Organizations are grappling with AI-assisted cyberattacks as industry stakeholders issue security advisories following a fresh wave of software vulnerabilities and attempts to exploit them this week.
On Wednesday, Microsoft flagged a "large-scale nation-state" campaign it attributed to China-aligned threat actor Storm-0940. The company said the actor began using the ARTEX agentic framework as early as September to target multiple industries with automated attacks. It took the attackers less than three hours to hack cloud infrastructure in multiple cases, according to the company.
"This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially," the company said in a report.
Microsoft also tied the actor's activity to the recently disclosed ConnectWise supply-chain compromise but said the incident did not emanate from a compromise of its own systems, products, or services.
Elsewhere, Cloudflare CEO Matthew Prince reported "millions" of attempts to exploit newly disclosed PHP vulnerabilities known as PHP2Shell. However, the company's statement did not establish whether AI was involved.
Security patches and advisories
The seemingly unending attacks have prompted software vendors to issue advisories alongside temporary patches as security teams scramble to contain some of the publicly disclosed vulnerabilities.
Frontend-as-a-service provider Vercel on Wednesday said it had deployed firewall rules against a high-severity flaw in the Node.js Brotli decoder that can allow arbitrary code execution.
Separately, GitLab announced updates for a critical integer-overflow vulnerability it said could allow attackers to execute arbitrary code. The flaw affects versions dating back to GitLab 7.0.
"We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible," the company said in a statement.
Railway, meanwhile, said an unauthorized third party may have hacked encrypted customer environment variables. The company paused deployments while investigating and advised customers to rotate stored credentials.