The Signal
Must Know
AI & Agents · Securityaffairs
What happened
Microsoft assessed that China state-aligned Storm-0940 was responsible for the ConnectWise multi-tenant application supply-chain compromise and used ARTEX to target Microsoft 365 environments. [1]
Microsoft reported that ARTEX-driven attacks targeted 2,250 Microsoft 365 tenants across sectors including aerospace, defense, energy, financial services, government, and manufacturing. [1]
Why it matters
In several attacks, Storm-0940 obtained privileged cloud access in less than three hours after initial targeting; Microsoft attributed the acceleration to agentic AI operating at machine speed. [1]
Research · Cyberscoop
What happened
eMudhra said it will stop issuing SSL/TLS certificates after researchers reconstructed the private keys for eight certificates in under a second; major browsers blocked the certificates and Indian authorities investigated. [2]
The weak keys resulted from an error during an April 2025 key-generation ceremony, which produced a second weak key set that was published to browser trust lists instead of the intended keys. [2]
Why it matters
Each affected key was an integer below 256, including one recorded as 4; because the corresponding public certificates were available, all possible values could be tested and the keys could be used to forge certificates and impersonate websites. [2]
Exploitation · The Hacker News
What happened
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator, the central management system for VeloCloud SD-WAN networks, according to a company advisory dated October 22. [4]
Anyone who can log in to the orchestrator, including a read-only customer account, can use the flaw to gain operator privileges, described as the highest level of control over the system. [4]
Why it matters
Centralized network-management planes warrant priority when an authenticated flaw crosses a reported read-only-to-operator privilege boundary. [4]
Vulnerability · Theregister Security
What happened
VulnCheck reported an exploit for PHP2Shell CVE-2026-109618, a critical PHP out-of-memory corruption vulnerability leading to remote code execution; CVE-2026-109619 is the paired flaw. [5]
VulnCheck researchers reported what they believe is the first known exploit achieving remote code execution on ASLR-enabled x86-64 systems running PHP’s recommended production configuration. [5]
Why it matters
VulnCheck reported seeing hundreds of PHP2Shell proof-of-concept repositories on GitHub, while describing very few as legitimate, working exploits, largely because of ASLR. [5]
Identity · Helpnetsecurity
What happened
According to Huntress, an attacker replayed stolen Microsoft 365 sign-in sessions to access email accounts at 79 organizations and created hidden inbox rules that concealed some messages from victims. [3]
The stolen sessions were replayed from servers at 1337 Services GmbH, described in the source as a hosting provider. [3]
Why it matters
Huntress tracked the campaign from July 14 through September 22, 2026, recording 497 successful sign-ins and more than 200,000 failed login attempts. [3]
Also Worth Knowing
AI & Agents · Arstechnica Security
What happened
Amazon said vulnerabilities in a programming language underpinning much of the Internet, discovered using AI tools, were being broadly exploited. [6]
AI & Agents · Malwarebytes Labs
What happened
Two Chicago customers filed separate lawsuits accusing Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law by scanning faces and hands without consent, storing the data with names and addresses, and using recordings to train AI; both companies dispute the claims. [7]