Security4all

And as if all these critical vulnerabilities weren't enough, we've also had several reports about threat actors using AI agents to compromise systems at scale. This is actually the part that worries me even more. Some interesting reports from the last few days: 01) ARTEX / ConnectWise Microsoft reports that Storm-0940 used ARTEX in a large-scale campaign targeting more than 2,250 Microsoft 365 tenants. Up to 2,900 authentication attempts per minute, with privileged cloud access achieved in under three hours in some cases. microsoft.com/en-us/security… 02) ARTEX / South Korean Finance CrowdStrike found evidence of AI-driven attacks against South Korean financial organizations, including exposed Claude Code sessions and ARTEX configurations. DeepSeek, GLM and Grok were used in the attacker's setup. crowdstrike.com/en-us/blog/u… 03) Cairn / 100+ Compromised Companies NorForge investigated exposed Cairn instances used for autonomous hacking campaigns. More than 1,100 attack projects in one cluster alone. Reuters identified over 100 companies whose websites had been compromised. Estimated AI costs: around $5 per task, according to NorForge. That's ridiculously cheap. norforge.com/blog/inside_cai… 04) Four More Agentic AI Campaigns CrowdStrike documented four additional threat actors using AI agents for real intrusion campaigns, including attacks against healthcare organizations and government entities. crowdstrike.com/en-us/blog/c… What concerns me is how quickly the economics of offensive operations are changing. Finding vulnerabilities, testing attack paths, adapting payloads, trying something else when an exploit fails, and eventually deploying a webshell. Much of this can now be delegated to agents that keep working for hours. And with open-weight models and freely available agent harnesses, the cost of running these operations is dropping significantly. We've been talking about AI changing offensive security for quite a while. These reports show that it's already happening in real-world intrusions. And I'm pretty sure we're only seeing a fraction of it.

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment: 1. Discovery with Nmap Common and alternative web ports; HTTP headers that may expose PHP versions: nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target> Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability. 2. Huntress: Monitoring and detection • Confirmed facts and remaining questions • Suspicious PHP child processes, shells and downloaders • Webshells and other post-exploitation activity • My process-watcher for Linux process visibility huntress.com/blog/php2shell-… 3. Vincent Schmalbach: Hardening and patching • Temporary nginx/Apache filters and upload-progress settings • WAF/origin bypass checks • Package and backport verification • PHP-FPM/worker restarts, container rebuilds • Side effects and checks for compromise vincentschmalbach.com/cve-20… Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.

PHP Patch, take it offline, or put it behind a WAF and hope it filters the exploit requests. I wouldn’t count on a configuration-only fix unless one is confirmed. For inventory, this Nmap command can reveal PHP versions exposed in HTTP headers: nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target> Only scan systems you’re authorized to test. This finds advertised versions, not every PHP server, and doesn’t confirm vulnerability.