AI Is Being Used in Vulnerability Research and Active Cyber Operations

Oct 22, 2026 · Original article ↗

Summary

The article links AI-assisted vulnerability research and attacks, reporting PHP vulnerability scanning, JPCERT/CC findings in Japan, and Microsoft’s account of Storm-0940 using ARTEX. It stresses that scanning and failed logons alone do not prove compromise.

Key points

CVE-2026-109618 and CVE-2026-109619 can enable unauthenticated remote code execution, including in products with embedded PHP. Darktrace observed widespread scanning but no direct evidence of exploitation.
On October 21, Darktrace recorded a six-month high in detections consistent with zero-day exploitation activity, up 64% against historic data; it did not confirm a link to the PHP vulnerabilities.
In a controlled simulation, researchers demonstrated that Claude’s memory stores feature could be abused after an attacker gained access to establish a C2 channel and assign tasks to internal agents. Darktrace did not claim this technique was seen in operational attacks.
JPCERT/CC reported that attackers used AI to scan for known vulnerabilities and attack APIs in incidents affecting organizations in Japan; its infrastructure analysis found Android application analysis, API discovery, and testing for weaknesses including SSRF.
Microsoft reported that Storm-0940 used ARTEX against hundreds of organizations, including in activity attributed to the ConnectWise supply-chain compromise. Some operations reached privileged cloud access in under three hours.
Microsoft also documented more than 151,000 failed logons across 327 accounts at eight organizations, with no successful authentication or related access changes in that campaign. Darktrace’s 65 failed authentication attempts from infrastructure later associated with the campaign did not establish compromise.
The article emphasizes assessing what follows initial scanning or authentication attempts, including process execution, file changes, outbound traffic, and identity or directory activity.

Article Details

Event Type: Security news covering AI-assisted vulnerability research and attacks, PHP vulnerability scanning, and Microsoft-attributed use of ARTEX by Storm-0940.
Impact: Darktrace observed widespread scanning related to the PHP vulnerabilities but reported no direct evidence of their exploitation; a separate increase in zero-day-exploitation detections was not confirmed as related. JPCERT/CC reported AI-assisted vulnerability scanning and API attacks affecting organizations in Japan. Microsoft attributed the ConnectWise supply-chain compromise to Storm-0940 using ARTEX. Microsoft reported more than 151,000 failed logons in one campaign with no successful authentication, while other operations reached privileged cloud access in less than three hours.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]64[.]128`	Source address later identified by Microsoft as performing sign-ins and Microsoft Graph activity in ConnectWise customer environments; Darktrace recorded repeated failed authentication attempts from it.