Weekly roundup: China-linked ARTEX agentic AI hits ConnectWise Cloud Backup; PHP2Shell patched; Interpol Serengeti III
This SentinelOne weekly roundup (Week 43, 2026) covers several separate stories. The most significant is a suspected Chinese state-aligned actor using ARTEX, a Go-based multi-agent LLM penetration testing framework, to compromise ConnectWise Cloud Backup and pivot into downstream Microsoft 365 tenants. The actor reportedly reached privileged cloud access in under three hours in multiple environments and attempted sign-ins across more than 2,250 tenants. The roundup also covers emergency PHP patches for the PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619), and law-enforcement news: Interpol's Operation Serengeti III (1,462 arrests, $105M recovered) and the sentencing of Nigerian tax fraudster Chukwuemeka Victor Amachukwu to eight years. A former OpenAI engineer was also detained over alleged corporate espionage.
Entenda a falha
A vulnerabilidade
CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, are remote code execution flaws in the PHP runtime, both rated CVSS 9.2. They affect PHP serving web traffic through Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The articles do not say how the two CVEs differ. Risk is highest on mod_php, where unauthenticated requests trigger memory corruption before any application code runs, so CMS security controls do not help. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The articles do not give the vulnerable version ranges. The ConnectWise Cloud Backup intrusion in the same roundup has no CVE, and no flaw is described for it.
Como funciona
A web request reaches the PHP runtime (mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed) and is processed. If the request terminates unexpectedly, the runtime handles the error and releases memory. The articles describe the defects as being in memory management and error handling, and mention an out-of-memory condition. At that point memory ends up corrupted, which can lead to code execution. On mod_php this happens before any application code runs. The articles give no finer step-by-step detail.
Por que é vulnerável
The root cause is defective memory management and error handling when a request ends unexpectedly, including an out-of-memory condition. A 2024 audit had flagged this same condition but could not prove it exploitable, so it stayed unresolved for two years. The articles do not detail what the patch changes, only that updating the runtime is the only complete fix. Disabling session upload progress or limiting memory only partly closes some attack paths.
Como foi descoberta
A 2024 audit flagged the out-of-memory condition but could not show it was exploitable. AI-assisted auditing under OpenAI's Patch the Planet program later turned it into confirmed working remote code execution. Technical details leaked online during the embargo. Amazon Threat Intelligence saw exploitation probes on its honeypots from October 17, four days before the patches, which suggests attackers had the details while the flaws were still embargoed. PHP then published emergency releases.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 16:16.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- ARTEX campaign: From Oct 10 to 14, 2026, an automated cross-tenant password-spray campaign generated over 151,000 failed logons, peaking at 2,900 failures per minute on Oct 11. On Oct 15, the AI agents took control of identities tied to multiple ConnectWise cloud applications. They used pre-granted permissions to authenticate to customer Microsoft 365 environments without interactive logins.
- Post-access activity: The agents ran Microsoft Graph operations for directory reconnaissance, privileged role changes and application credential modification. Adding unauthorized credentials to existing OAuth applications created persistence that survives remediation of the backup software. Targeted sectors include aerospace, defense, energy, financial services, government and technology.
- ARTEX background: Originally developed by ThreatBook, it is a harness that works with any AI model. The original GitHub repository was removed, but forks remain. ConnectWise temporarily suspended services to isolate infrastructure.
- PHP2Shell: Both flaws are rated CVSS 9.2 and stem from memory management and error handling defects when requests terminate unexpectedly. They affect mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence saw exploitation probes on honeypots from Oct 17, four days before patches, after details leaked during the embargo. The weakness had been flagged in a 2024 audit but was not proven exploitable until AI-assisted auditing under OpenAI's "Patch the Planet" program.
- Tax fraud case: Between 2019 and 2021, Amachukwu and co-conspirators spearphished tax preparation firms and compromised PII of at least 800 clients. They stole over $3.3M through fraudulent returns and loan applications.
Remediação
- Apply the PHP runtime updates, which are the only complete fix. Interim measures such as disabling session upload progress or restricting memory limits only partially close specific attack paths.
- For the ConnectWise intrusion, the article notes that OAuth application credentials added by the actor persist after the backup software is remediated. Defenders should therefore review OAuth application credentials and privileged role changes.
- Monitor for web worker processes spawning shells, webshells written to document roots and unauthorized outbound connections.
Linha do tempo
-
Weekly roundup: China-linked ARTEX agentic AI hits ConnectWise Cloud Backup; PHP2Shell patched; Interpol Serengeti III
ler a análise desta fonte ocultar
This SentinelOne weekly roundup (Week 43, 2026) covers several separate stories. The most significant is a suspected Chinese state-aligned actor using ARTEX, a Go-based multi-agent LLM penetration testing framework, to compromise ConnectWise Cloud Backup and pivot into downstream Microsoft 365 tenants. The actor reportedly reached privileged cloud access in under three hours in multiple environments and attempted sign-ins across more than 2,250 tenants. The roundup also covers emergency PHP patches for the PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619), and law-enforcement news: Interpol's Operation Serengeti III (1,462 arrests, $105M recovered) and the sentencing of Nigerian tax fraudster Chukwuemeka Victor Amachukwu to eight years. A former OpenAI engineer was also detained over alleged corporate espionage.
Technical Details
- ARTEX campaign: From Oct 10 to 14, 2026, an automated cross-tenant password-spray campaign generated over 151,000 failed logons, peaking at 2,900 failures per minute on Oct 11. On Oct 15, the AI agents took control of identities tied to multiple ConnectWise cloud applications. They used pre-granted permissions to authenticate to customer Microsoft 365 environments without interactive logins.
- Post-access activity: The agents ran Microsoft Graph operations for directory reconnaissance, privileged role changes and application credential modification. Adding unauthorized credentials to existing OAuth applications created persistence that survives remediation of the backup software. Targeted sectors include aerospace, defense, energy, financial services, government and technology.
- ARTEX background: Originally developed by ThreatBook, it is a harness that works with any AI model. The original GitHub repository was removed, but forks remain. ConnectWise temporarily suspended services to isolate infrastructure.
- PHP2Shell: Both flaws are rated CVSS 9.2 and stem from memory management and error handling defects when requests terminate unexpectedly. They affect mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence saw exploitation probes on honeypots from Oct 17, four days before patches, after details leaked during the embargo. The weakness had been flagged in a 2024 audit but was not proven exploitable until AI-assisted auditing under OpenAI's "Patch the Planet" program.
- Tax fraud case: Between 2019 and 2021, Amachukwu and co-conspirators spearphished tax preparation firms and compromised PII of at least 800 clients. They stole over $3.3M through fraudulent returns and loan applications.
Remediation
- Apply the PHP runtime updates, which are the only complete fix. Interim measures such as disabling session upload progress or restricting memory limits only partially close specific attack paths.
- For the ConnectWise intrusion, the article notes that OAuth application credentials added by the actor persist after the backup software is remediated. Defenders should therefore review OAuth application credentials and privileged role changes.
- Monitor for web worker processes spawning shells, webshells written to document roots and unauthorized outbound connections.