Watch on YouTube · subscribe for the daily brief

Someone tried to exploit PHP2Shell four days before the patch came out. The same day, Microsoft described AI agents trying 2,900 logins a minute, and Symantec caught an agent that turns other people's AI models into attackers.

PHP2Shell was probed before anyone knew

Amazon's MadPot honeypots, decoy servers built to attract attackers, recorded the first PHP2Shell exploit attempt on October 17, while the two flaws were still under embargo. It came from a commercial anonymization network, and Amazon says "it remains unclear how the actor acquired exploit information prior to disclosure" (The Hacker News). More probes hit the honeypots in the hours before Wednesday's release, with payloads varied enough that Amazon suspects several actors.

After the release, the volume exploded. Cloudflare CEO Matthew Prince said the network saw thousands of attempts in the 10 hours before disclosure, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions by Wednesday night (SiliconANGLE). Amazon now says "PHP2Shell is now being broadly exploited in the wild" (Wired).

No confirmed break-in yet. Wordfence, which protects more than 5 million WordPress sites, has blocked more than 74,000 exploit and probing attempts without a single confirmed compromise. The PHP Foundation says it knows of no successful remote code execution.

But a hit would be hard to see. CrowdStrike says workers stay stable, responses return HTTP 200 and application logs stay clean, because no application code runs. "The only server-side trace is a single memory-limit fatal in the web server's error log, which is routinely dismissed as noise" (The Hacker News).

Amazon's lesson. Seven- and 30-day remediation windows for critical internet-facing flaws assume a delay attackers no longer give. Amazon wants investigations to start from October 17 at the latest, and patch timelines measured in hours.

If you haven't patched yet: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart every PHP worker, and search your web server error logs since October 17 for memory-limit fatals. Our first PHP2Shell article explains the flaws and the update steps.

ConnectWise: AI agents at 2,900 logins a minute

Microsoft says a China-aligned group it tracks as Storm-0940 broke into ConnectWise's cloud backup service and stole the application credentials that connect it to customers' Microsoft environments (TechCrunch). It then used ARTEX, an AI agent framework for penetration testing, "to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute." In some cases, the time from first targeting to privileged access was under three hours (The Hacker News). ConnectWise paused the backup service and reset credentials.

LLMjacking: your open model, their attacker

Symantec caught an attack agent that hijacks AI models left open on the internet and uses them to run the whole operation: scanning for targets, exploiting server software, stealing databases and keys, and installing cryptominers, for up to 100,000 steps with no human involved. The model's owner pays the compute bill. Its honeypot logged more than 127,000 requests looking for AI endpoints, many trying stolen API keys (The Decoder).

Agents get their own keys

1Password for Agents lets an agent log in to your accounts without ever seeing the password: the agent proves its identity, you approve the login, and 1Password fills in the credentials (TechCrunch).

Banks are pushing back. JPMorgan, Bank of America, Morgan Stanley and others are restricting AI agents that log in with customers' own credentials, because many can't tell whether a person asked for the action. Most want agents limited to read-only access (The Decoder).

Google's Agent Compute Engine gives every agent its own isolated micro virtual machine that pauses when idle, plus an open-source Kubernetes runtime, Agent Substrate (The Decoder).

Muse sharing is back. Meta says the leak we covered on October 20 was in the web addresses of shared Muse artifacts, and it's fixed; old links now point users to request new ones (The Verge).

Builder's bench

• AWS Continuum is generally available: it finds code vulnerabilities, confirms which are exploitable in your environment, and proposes a fix that a person approves (AWS).
• Open Responses, OpenAI's spec for one common API across model providers, went to the Agentic AI Foundation, one of four new projects that bring it to ten (SiliconANGLE).
• OpenAI's Decisions API is widely available: a fast, cheap model that chooses between options and returns a confidence score (TechCrunch).
• Canva Craft, Canva's first image model, plans a layout before drawing, so text comes out readable (TechCrunch).
• VeloCloud zero-day: Arista says a 9.9-rated SQL injection in VeloCloud Orchestrator is exploited; a read-only login is enough to gain operator control. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12 (The Hacker News).

The rest of the day

• Only 13% see major returns. A Gartner survey of 2,002 technology leaders found few companies getting major value from AI, while 51% expect it to raise operating costs (The Decoder).
• Uber put all 30,000 employees on ChatGPT Work after a 1,000-person pilot (TechCrunch).
• Microsoft's MAI-DxO was right on 83% of hard cases in a simulation, against 36% for doctors working alone; specialists weren't compared (TechCrunch).
• OpenAI's agents mapped a mouse brain atlas in 32 minutes, a job estimated at months to a year by hand (The Decoder).
• Agents that play learn faster. MIT researchers left agents alone on a virtual island for 30 hours; they invented challenges, then beat agents that hadn't played (TechCrunch).

One thing to do today

List every AI model endpoint and gateway your team runs. Check that each one requires a key and has a spending cap. An open endpoint is now someone else's attacker, on your bill.