となり、サイバー攻撃による被害の防止・軽減に官民共同で取り組むことが可能となります。

「資産届出」は、基幹インフラ事業者の皆様から、導入しているVPN装置や重要なデータを保存するサーバなどについて、「資産情報」として国に届け出ていただく制度です。
国が入手した脆弱性情報と突合することにより、脆弱性があるサーバなどを特定し、導入している事業者にピンポイントで注意喚起を行うことが可能となります。

「インシデント報告」は、重要なデータを保存するサーバなどについて、不正アクセスなどの「サイバーインシデント」が発生した場合などに、基幹インフラ事業者の皆様などから、国に報告をしていただく制度です。
国が情報の整理・分析を行い、必要な情報をタイムリーに横展開することで、他の事業者への被害拡大を抑えることが可能となるほか、脅威の未然の把握にもつなげることが期待されます。

＜「アクセス・無害化措置」について＞

「アクセス・無害化措置」は、国、基幹インフラなどに対する重大なサイバー攻撃の未然防止や被害拡大の防止を行うため、攻撃サーバなどに対して、警察、自衛隊が、ネットワークを介してアクセスした後、
・不正プログラムの消去、
・攻撃者が当該サーバにアクセスできないような設定変更
などの措置を実施するもので、『サイバー対処能力強化法整備法』で新たに導入された対処手法です。

「注意喚起」や「パブリック・アトリビューション」など、サイバー攻撃に対処するためのこれまでのオプションに、「アクセス・無害化措置」が新たに加わることで、我が国を標的とするサイバー攻撃に実効的に対処することが可能となります。

厳しさを増すサイバー脅威に対し、官だけ、民だけ、そして一国だけで対応することは困難です。
国際的に共通する課題として、相互信頼関係にある同志国・同盟国とも、従来にも増して、緊密に連携していく必要があります。

サイバー空間をめぐる脅威は常に変化し続けています。
国民の皆様の暮らしや安全、経済活動、そして我が国の国益を守るため、サイバー攻撃などの脅威に対する対処能力の向上や施策の改善に不断に取り組んでまいります。

[NetAskari @NetAskari]

"Jasmine had no technical skills and zero interview experience of any kind, yet within days of arrival she was assigned a persona, handed a two-to-three-week account-building quota, and booked in front of a client CEO." - THE WOMEN BEHIND NORTH KOREA'S IT WORKER OPERATIONS: https://t.co/tqBGTzc6Bf

[NetAskari @NetAskari]

If you want to read the full deep-dive into what is new in the now extended ZRON dataset, come over to our blog and read the full thing. I bet there will be more revelations as there are still so many little hints hidden in the work reports and inter-company messages: https://t.co/p3LnzQfsas 13/13