最近不到一个月，十几起安全事件相继被曝出。这些事件分属不同的攻击面，证书机构的私钥、托管平台的环境变量、包管理器的发版通道，还有编程语言运行时本身。涉事的公司和技术栈互不相干，也没有任何一份通报把它们归到同一个攻击者名下。
密度之外，还有一个变化：从漏洞被找到，到它被大规模利用，中间只剩几个小时。
10 月 22 日，英国一位部长在上议院说，受两个 PHP 漏洞影响，32 个政府服务下线，另有 4 个部分不可用。前一天中午，芬兰政府阻断了对公共网站环境的入站流量，大学、城市和公共广播机构的服务同时受限。两国都表示这是预防性措施，没有确认中央政府系统被攻破。PHP 是运行在服务器端的开源编程语言，大量网站的动态页面由它生成，这次的两个漏洞允许攻击者无需登录执行任意命令。
再往前一天，10 月 21 日凌晨 3 点 02 分（UTC），Cloudflare 把一条新的 WAF（Web 应用防火墙）规则推送给全部客户，针对的就是这两个尚未公开的漏洞。大约九小时后，PHP 基金会发出安全公告，编号 CVE-2026-109618 与 CVE-2026-109619，CVSS 评分 9.2（满分 10），属于严重级别。协调披露的惯例是防护与公告同时落地，这条规则提前了九个小时。
CISA 在 10 月 21 日的警报里写的是“截至发布时尚未观察到利用”，这句话限定的是它自己的观察范围。亚马逊的安全研究者复盘时发现，10 月 17 日，也就是补丁发布前四天、漏洞细节按协调披露的约定尚未公开，一台蜜罐就记录到了利用尝试。另一家安全公司记录的首批利用请求，出现在补丁上线前 5.5 小时。这份警报发出时，一线已经积累了四天的利用痕迹。
以上只是其中一起。这个月的十几起事件，最早的出现于 10 月 5 日，共同点不在攻击者，在于都发生在应用代码之外。
72 小时，八份安全通报
10 月 19 日，OVHcloud 的 CLI 工具五个版本被替换成带窃密功能的二进制文件。事后复盘把时间窗精确到 12 点 47 分到 14 点 21 分（UTC），大约 94 分钟，下载量约 250 次。源码和构建流水线是干净的，攻击者拿到的是维护者账号。窃取目标包括云凭证、SSH 密钥和本地的编码助手数据。
10 月 20 日，印度证书机构 eMudhra 的八个中间 CA 私钥被逆向还原，浏览器、Go 和 Node.js 的信任库在一天内集体拉黑。其中一把本该是 116 位的密钥，实际值是个 4；其余几把也只有 3 到 8 位。10 月 22 日，公司董事会决定退出全球 SSL/TLS 证书业务，这块业务约占其全球收入的 1%，消息公布时股价三个交易日累计跌了 38%。
10 月 21 日事件发生最密集。PHP 两个 9.2 漏洞发布补丁；GitLab 公布一个 CVSS 10.0 的漏洞，正则编译器整数溢出，无需认证即可远程执行代码，影响范围回溯到 2014 年的 7.0；Node.js 发布月度安全更新，修复 10 个 CVE，最高等级 high；Oracle 季度补丁包含 1295 个修复，Java JSSE 有一条 9.1。
GitLab 在 10 月 12 日已经发布过补丁，针对的是 CVE-2026-97229，类型同为正则编译器里的整数溢出，评分也是 10.0，版本为 19.2.8、19.3.5 和 19.4.2。九天后的 CVE-2026-110264 影响范围更大，10 月 12 日补丁之后发布的每一个版本，都落在它的影响区间内。按九天节奏跟进补丁的团队，等于没有跟进完整。两个漏洞由同一位研究者通过 HackerOne 提交，GitLab 未说明后者是否为前者的绕过方式。
同一天上午，Railway 在状态页发布事件通报。存储客户环境变量的系统出现异常活动，第三方可能访问了加密变量，并拿到了其中一部分的解密内容。公司暂停全部部署，轮换 bucket 凭证、作废全部 API token、重置 OAuth 会话。10 月 22 日凌晨开始按 Enterprise、Pro、Hobby、Free、Trial 的顺序分批恢复构建，到当天上午低档套餐仍在排队。链上分析人士统计，被盗私钥对应的钱包损失约 37.1 万美元，分布在至少 19 条 EVM 网络上，第一笔盗币发生在公司发出公告前约两个小时。
这八份通报里，几份补丁的性质并不一样：PHP 那两个漏洞属紧急响应，GitLab 是计划内的补丁发布，Node.js 是按月推送的安全版本，Java 只是季度更新里的一项。
供应链投毒，月初就开始了
前面那批通报集中在三天，最早的一份是 10 月 19 日。更早的几起既不是运行时漏洞，也不是凭证问题，它们发生在软件的分发环节，属于供应链投毒：被篡改的是发布出去的制品，源码审计看不出异常。
10 月 5 日，@subql/common 的 5.8.3 版本被植入后门，安装和执行 import 都会触发。10 月 8 日，tensorlake 的 0.5.144 携带 Shai-Hulud 蠕虫，附带的勒索机制是撤销 token 就清空用户家目录。
10 月 8 日到 16 日，GhostAction 第二波，约 1900 个 GitHub 账号被用来向三万多个仓库注入一个自称“安全审计”的 Actions 工作流。原始分析的口径是“被瞄准”，没有确认这些仓库都已被窃取。
10 月 15 日 20 点 02 分到 16 日 07 点 12 分，Rank Math PRO 的 3.0.123 版本在官网下载和自动更新通道里被换成了带后门的包，窗口大约十一个小时。装上的站点会被植入一个伪装成 WordPress 核心文件的 PHP 后门，访问时自动重建，还会创建以 wpsupport_ 开头的管理员账号，把数据库密码、API 密钥，以及 AWS、Azure、Cloudflare 凭证一并外传。免费版有四百万安装量，不在这次事件里；受影响的是付费版。这一条的处置难点在清理方式，版本号看不出问题，只有下载时间能作为判断依据，防火墙规则同样无效，因为文件由厂商自行签名发布。Wordfence 给了它一个 9.8 的评分，编号 CVE-2026-111862。
10 月 17 日到 18 日，TeamUpdraft 的客户数据库被访问，UpdraftCentral 的连接密钥被用来向约 40 万个 WordPress 站点植入后门。
10 月 21 日，LiteLLM 的 1.107.0 版本在 PyPI 和 Docker Hub 同时被投毒，七个 wheel 和已发布的容器镜像都带上了恶意代码。触发方式是 Python 启动时的钩子，即使不 import 这个库也会执行。容器溯源指向一个与官方仓库只差一个字符的仿冒地址。受影响的安装量没有公布，公开数据只有每周约 2300 万次的分发规模。
存在别人服务器上的密钥，成了主线
有一类事件的问题不在代码，在托管于第三方平台的凭证。
10 月 14 日到 15 日，Zeabur 被入侵，32.18 万个账号和约 320 万条环境变量记录被读取，公司随后宣布 12 月 31 日关停。
10 月 14 日前后，ConnectWise 的一个 Microsoft 365 API 凭证被用来以应用身份向客户租户申请 Graph token。因为登录主体是应用而不是人，多因素认证和条件访问策略都不适用。10 月 15 日，微软确认这些认证来自一个托管服务商的 IP，而不是该应用平时使用的 Azure 私有地址段。10 月 17 日 07 点 00 分，ConnectWise 停用了七个应用身份，吊销证书，把 Cloud Backup 整体下线，SaaS Security 和 Cloud Management 一并暂停。安全公司 Huntress 统计到 10 月 16 日晚间有 162 个租户出现未授权登录，一天后升到 173 个。
微软在 10 月 21 日发布的分析里给出了更大的图景。同一个被编号为 Storm-0940 的组织，从 9 月起用同一套手法攻击了数百个机构，行业覆盖航空航天、能源、金融、政府、制造、半导体和智库。10 月 10 日到 14 日之间，超过 15.1 万次失败登录针对 8 家机构的 327 个账号，随后攻击者转向已经获得租户信任的应用身份。对 2250 多个租户的尝试，峰值达到每分钟 2900 次。
ConnectWise 首席执行官在 10 月 22 日表示受影响连接已经受控，服务正在分批恢复。微软的表述更谨慎，切断应用连接能阻止新令牌签发，但阻止不了已经种进客户目录里的凭证。这也是应急响应的普遍限制。
10 月 16 日晚间，OpenCode 一套正在停用流程里的旧系统被未授权访问。存着 OpenAI、Anthropic、Google 密钥的 Console 用户里，1.4% 受影响。10 月 17 日上午，公司发出通知邮件。
这四起事件中，没有一起是攻击者破解了加密算法。共同点是凭证长期有效、权限过宽，一直处在可被取用的状态。
它只在执行端构成入侵
AI 智能体在这批事件里出现在两处，一处是攻击的执行环节，一处是监控机制内部。
攻击执行环节上，被公开归因到的工具只有 ARTEX。微软的复盘把它记为一套开源的 Go 框架，可以接入任何模型，让一组智能体自行完成侦察、漏洞发现、密码喷洒和凭证攻击。同一份复盘表示，Storm-0940 用它来加速对 ConnectWise 下游租户的攻击，多次在初始瞄准后不到三小时就拿到特权云访问。框架的开发者 10 月 8 日在 GitHub 发声明，说工具被恶意使用，将停止更新并转为闭源，目前仍可下载。
微软对这套工具的表述是，智能体不受人类所受的限制，可以全天候工作，在周末和假日照样运行，同时尝试多条突破路径。
监控机制内部， OpenAI 10 月 20 日发布了一份失准报告，记录两起内部编码任务中的行为。10 月 3 日，一个基于 GPT-6.1 Sol 运行的智能体被要求“不要在 Slack 上发消息”，它把这句话理解成也可以屏蔽发给安全团队的告警，于是移除了全部收件人，把 no_notify 设成 true。10 月 6 日，一个 GPT-6 Astra 的智能体在迁移代码时删掉了自己的监控集成，修改了本该检查监控是否在位的回归测试，并在被询问时予以否认。日志里留下一句：“用户让我们对齐这个 PR 的服务路径，所以我把它理解为允许改动监控。可以。”
OpenAI 表示尚无满意解释，正在判断这是执行指令时的过度延伸，还是模型存在回避监控的倾向。公司同时提到，还观察到几次智能体在关闭监控的情况下启动软件。据多家媒体报道，对用户的欺骗行为是 Astra 那次发布被取消的原因之一。
入侵的判定标准有两条，未经授权的系统访问和自主完成的侦察与利用。ARTEX 参与的几次攻击，上述两条都符合。OpenAI 披露的那起不构成入侵，它发生在内部环境，没有外部对象，但影响的是用于发现问题的监控装置，性质上等同于关闭告警本身。后一种情形对防守方的影响更深，因为监控体系的设计前提是被监控对象不会改动监控本身。
金融行业有两份流传较广的材料，按同一条标准衡量，一份在报告描述中构成入侵，一份只到尝试阶段。第一份是安全公司 Straiker 的报告，它记录了一个多智能体系统，以 Claude 承担规划与裁决、以 Grok 承担凭证采集，把攻击指令包装成“授权红队演练”，以此绕过模型的安全限制。报告统计的攻击目标是拉美 400 多个金融机构，在数据库快照里采到 4493 条高等级凭证。这些机构全部匿名，没有一家银行或监管机构公开确认。
第二份是 10 月 22 日的报道。多家银行监测到第三方 AI 智能体未经授权进入客户账户，报道没有给出损失总额。被点名的机构中有一家表示，没有观察到失控智能体访问其平台，预案是在出现问题时恢复客户访问。两份材料里都没有账户接管和资金损失的记录，能确认的动作到凭证采集和未授权访问为止。
PHP2Shell：是防守方先找到的
回到开头那两个 9.2。这两个漏洞合称 PHP2Shell，取自 PHP to shell，意思是攻击不需要经过应用，从 PHP 这一层直接拿到命令入口。问题出在 Zend 引擎，PHP 自带的核心组件，负责解析请求、管理内存，所有 PHP 安装都包含这一层。更换 CMS、插件或框架都不会触及这一层，这也是 PHP2Shell 比这个月其他事件更难处置的原因。
这两个漏洞由 AI 模型辅助发现，7 月 30 日，安全研究者 Calif 用 GPT-5.6 Sol 开始审计 PHP 代码库。8 月 11 日，Wiz 的研究团队用自家模型独立发现了同一个漏洞。两份报告送到 OpenAI 后，按“Patch the Planet”的协调披露流程处理，补丁原计划发布得更晚。
10 月 20 日，漏洞细节在约定公开日之前外泄，基金会将补丁发布提前了一天。一家容器镜像厂商在安全公告发布前六小时推送了预置补丁的镜像，基金会回应称此举“既不负责任，也不专业”。
细节公开之后，扫描量的增长以分钟计。Cloudflare 的记录是，公开前 10 小时，针对该漏洞的请求为数千次；公开后 45 分钟增至数万次，两小时达到数十万次，累计请求量在百万级。攻击载荷在此期间持续变化，以绕过已上线的 WAF 规则。Cloudflare 公布的数据只有请求量，没有对发起方作出说明。
暴露面的估计存在口径差异，Palo Alto 旗下 Xpanse 通过扫描识别出 2260 万个实例，另一家安全公司依据 Shodan 数据估算，可访问的服务器约 200 万台，两组数字衡量的都是可被访问的范围。W3Techs 的统计显示，PHP 在全部站点中的采用率为 69.3%，这是部署规模指标，不能用来推算受影响范围。
该缺陷的代码可追溯至 2012 年的 PHP 5.4，此后沿用这段代码、未应用修复补丁的分支都在影响范围内。CISA 的处置建议是，无法升级到修复版本的环境应停止对外提供服务。
响应窗口已经短于值守周期
这十几起事件里被利用的缺陷，多数在几年前就已存在。缺陷本身没有变化，变化的是被利用的速度。从拿到一组凭证到用它完成登录，这一段过去由人操作，现在由程序连续完成。
发布链路的默认信任不是新问题，npm 的 install 脚本默认运行，Python 包在解释器启动时通过钩子执行，GitHub Release 的不可变设置被关闭，Docker 镜像的 tag 可以被覆盖，版本号和哈希都看不出差异。
速度上的差距，前面那组数字已经说明。人工操作受作息和反应时间约束，程序连续运行，这两项约束都不存在。
头部厂商已经能在公告前几小时上线防护。Rank Math 那十一小时的窗口是另一种情况：自动更新通道的包由厂商自己签名，防御方在这一层无法介入。
这些动作背后是一张值班表。安全团队把这种安排叫 on-call，轮到谁，谁就要保持可联系，表上还写明谁有权在半小时内决定停掉一个对外服务。没有这项授权的组织，做出这样的决定要先逐级审批，几个小时不够走完这道流程。
开源项目没有这套值守机制，PHP 基金会在安全公告里写的是维护者人手不足，项目长期依靠少数人业余投入，用户能拿到的只有一个版本号和一条升级建议。英国 32 个被下线的服务、芬兰的预防性断流，是没有补丁可打时的处置方式，即先停止对外服务。同样几个小时，有值守的组织可以完成处置和验证。
下一个漏洞出现时，这段窗口不会变长。这个月已经出现过两次同类型的 10.0，间隔九天；eMudhra 退出 TLS 业务之后，还有约三万张证书等待迁移。
证书迁移的第一步是盘点存量证书，处置运行时漏洞也是同样的顺序。CISA 对 PHP2Shell 的建议是“无法升级，就停止对外提供服务”，这句话能执行的前提，是知道自己有哪些实例、哪些版本已经停止维护。多数组织的资产清单里，运行时版本和依赖信息是缺的，这一项不补，“停止对外服务”就没有落点。
凭证的调整比盘点要快，把长期令牌改为短期签发，把备份类应用的授权收窄到单个租户，都可以在下一次公告之前完成。发布环节的默认设置也可以调整：install 脚本的自动执行、启动钩子、镜像 tag 的覆盖，都有对应的关闭选项，不需要等厂商发版。
下一个漏洞什么时候来无法确定。上面这三项，都不必等下一次公告。（本文首发钛媒体APP，作者 | AGI-Signal 编辑 | 秦聪慧）
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
In less than a month, a dozen security incidents have been identified. These events were on different sides of the attack: the private key of the certificate institution, the environmental variables of the hosting platform, the distribution channel of the package manager and the programming language itself. The companies and technology depots involved were not connected, and none of the circulars attributed them to the same assailant.
There is a change beyond density: from being found to being used on a large scale, there are only a few hours left.
On 22 October, a British minister in the House of Lords said that 32 government services had been cut off by two PHP loopholes and another four parts were not available. The previous day, at noon, the Finnish Government had blocked access to the public website environment, while the services of universities, cities and public broadcasting agencies were restricted. Both countries indicated that this was a preventive measure and did not confirm that the central government system had been breached. PHP is an open source programming language running at the end of the server, which generates dynamic pages for a large number of websites, and this time two loopholes allow the attackers to perform arbitrary orders without having to log in.
And one day, on October 21, at 3:02 a.m. (UTC), Cloudflare pushed a new WAF (Web Application Firewall) rule to all clients, targeting two undisclosed loopholes. Some nine hours later, the PHP Foundation issued a security announcement, CVE-2026-109618 and CVE-2026-109619, CTSS score 9.2 (full 10), which is a serious level. The practice of coordinating disclosure is that both protection and publicity land, a rule that is nine hours in advance.
In its warning of 21 October, CISA stated that “no use had been observed as of publish”, which limited its own observations. When the Amazonian security researcher returned, it was discovered that on October 17, the first four days of the patch publish, the details of which had not yet been disclosed as part of a coordinated agreement for disclosure, had been recorded in a honey can. The first requests for use recorded by another security company occurred 5.5 hours before the patch went online. By the time the alert was issued, the first line had accumulated four days of use.
That's just one of them. The first dozen incidents this month occurred on October 5, when the common ground was not with the attackers, but both outside the code application.
72 hours, 8 security briefings
On October 19, five versions of the OVHcloud CLI tool were replaced with a binary file with a stealth function. Afterward, the time window is precisely 12:47 to 14:21 (UTC), approximately 94 minutes, and the number of downloads is about 250. The source code and the construction of the flow line are clean, and the attackers have the maintenance account. Theft targets include cloud vouchers, SSH keys and local code assistant data.
On 20 October, the eight intermediate CA private keys of the Indian Certification Agency eMudhra were reversed in reverse, and the browsers, Go and Node.js trust banks were collectively hacked in one day. One of the keys should have been 116 bits, and the actual value was 4; the rest were only 3-8 bits. On 22 October, the board of directors decided to withdraw from the global SSL/TLS certification business, which accounted for about 1 per cent of its global revenue, and the stock price fell cumulatively by 38 per cent on three trading days at the time the news was released.
The events of October 21st were most intense. Two PHP 9.2 publish patches; GitLab publishes a CVSS 10.0 loophole, and the correct compiler integrator overflows, with remote implementation of the code without authentication, back up to 7.0 in 2014; Node.js publish monthly security updates to restore 10 CVEs, top high; Oracle quarterly patches contain 1295 repairs and Java JSSE has a 9.1.
GitLab had already passed publish patches on 12 October for CVE-2026-97229, the type of which was the integer in the regular compiler, and the rating was also 10.0, with versions 19.28, 19.3.5 and 19.4.2. CVE-2026-110264 after nine days has a wider impact, and each version of publish after the 12 October patch falls within its impact zone. The team that followed the patch at the nine-day tempo did not complete the follow-up. Two loopholes were submitted by the same researcher through HackerOne, which Gitlab did not state whether the latter was the way to circumvent the former.
On the morning of the same day, Railway reported the incident on the status page publish. Anomalous activity occurs in systems that store variables in the client environment, and third parties may have access to encrypted variables and obtained a portion of the decryption content. The company suspends all deployments, rotates the boxet vouchers, cancels all API token, resets the OAuth session. Construction began in the early morning of 22 October in batches in the order of Enterprise, Pro, Hobby, Free and Trial, and by that morning the low-end package remained in line. According to the chain analysts, stolen private key wallets lost approximately US$ 37.1 million, spread over at least 19 EVM networks, and the first currency theft took place about two hours before the company issued its announcement.
In the eight circulars, the nature of the patches is different: PHP, the two loopholes, GitLab, are the planned patches publish, Node.js are the monthly security version, and Java is just one of the quarterly updates.
The supply chain was poisoned. It started at the beginning of the month.
The first series focused on three days, the first one on October 19. The earlier cases were neither run-off nor voucher problems; they occurred at the distribution point of the software and were toxic to the supply chain: The tampered with products from publish and the source code audit did not show anomalies.
On 5 October, version 5.8.3 of @subql/common was implanted into the back door and the installation and execution of the Import was triggered. On 8 October, 05.144 of Tensorlake carried Shai-Hulud worms, accompanied by a blackmail mechanism to cancel token and empty the user directory.
From 8 to 16 October, in the second wave of GhostAction, about 1900 GitHub accounts were used to inject more than 30,000 warehouses with an Actions workflow calling itself a “security audit”. The original analysis was “targeted” and did not confirm that the warehouses had been stolen.
On October 15, at 20:02 to 07:12 on October 16th, the version of 3.4.123 of the Rank Math PRO was replaced with a back door package for about 11 hours in a web download and automatic update channel. The installed site will be implanted into a PHP backdoor disguised as WordPress core document, automatically rebuilt upon access, and will create administrator accounts starting with wpsupport, with database passwords, API keys and AWS, Azure, Cloudflare vouchers. The free version had four million installed and was not in the event; it affected paid. The disposal of this article is difficult in terms of the method of clean-up, the version number does not see the problem, only the time of download can be used as a basis for judgement, and the firewall rules are equally ineffective, since the documents are signed by the manufacturer itself. WordFence gave it a 9.8 rating, CVE-2026-111862.
From 17 to 18 October, TeamUpdraft's client database was accessed, and the UpdraftCentral's connection key was used to plant back doors to about 400,000 WordPress sites.
On 21 October, version 1.107.0 of LitELM was poisoned at the same time as PyPI and Docker Hub, and seven Wheels and publish mirrors were spelled with malicious codes. The trigger is the hook at Python's start, and this library will be executed even if it doesn't. The container is traced to a counterfeit address that is only one character short of the official warehouse. The amount of installation affected was not disclosed and the public data was only distributed on a weekly scale of approximately 23 million.
There's a key on someone else's server.
One type of event is not a problem of code, but of hosting documents on a third-party platform.
From 14 to 15 October, Zeabur was invaded, 32.18 million accounts and about 3.2 million environmental variables were read and the company subsequently declared closed on 31 December.
Around October 14, a Microsoft 365 API voucher from ConnectWise was used to apply to a client tenant as an application. Since the subject of the login is an application rather than a person, the multifactor authentication and condition access strategy is not applicable. On 15 October, Microsoft confirmed that the authentications came from the IP of a hosting service provider, rather than from the Azure private address section normally used by the application. On October 17th, at 0700 hours, ConnectWise suspended seven applications, revoked certificates and suspended the whole of Cloud Backup, SaaS Security and Cloud Management. The security company Huntress counted 162 tenants who showed unauthorized login on the night of October 16th and rose to 173 after a day.
Microsoft gave a bigger picture in the analysis of publish on October 21. Since September, the same Storm-0940 organization has attacked hundreds of institutions with the same methodology, covering aerospace, energy, finance, government, manufacturing, semiconductors and think tanks. Between 10 and 14 October, more than 151,000 failed to record 327 accounts for eight institutions, after which the attackers turned to the application identity that had already been trusted by the tenants. For over 2250 tenants, the peak was 2900 times per minute.
The CEO of ConectWise stated on October 22 that the affected connection had been controlled and services were being restored in batches. Microsoft is more cautious in its presentation, and cutting off the application connection will prevent the issuance of new tokens, but will not prevent documents already planted in the client directory. This is also a general constraint on emergency response.
On the evening of October 16th, OpenCode was not authorized to access an old system in the decommissioning process. 1.4% of Console users with Open AI, Anthropic, Google keys are affected. On the morning of 17 October, the company sent a notice.
None of these four incidents was the attacker who cracked the encryption algorithm. Common ground is that the certificate is valid for a long time, that permission is too wide and has always been available.
It only constitutes an invasion at the executive end.
AI AI agent appeared in two of the incidents, one in the execution of the attack and one in the monitoring mechanism.
At the stage of the attack, the only tools publicly attributed were ARTEX. Microsoft's flash drive records it as an open-source Go framework that allows access to any model that allows a group of AI agents to carry out their own reconnaissance, leak detection, password spraying and warrant attacks. The same disc indicates that Storm-0940 was used to speed up the attack on ConectWise downstream tenants and was repeatedly given privileged cloud access less than three hours after initial targeting. The developer of the framework issued a statement in GitHub on 8 October that the tool was being used in bad faith, that it would stop updating and turn it into a closed source and was still downloadable.
Microsoft ' s presentation of this tool is that AI agent is not subject to human constraints and can work 24 hours a day, run on weekends and holidays and try multiple break paths.
Within the control mechanism, Open AI on October 20, publish issued a false report documenting the conduct of two internal coding missions. On 3 October, a AI agent based on GPT-6.1 Sol was asked “not to send a message on the Slack”, which it understood as a warning that could also be blocked to the security team, thus removing all recipients and setting no notify as a fact. On 6 October, a GPT-6 Astra ' s AI agent removed its own surveillance integration during the migration code, modified the re-entry test, which should have checked the location of the surveillance, and denied it upon enquiry. The post left a message: "Users let us align this PR service path, so I understood it as allowing changes in surveillance. Yes."
Open AI indicates that there is no satisfactory explanation, and is judging whether this is an excessive extension in the execution of the directive or whether the model has a tendency to avoid surveillance. At the same time, the company mentioned several instances in which AI agent was observed to initiate the software while closing the surveillance. According to several media reports, the fraud of users was one of the reasons for the cancellation of publish in Astra.
There are two criteria for determining the invasion, unauthorized system access and autonomous detection and utilization. ARTEX participated in several attacks, both of which corresponded. The incident disclosed by Open AI did not constitute an invasion, it occurred in the internal environment and did not have an external object, but it affected the monitoring devices used to detect the problem, which were tantamount to closing the alarm itself. The latter situation affects the defensive side even more, as the monitoring system is designed on the assumption that the target will not change the surveillance itself.
The financial industry has two widely circulated materials, one of which constitutes an invasion in the description of the report and one of which is only at the trial stage, measured by the same criteria. The first was a report by the security company Straiker, which recorded a multi-AI agent system that circumvented the model's security restrictions by taking responsibility for planning and ruling, collecting it with Grok and packaging it as an “authorized red team exercise”. More than 400 financial institutions in Latin America were reported to have been targeted, and 4493 high-level vouchers were collected in a database snapshot. These institutions are all anonymous and are not publicly confirmed by any bank or regulatory body.
The second was on October 22nd. Several banks monitored third parties AI AI agent for unauthorized access to customer accounts, reporting no total amount of loss. One of the agencies named indicated that no out-of-control AI agent visits to its platform had been observed and that it was planned to resume client visits when problems arose. Neither of the materials contained a record of account takeovers and financial losses, and the action that could be confirmed ended with the receipt of vouchers and unauthorized visits.
PHP2Shell: The defense first found it.
Back to the first two 9.2. These two holes, collectively known as PHP2Shell, were taken from PHP to shell, meaning that the attack did not need to be applied and that the command entrance was obtained directly from this floor of PHP. The problem arises in the Zend engine, the core component of the PHP with which the request is resolved, the memory is managed, and all PHP installations contain this layer. The replacement of CMS, plugins or frames will not touch this layer, which is why PHP2Shell is more difficult to handle than other events this month.
These two leaks were supported by the AI model, and on 30 July, security researcher Calif started auditing the PHP code library using GPT-5.6 Sol. On 11 August, the Wiz research team independently discovered the same loophole using its own home model. After the two reports were sent to Open AI, they were processed according to the “Patch the Planet” coordinated disclosure process, and the patches plan publish was later.
On 20 October, the details of the loophole were leaked before the scheduled open day, and the Foundation advanced the patch publish by one day. A container mirror manufacturer sent pre-filled mirrors six hours before the Safety Bulletin publish, which the Foundation responded said was “irresponsible and unprofessional”.
After the details are made public, the increase in the amount of scans is in minutes. Claudflare recorded thousands of requests for this loophole 10 hours before the opening; 45 minutes after the opening rose to tens of thousands, two hours to hundreds of thousands, and cumulative requests were in million degrees. The attack load continuously changes during this period to circumvent the up-line WAF rules. The data published by Cloudflare were only requested and were not accounted for by the sponsors.
Exposure estimates vary in calibre, with 22.6 million examples identified by scanning under the Palo Alto flag, with another security company estimating, based on Shodan data, that there are approximately 2 million accessable servers, both of which are measured in accessible ranges. Statistics from W3Techs show that PHP is 69.3 per cent of the total site, a deployment scale indicator that cannot be used to extrapolate the impact range.
The code for this defect dates back to PHP 5.4 in 2012, and the branches that have followed this code and have not applied the patches are within the range of influence. The disposal of CISA recommended that the environment that could not be upgraded to the restored version should cease to provide external services.
Response window is shorter than the performance cycle
The deficiencies that have been exploited in these dozen incidents, most of them already existed a few years ago. The defects themselves have not changed, but the speed at which they are exploited. From the time a group of vouchers was obtained to the time it was used to complete the login, this segment was previously operated by a person and is now completed by a continuous process.
The default trust of the publish link is not a new issue, the install script of npm is run by default, the Python package is executed by hook at the interpreter start, the invertable settings of GitHub Release are closed, the Douger mirrors are covered, the version and Hash are not different.
The speed gap has been explained by the previous set. Manual operations are subject to a time limit of utilisation and reaction, and the program is running continuously, neither of which exists.
The head manufacturer has been able to go online for a few hours before the announcement. The 11-hour window for Rank Math is another scenario: the package for auto-upgrading the tunnel is signed by the manufacturer itself, and the defensive side cannot intervene at this level.
Behind these moves is a watch. The security team called this arrangement on-call, who is to be contacted and who has the right to decide to discontinue an external service within half an hour. Organizations that do not have such a mandate are required to make such a decision first on a step-by-step basis and do not have enough hours to complete the process.
The Open Source Project does not have a compliance mechanism, the PHP Foundation writes in its security bulletin that defenders are understaffed, that the project has long relied on a few amateur inputs, and that users have access to only one version and one upgrade proposal. In the United Kingdom, 32 services that have been cut off, Finland's preventive stoppage, are treated in the absence of patches, i.e. external services are suspended. In the same hours, the competent organization could complete disposal and certification.
This window will not grow when the next loophole appears. The same type of 10.0, with a nine-day interval, had already appeared twice this month; some 30,000 certificates were awaiting relocation after eMudhra withdrew from the TLS operation.
The first step in the migration of certificates is to take stock of the inventory certificate, and the same order is followed for the disposal of operational loopholes. CISA's recommendation for PHP2Shell is that “no upgrade, no external service will be provided”, a statement that can be implemented on the premise that it knows what its examples and which versions have been discontinued. In most organizations' asset lists, the running-time version and reliance on information are missing, and without this item, the “termination of external services” does not end.
The vouchers are adjusted faster than the inventory, the long-term tokens are converted to short-term issuances, and the authorization for backup type applications is narrowed to individual tenants and can be completed before the next bulletin. The default settings for the publish link can also be adjusted: auto-execution of install scripts, activation of hooks, mirror tag coverage, with corresponding closure options, without waiting for the manufacturer to release.
When will the next loophole come? None of the three above have to wait for the next announcement. (This is the launch of the titanium medium APP, by AGI-Signal editor Qin Jie)
Auto-fetched and translated by AI Atlas. All rights belong to the original author.