PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches
Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline.
It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues.
Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers.
00:00 Headlines And Intro
00:33 PHP To Shell Exploitation
02:07 Patch Now Impact Scope
02:47 Linux KSMBD Bugs Exposed
04:10 AI Disclosure Process Drama
05:25 GitLab Max Severity Patch
07:30 ConnectWise Breach AI Agents
09:24 Artex Spreads In Japan
11:18 GMO Haname VPS Malware
12:24 Closing And Sign Off
Read the original article:
AI agents behind ConnectWise breach, PHP2Shell exploited days before patches, Japanese cloud hack