Microsoft: China-linked Storm-0940 used agentic AI framework ARTEX to attack hundreds of orgs
testingcatalog · x · 2026-10-22
testingcatalog's daily AI brief (Oct 22) leads with security news: PHP 8.5.12/8.4.27/8.3.36/8.2.35 patch two critical unauthenticated RCE flaws dubbed php2shell (CVE-2026-109618/109619), uncovered with help from OpenAI's Patch the Planet initiative, which now ships a Codex skill to scan affected sites. Microsoft Threat Intelligence reports China state-aligned actor Storm-0940 used the agentic AI pentesting framework ARTEX to automate attacks on hundreds of organizations worldwide. Cloudflare warns that private keys for eight trusted eMudhra intermediate certificates were compromised, enabling forgery of certificates for any domain, plus a NetScaler command-execution flaw (CVE-2026-88771). Node.js shipped security releases for 22.x/24.x/26.x. The quoted Oct 21 brief adds OpenAI's acquisition of Orchestra Bio, ChatGPT Locked Chats rollout, and 12-hour API prompt caching.
More from Companies & People
- Ex-Tesla Optimus lead Remi Cadene is hiring for large-scale robot AI training roles — RemiCadene · 2026-10-22
- Founders slam Anthropic for mediocre startup support vs OpenAI, Google — vaibhavbetter · 2026-10-22
- Security researcher accuses Wiz of buying php2shell domain to steal research credit — SatelliteNetSec · 2026-10-22
- op7418 on Wang Ziru's iPhone 18 Pro review: still entertaining, never boring — op7418 · 2026-10-22
- Moonshot AI's 17-year-old Kimi K3 co-author joins Jeff Dean's Discovery Loop — VectorWireAI · 2026-10-22
- Barclays cuts 5,000 jobs in AI-led efficiency drive — DanielLockyer · 2026-10-22