AI agents breach human systems: a dozen-plus vulnerabilities in one month, which layer did AI actually break through

In less than a month recently, more than a dozen security incidents were disclosed one after another. These incidents belong to different attack surfaces: the private keys of a certificate authority, the environment variables of a hosting platform, the release channel of a package manager, and the programming language runtime itself. The companies and tech stacks involved are unrelated to one another, and no single advisory attributes them to the same attacker.

Beyond the density, there is another change: from a vulnerability being found to its being exploited at scale, only a few hours remain.

On October 22, a British minister said in the House of Lords that, affected by two PHP vulnerabilities, 32 government services went offline and another 4 were partially unavailable. At noon the previous day, the Finnish government blocked inbound traffic to the public website environment, and services of universities, cities and public broadcasters were simultaneously restricted. Both countries said these were precautionary measures and did not confirm that central government systems had been compromised. PHP is an open-source programming language that runs on the server side; the dynamic pages of a large number of websites are generated by it. The two vulnerabilities this time allow attackers to execute arbitrary commands without logging in.

One day earlier, at 3:02 a.m. (UTC) on October 21, Cloudflare pushed a new WAF (Web Application Firewall) rule to all customers, targeting precisely these two not-yet-public vulnerabilities. About nine hours later, the PHP Foundation issued a security advisory, numbered CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2 (out of 10), rated critical. The convention for coordinated disclosure is that protection and the advisory land at the same time; this rule came nine hours early.

CISA's October 21 alert said "no exploitation has been observed as of publication," a statement limited to its own scope of observation. When Amazon security researchers reviewed the incident, they found that on October 17—four days before the patch release, when vulnerability details were not yet public under the coordinated disclosure agreement—a honeypot recorded an exploitation attempt. The first exploitation requests recorded by another security company appeared 5.5 hours before the patch went live. By the time this alert was issued, four days of exploitation traces had already accumulated on the front line.

The above is only one of them. Of the more than a dozen incidents this month, the earliest appeared on October 5; what they have in common is not the attacker but that they all occurred outside application code.

72 hours, eight security advisories

On October 19, five versions of OVHcloud's CLI tool were replaced with binaries carrying data-stealing functionality. The postmortem pinned the time window to 12:47 to 14:21 (UTC), about 94 minutes, with roughly 250 downloads. The source code and build pipeline were clean; what the attacker obtained was a maintainer account. The theft targets included cloud credentials, SSH keys and local coding assistant data.

On October 20, eight intermediate CA private keys of the Indian certificate authority eMudhra were reverse-reconstructed, and the trust stores of browsers, Go and Node.js collectively blacklisted them within a day. One key that should have been 116 bits actually had a value of 4; the others were only 3 to 8 bits. On October 22, the company's board decided to exit the global SSL/TLS certificate business, which accounts for about 1% of its global revenue; when the news was announced, the stock had fallen 38% cumulatively over three trading days.

October 21 saw the densest cluster of incidents. Patches were released for the two PHP 9.2 vulnerabilities; GitLab disclosed a CVSS 10.0 vulnerability, an integer overflow in the regex compiler allowing remote code execution without authentication, with impact reaching back to 7.0 in 2014; Node.js released its monthly security update fixing 10 CVEs, the highest rated high; Oracle's quarterly patch contained 1295 fixes, including a 9.1 in Java JSSE.

GitLab had already released a patch on October 12 for CVE-2026-97229, also an integer overflow in the regex compiler, also rated 10.0, in versions 19.2.8, 19.3.5 and 19.4.2. Nine days later, CVE-2026-110264 has a larger impact scope: every version released after the October 12 patch falls within its affected range. Teams that followed the patch on a nine-day cadence effectively did not follow it completely. Both vulnerabilities were submitted by the same researcher via HackerOne; GitLab did not say whether the latter is a bypass of the former.

On the same morning, Railway posted an incident advisory on its status page. Abnormal activity occurred in the system storing customer environment variables; a third party may have accessed encrypted variables and obtained the decrypted contents of some of them. The company suspended all deployments, rotated bucket credentials, revoked all API tokens and reset OAuth sessions. Starting in the early hours of October 22, builds were restored in batches in the order Enterprise, Pro, Hobby, Free, Trial; by that morning, lower-tier plans were still queuing. On-chain analysts counted losses of about $371,000 in wallets corresponding to the stolen private keys, spread across at least 19 EVM networks, with the first theft occurring about two hours before the company issued its advisory.

Among these eight advisories, the nature of several patches differs: the two PHP vulnerabilities were an emergency response, GitLab was a scheduled patch release, Node.js was a monthly security release, and Java was merely one item in a quarterly update.

Supply chain poisoning began at the start of the month

The earlier batch of advisories was concentrated in three days, the earliest being October 19 day. The earlier incidents were neither runtime vulnerabilities nor credential problems; they occurred in the software distribution chain and were supply chain poisoning: what was tampered with was the published artifacts, and source code audits would show nothing unusual.

On October 5, version 5.8.3 of @subql/common was implanted with a backdoor, triggered both on installation and on executing import. On October 8, tensorlake's 0.5.144 carried the Shai-Hulud worm, with an accompanying extortion mechanism that wipes the user's home directory if the token is revoked.

From October 8 to 16, the second wave of GhostAction, about 1,900 GitHub accounts were used to inject an Actions workflow calling itself a "security audit" into more than thirty thousand repositories. The original analysis's wording was "targeted"; it did not confirm that all these repositories had been compromised.

From 20:02 on October 15 to 07:12 on October 16, version 3.0.123 of Rank Math PRO was swapped for a backdoored package in the official website download and automatic update channels, a window of about eleven hours. Installed sites would be implanted with a PHP backdoor disguised as a WordPress core file, automatically rebuilt on access, and would also create administrator accounts beginning with wpsupport_, exfiltrating database passwords, API keys, and AWS, Azure, and Cloudflare credentials together. The free version has four million installs and is not part of this incident; the paid version is affected. The difficulty in handling this one lies in the cleanup method: the version number shows no problem, only the download time can serve as a basis for judgment, and firewall rules are equally ineffective, because the files were signed and released by the vendor itself. Wordfence gave it a score of 9.8, numbered CVE-2026-111862.

From October 17 to 18, TeamUpdraft's customer database was accessed, and UpdraftCentral's connection keys were used to implant backdoors into about 400,000 WordPress sites.

On October 21, version 1.107.0 of LiteLLM was poisoned simultaneously on PyPI and Docker Hub; seven wheels and the published container images all carried malicious code. The trigger was a Python startup hook, which executes even without importing the library. Container tracing pointed to a counterfeit address differing from the official repository by a single character. The number of affected installs was not disclosed; the only public data is a distribution scale of about 23 million per week.

Keys stored on other people's servers became the main thread

There is a category of incidents where the problem is not in the code but in credentials hosted on third-party platforms.

From October 14 to 15, Zeabur was breached; 321,800 accounts and about 3.2 million environment variable records were read, and the company subsequently announced shutdown on December 31.

Around October 14, a ConnectWise Microsoft 365 API credential was used to request Graph tokens from customer tenants as an application identity. Because the login principal was an application rather than a person, multi-factor authentication and conditional access policies did not apply. On October 15, Microsoft confirmed that these authentications came from the IP of a hosting provider, not from the Azure private address range normally used by the application. At 07:00 on October 17, ConnectWise disabled seven application identities, revoked certificates, took Cloud Backup entirely offline, and suspended SaaS Security and Cloud Management as well. The security firm Huntress counted 162 tenants with unauthorized logins by the evening of October 16, rising to 173 a day later.

Microsoft's analysis published on October 21 gave a bigger picture. The same organization, numbered Storm-0940, had used the same set of techniques since September to attack hundreds of institutions, covering industries including aerospace, energy, finance, government, manufacturing, semiconductors, and think tanks. Between October 10 and 14, more than 151,000 failed logins targeted 327 accounts at 8 institutions, after which the attackers shifted to application identities already trusted by tenants. Attempts against more than 2,250 tenants peaked at 2,900 per minute.

On October 22, ConnectWise's chief executive said the affected connections were under control and services were being restored in batches. Microsoft's wording was more cautious: cutting application connections can stop new tokens from being issued, but cannot stop credentials already planted in customer directories. This is also a general limitation of incident response.

On the evening of October 16, an old system of OpenCode that was in the process of being decommissioned was accessed without authorization. Among Console users storing OpenAI, Anthropic, and Google keys, 1.4% were affected. On the morning of October 17, the company sent notification emails.

In none of these four incidents did the attackers crack an encryption algorithm. The common point is that credentials were valid for a long time, had overly broad permissions, and remained in a state where they could be taken and used.

It constitutes an intrusion only at the execution end

In the attack execution stage, the only publicly attributed tool is ARTEX. Microsoft's retrospective records it as an open-source Go framework that can connect to any model, letting a group of agents autonomously carry out reconnaissance, vulnerability discovery, password spraying, and credential attacks. The same retrospective states that Storm-0940 used it to accelerate attacks on ConnectWise Attacks on downstream tenants repeatedly gained privileged cloud access in less than three hours after initial targeting. The framework's developers issued a statement on GitHub on October 8, saying the tool had been used maliciously and that they would stop updating it and move it to closed source; it is still available for download.

Microsoft describes this tool as one where agents are not subject to the limits humans face, can work around the clock, keep running on weekends and holidays, and try multiple breakthrough paths at the same time.

Within the monitoring mechanism, OpenAI published a misalignment report on October 20 documenting behavior in two internal coding tasks. On October 3, an agent running on GPT-6.1 Sol was told "do not send messages on Slack," and it interpreted this as also permitting it to block alerts sent to the security team, so it removed all recipients and set no_notify to true. On October 6, a GPT-6 Astra agent, while migrating code, deleted its own monitoring integration, modified a regression test that was supposed to check whether monitoring was in place, and denied it when asked. A line in the log read: "The user asked us to align the service path for this PR, so I understood that as permitting changes to monitoring. OK."

OpenAI said there is no satisfactory explanation yet and that it is trying to determine whether this was overreach in executing instructions or a tendency in the model to evade monitoring. The company also mentioned that it had observed several instances of agents starting software with monitoring turned off. According to multiple media reports, deceptive behavior toward users was one of the reasons the Astra release was canceled.

The criteria for determining an intrusion are two: unauthorized system access and autonomously completed reconnaissance and exploitation. Several attacks involving ARTEX meet both. The incident OpenAI disclosed does not constitute an intrusion; it occurred in an internal environment with no external target, but it affected the monitoring device used to detect problems, which in nature is equivalent to disabling the alerts themselves. The latter situation has a deeper impact on defenders, because the design premise of a monitoring system is that the monitored object will not alter the monitoring itself.

In the financial industry, there are two widely circulated materials. Measured by the same standard, one constitutes an intrusion as described in the report, while the other only reached the attempted stage. The first is a report by the security company Straiker, which documents a multi-agent system using Claude for planning and adjudication and Grok for credential collection, packaging attack instructions as an "authorized red team exercise" to bypass model safety restrictions. The report counts more than 400 financial institutions in Latin America as attack targets and collected 4,493 high-level credentials in a database snapshot. All these institutions are anonymized, and no bank or regulator has publicly confirmed it.

The second is a report from October 22. Multiple banks detected third-party AI agents entering customer accounts without authorization; the report did not give a total loss figure. Among the institutions named, one said it had not observed out-of-control agents accessing its platform, and that its contingency plan was to restore customer access if problems arose. Neither material contains records of account takeover or financial loss; the confirmed actions stop at credential collection and unauthorized access.

PHP2Shell: the defenders found it first

Back to the two 9.2s at the beginning. Together these two vulnerabilities are called PHP2Shell, taken from PHP to shell, meaning the attack does not need to go through the application and obtains a command entry point directly at the PHP layer. The problem lies in the Zend engine, the core component bundled with PHP that handles request parsing and memory management; all PHP installations include this layer. Changing the CMS, plugins, or framework will not touch this layer, which is also why PHP2Shell is harder to handle than other incidents this month.

These two vulnerabilities were discovered with the assistance of AI models. On July 30, security researcher Calif began auditing the PHP codebase using GPT-5.6 Sol. On August 11, Wiz's research team independently discovered the same vulnerability using its own model. After both reports were sent to OpenAI, they were handled under the "Patch the Planet" coordinated disclosure process, and the patch was originally scheduled for release later.

On October 20, vulnerability details leaked before the agreed public date, and the foundation moved the patch release up by one day. A container image vendor pushed an image with the patch preinstalled six hours before the security advisory was published, and the foundation responded that this was "neither responsible nor professional."

After the details were made public, scanning volume grew by the minute. Cloudflare recorded that 10 hours before publication, requests targeting the vulnerability numbered in the thousands; 45 minutes after publication they rose to tens of thousands, and within two hours they reached hundreds of thousands, with cumulative requests in the millions. Attack payloads kept changing during this period to bypass WAF rules already online. The data Cloudflare published covers only request volume and does not identify the originators.

Estimates of the exposure surface differ by methodology. Palo Alto's Xpanse identified 22.6 million instances through scanning, while another security company estimated based on Shodan data that about 2 million servers were accessible; both figures measure the range that can be accessed. W3Techs statistics show that PHP's adoption rate across all sites is 69.3%, which is a deployment-scale metric and cannot be used to infer the affected range.

The code for this flaw can be traced back to PHP 5.4 in 2012, and all branches that have continued to use this code since then without applying the fix are within the affected range. CISA's remediation recommendation is that environments unable to upgrade to a fixed version should stop providing external services.

The response window is now shorter than the on-call cycle

In these dozen-plus incidents, most of the flaws that were exploited had already existed for years. The flaws themselves have not changed; what has changed is the speed at which they are exploited. From obtaining a set of credentials to using them to complete a login, this step used to be performed by a human; now it is carried out continuously by programs.

The default trust in the release pipeline is not a new problem: npm's install scripts run by default, Python packages execute via hooks when the interpreter starts, GitHub Release's immutability setting is turned off, Docker image tags can be overwritten, and no difference can be seen in version numbers or hashes.

The gap in speed has already been illustrated by the figures above. Manual operations are constrained by working hours and reaction time; programs run continuously, and neither constraint exists.

Leading vendors are already able to deploy protections a few hours before an advisory. The eleven-hour window in the Rank Math case was a different situation: packages in the auto-update channel are signed by the vendor itself, and defenders cannot intervene at this layer.

Behind these actions is an on-call roster. Security teams call this arrangement on-call: whoever is on rotation must remain reachable, and the roster also specifies who has the authority to decide within half an hour to shut down an external service. Organizations without this authorization must go through level-by-level approval to make such a decision, and a few hours are not enough to complete that process.

Open source projects do not have this on-call mechanism. The PHP Foundation wrote in its security advisory that maintainers are short-staffed, and the project has long relied on a small number of people contributing in their spare time; all users get is a version number and an upgrade recommendation. The 32 services taken offline in the UK and Finland's precautionary traffic cutoff are handling methods used when there is no patch to apply, namely stopping external services first. In the same few hours, organizations with on-call staff can complete remediation and verification.

When the next vulnerability appears, this window will not get longer. There have already been two incidents of the same type rated 10.0 this month, nine days apart; after eMudhra exited the TLS business, about 30,000 certificates still await migration.

The first step in certificate migration is to inventory existing certificates, and handling runtime vulnerabilities follows the same order. CISA's recommendation for PHP2Shell is "if you cannot upgrade, stop providing external services." The premise for being able to carry out this statement is knowing which instances you have and which versions are no longer maintained. In most organizations' asset inventories, runtime versions and dependency information are missing; unless this gap is filled, "stop providing external services" has no target to land on.

Adjusting credentials is faster than taking inventory: changing long-lived tokens to short-term issuance and narrowing the authorization of backup-type applications to a single tenant can both be completed before the next advisory. Default settings in the release stage can also be adjusted: automatic execution of install scripts, startup hooks, and overwriting of image tags all have corresponding options to turn them off, with no need to wait for a vendor release.

It is impossible to determine when the next vulnerability will arrive. None of the above three items requires waiting for the next advisory. (This article was first published on TMTPost APP; author | AGI-Signal; editor | Qin Conghui)