AI-powered attacks hit hundreds of orgs, gaining privileged cloud access in under 3 hours
kimmonismus · x · 2026-10-22
Security researcher kimmonismus aggregates a wave of AI-driven cyberattacks he calls worse than the Hugging Face incident:
- Microsoft Threat Intelligence: China-aligned actor Storm-0940 used the agentic AI pentesting framework ARTEX to automate attacks on hundreds of organizations, reaching privileged cloud access in under 3 hours in multiple cases; the group is behind the ConnectWise supply chain compromise, with AI-accelerated reconnaissance, credential changes, and privilege escalation.
- CrowdStrike: documented four operators running successful AI-agent campaigns; one compromised at least 15 Argentine healthcare organizations.
- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits; Cloudflare's CEO reports millions of exploitation attempts.
- Platform breaches: Railway disclosed possible access to customer secrets, LiteLLM shipped a backdoored release, Zeabur confirmed a breach and is shutting down.
- Critical vulns: GitLab patched a CVSS 10.0 unauthenticated RCE (CVE-2026-110264) affecting 12 years of releases; Node.js patched a Brotli decoder RCE (CVE-2026-11149) affecting Node 22/24/26, with Vercel deploying WAF rules.
The author sees this as a turning point for AI-accelerated offensive security.
More from Safety
- AMA outlines path forward for FDA oversight of generative AI in medicine — HealthcareLdr · 2026-10-22
- Does 1Password's agentic autofill make it more attack-prone than LastPass? — JacquesThibs · 2026-10-22
- North Korea's government sites down for 24+ hours amid 'someone asked Claude to hack it' memes — djcows · 2026-10-22
- mitmproxy's new --emudhra flag for signing TLS certs becomes a security meme — kingslyj · 2026-10-22
- Eric Jang: robots need open SDKs so the community can secure them at scale — ericjang11 · 2026-10-22
- Google DeepMind researchers reportedly bound by perpetual non-disparagement clauses — zetalyrae · 2026-10-22