Microsoft assessed that China state-aligned Storm-0940 was responsible for the ConnectWise multi-tenant application supply-chain compromise and used ARTEX to target Microsoft 365 environments. Microsoft reported that ARTEX-driven attacks targeted 2,250 Microsoft 365 tenants across sectors including aerospace, defense, energy, financial services, government, and manufacturing.
Why it matters
In several attacks, Storm-0940 obtained privileged cloud access in less than three hours after initial targeting; Microsoft attributed the acceleration to agentic AI operating at machine speed.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Research · Cyberscoop
What happened
eMudhra said it will stop issuing SSL/TLS certificates after researchers reconstructed the private keys for eight certificates in under a second; major browsers blocked the certificates and Indian authorities investigated. The weak keys resulted from an error during an April 2025 key-generation ceremony, which produced a second weak key set that was published to browser trust lists instead of the intended keys.
Why it matters
Each affected key was an integer below 256, including one recorded as 4; because the corresponding public certificates were available, all possible values could be tested and the keys could be used to forge certificates and impersonate websites.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Exploitation · The Hacker News
What happened
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator, the central management system for VeloCloud SD-WAN networks, according to a company advisory dated October 22. Anyone who can log in to the orchestrator, including a read-only customer account, can use the flaw to gain operator privileges, described as the highest level of control over the system.
Why it matters
Centralized network-management planes warrant priority when an authenticated flaw crosses a reported read-only-to-operator privilege boundary.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Evidence is visible. Uncertainty stays visible too.
Baitaphish separates source records from interpretations, labels AI-assisted enrichment, and avoids turning ingestion volume into unsupported claims about threats, prevalence, or risk.
