October 24, 2026
48 Hours of Hacks: AI Agents, Stolen Keys, and a PHP Scare
Between October 21 and 23, 2026, a Chinese state-linked group used AI agents to work through a supply-chain breach at machine speed, a…
By Varun Chopra
9 min read
Between October 21 and 23, 2026, a Chinese state-linked group used AI agents to work through a supply-chain breach at machine speed, a developer cloud told every user to change their keys, and PHP needed an emergency patch. Here's what happened, in plain English, and what to do about it.
_💥 _Master AI & Tech Skills 💰 One Plan. Multiple Courses. More Savings. 🔥 Get Up to 50% OFF | ⏰ Limited-Time Offer 👉 Enroll Now & Start Learning
Around 2,900 login attempts a minute. Microsoft says that's how fast one attacker's AI agents hit company cloud accounts this week.
No human types that fast. That's the main story of the last 48 hours. Attackers aren't just using AI to write phishing emails anymore. They're giving it stolen keys and letting it run.
It wasn't the only bad news. A popular developer platform told every user to replace their secret keys. PHP, the language behind a huge share of the web, shipped emergency patches. A US lab-testing giant reported a breach. And here at home, India's largest bank confirmed that customer records turned up on the dark web.
This piece covers each incident in two layers: what happened and why it matters to you first, then a short section for the technical folks. If a term is jargon, I explain it the first time it comes up.
A note on method: everything here comes from vendor statements, government advisories, or reputable reporting dated October 20 to 23, 2026. Where something isn't confirmed, I say so.
The 48 Hours at a Glance
1. ConnectWise: The First Big "AI Agent" Supply-Chain Attack
What happened
ConnectWise sells IT management and backup tools to thousands of businesses. Microsoft says a China state-aligned group it calls Storm-0940 broke into ConnectWise's Cloud Backup service. The attackers stole the app's own credentials: the digital "master key" the backup app uses to connect to customers' Microsoft 365 accounts.
That's a supply-chain attack: instead of breaking into you, attackers break into a vendor you trust and use its access to reach you.
Then came the new part. Microsoft says the group used ARTEX, an open-source AI "penetration testing" framework (software built to attack systems on purpose so defenders can find weak spots), to automate the rest. According to Microsoft, ARTEX-driven attempts hit more than 2,250 Microsoft 365 tenants (a tenant is one organization's Microsoft cloud account) at about 2,900 attempts per minute. In some cases the group got privileged cloud access in under three hours.
Microsoft says most of the attempts failed, and that its own systems weren't breached or vulnerable. Targets spanned defense, government, finance, energy, semiconductors, think tanks and more, per Reuters.
Why it matters to you
If your employer uses ConnectWise Cloud Backup, your work email and files may have been exposed. Even if it doesn't, this is the template for what comes next. The attacker didn't need your password or your MFA code. The app was already trusted, so the attacker just walked in as the app.
AI didn't invent a new way in. It made an old way in run at machine speed.
For the technical folks
- Vector: abuse of compromised multi-tenant Entra ID application credentials → app-only Microsoft Graph tokens. No interactive sign-in, so no user MFA.
- Sophos X-Ops saw service-principal sign-ins as the ConnectWise Cloud Backup app (formerly SkyKick) on Oct 15, from a single VPS, for about 96 minutes. They found no sign of hands-on-keyboard activity and assess it was scripted.
- ConnectWise disabled seven application identities and revoked their credentials at 07:00 UTC on Oct 17, per its remediation guide.
- Follow-on activity via Graph included reconnaissance, application credential changes for persistence, and changes to groups and privileged roles. Microsoft warns these can survive even after the original app is fixed.
- Do: keep the affected ConnectWise apps disabled, review service-principal sign-in logs and Graph audit activity, and hunt for newly added credentials, consents, role assignments and policy changes. Microsoft's and ConnectWise's posts list IOCs.
2. Railway: "All Users" Should Rotate Their Keys
What happened
Railway is a cloud platform developers use to deploy apps. On October 21 it disclosed that attackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents," per TechCrunch.
Environment variables are where apps keep their secrets: database passwords, API keys, cloud credentials. With them, an attacker can log in to other services as you.
Railway says it looks like only a "subset of users" were hit, but it told all users to revoke and rotate their keys. It briefly paused new builds and deployments. It hasn't said how many users were affected or what the root cause was, and its CEO told TechCrunch a post-mortem is coming.
Why it matters to you
If you, your startup or your freelancer runs anything on Railway, assume your secrets are burned until you replace them. If you're not a developer, the lesson still applies: one leaked key at a platform can quietly unlock your data somewhere else.
For the technical folks
- Rotate every secret stored in Railway variables: DB credentials, cloud IAM keys, LLM API keys, webhook secrets, OAuth client secrets. Then check those providers' logs for unfamiliar use.
- Railway said the breach was likely part of a broader campaign aimed at "compromising AI inference providers." TechCrunch notes that open-source AI coding tool OpenCode reported a similar secrets breach earlier in the week. Unconfirmed: whether the two are linked, and how Railway was breached.
3. PHP2Shell: An Emergency Patch for the Web's Workhorse
What happened
PHP is the programming language behind a huge share of websites. On October 21, the PHP project released fixes for two critical bugs, CVE-2026–109618 and CVE-2026–109619, nicknamed "PHP2Shell." (A CVE is just a standard ID number for a publicly known security flaw.)
CISA, the US government's cyber-defense agency, said the bugs allow unauthenticated remote code execution: an attacker on the internet can run their own commands on the server without logging in. CISA says they affect all PHP installations serving web requests.
Why it matters to you
If you run a WordPress blog, a shop, or any PHP site, your host or developer needs to patch this now. TechCrunch reported that organizations and governments took sites offline to patch.
A note on exploitation: CISA said on October 21 it had not seen exploitation. TechCrunch, citing Amazon researchers, reported evidence of exploitation four days before the patches came out. Treat it as exploited.
For the technical folks
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Per CISA, if you're on unsupported PHP 8.1 or older, take those systems offline until you can upgrade.
- Root cause, per the security write-ups: out-of-memory handling can abort request processing while request data is half set up, and cleanup then works on attacker-controlled corrupted memory. mod_php is considered highest risk. PHP says no configuration fully mitigates it.
- PHP is often bundled inside other products, so inventory appliances and vendor software too. A WAF may buy time. Watch for PHP workers spawning shells or downloading tools.
4. Plex2Shell: Your Home Media Server Is a Target
What happened
On October 20, CISA added four Plex Media Server flaws to its KEV catalog (Known Exploited Vulnerabilities, its list of bugs attackers are actually using). Chained together, they're called Plex2Shell. The Hacker News and BleepingComputer covered it on October 21.
Plex is the app many people use to stream their own movies and photos at home. According to the reports, attackers are using the chain to install cryptocurrency miners and proxy malware.
Why it matters to you
If you run Plex at home and it can be reached from the internet, update it today. A media server sounds harmless. A hijacked one is a computer on your home network doing someone else's work.
For the technical folks
- CVEs: CVE-2026–96652, -96654, -96655, -96656 (SSRF, URI injection, arbitrary file write leading to library load). Researcher Zach Main rates the full chain 9.8.
- Fixed in Plex Media Server 1.43.3.10861 (released in August). Full details were published Oct 16 and a PoC followed. The same KEV update added Siemens Software Center CVE-2026–110936, abused in "ClickFix" campaigns, and SiteGuard CVE-2026–106931.
5. Quest Diagnostics: Patient Records Likely Accessed
What happened
US lab giant Quest Diagnostics said it learned on October 21 that an unauthorized party accessed its Quanum Lab Services Manager, a system healthcare clients use to order tests and see results. Quest believes certain patient records were accessed. It suspended the system, notified federal law enforcement and brought in outside experts, per AP and its SEC filing.
Why it matters to you
Health data can't be "rotated" like a password. How many people were affected and which data types were involved is still unknown. If you're a Quest patient, watch for official notices, and be suspicious of "your test results" emails asking you to click or pay.
For the technical folks
No vector, CVE or IOCs have been made public yet. Quest also paused its Essential Insights and LabHQ access as a precaution and said no data was accessed there.
6. India Angle: SBI Confirms Customer Data on the Dark Web
What happened
On October 21, State Bank of India told stock exchanges it had been alerted on October 16 by its threat-intelligence provider, the Defence Cyber Agency and CERT-In (India's national cyber emergency team) about customer data on the dark web.
From a preliminary look at about 3,75,000 records, SBI found 3,897 customer records containing personal data: names, mobile numbers, dates of birth, email and home addresses, gender, branch and CIF IDs, and loan/lead metadata, per The Hindu. SBI says core operations weren't affected, and it has brought in a CERT-In-empanelled firm to investigate.
Why it matters to you
That data is a scammer's script. The Internet Freedom Foundation warned that affected customers are the likeliest to get calls from fake "SBI officials" who can read their details back to them. A caller knowing your details doesn't make them real. SBI will never ask for your OTP, PIN or password.
For the technical folks
Unconfirmed: the source of the leak and whether it came from SBI's systems or a third party. Separately, the Economic Times notes that CERT-In issued a critical advisory on October 15 on AI agents as attack vectors. It said agentic tools have cut the time from first access to impact from days to hours, but the weaknesses being exploited are still the ordinary ones: exposed credentials, forgotten test APIs, plaintext payment keys. That's the ConnectWise story too.
7. SafePay: Governments Name a Prolific Ransomware Gang
What happened
CISA, the FBI, the US Secret Service, and German and UK agencies published a joint advisory on SafePay, a ransomware gang (criminals who lock your files and demand payment). It has hit at least 600 organizations since August 2024. It's a "double extortion" operation: they steal the data first, then threaten to leak it if you don't pay.
Why it matters to you
SafePay gets in the boring way: stolen or guessed passwords, phishing and unpatched VPNs. Most of its victims would have been protected by MFA and timely patches.
For the technical folks
Initial access via credential exposure, brute force (T1110), and VPN/edge-device CVEs, with Mullvad VPN IPs used for access. They move around with legitimate tools: AnyDesk, ScreenConnect, TeamViewer, PowerShell, RClone, WinRAR. Encrypted files get the extension .SafePay. The full IOCs are in the CISA advisory.
What You Should Do Now
If you're a normal user
- Treat "bank" calls as fake until proven otherwise. Hang up and call the number on your card. Never share an OTP.
- Update your apps and devices, especially anything you run at home, like Plex.
- Turn on MFA everywhere, preferably an authenticator app or passkey, not SMS.
- Be wary of "test results" or "account alert" emails. Go to the official site directly.
- Use a password manager so one leak doesn't unlock everything.
If you're a developer or in IT
- Patch PHP now (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), including PHP bundled inside appliances.
- On Railway? Rotate every secret, then audit downstream provider logs.
- Audit third-party app consents in Entra ID. Look for unexpected credentials, role changes and Graph activity from service principals.
- Move secrets to short-lived credentials (OIDC, workload identity) wherever you can.
- Patch edge devices and KEV entries first. Enforce MFA on VPNs.
- Assume attacks run at machine speed. Alert on volume anomalies, not just known-bad signatures.
The Real Lesson
Read these seven stories again and look for the zero-day magic. You'll barely find any. A stolen app key. Leaked environment variables. An unpatched server. A guessed password.
What changed is the speed. When an AI agent can try thousands of doors a minute, a door you meant to lock "next sprint" is already open.
Attackers have automated. Your patching and key rotation have to keep up.
Sources: Microsoft Security Blog, "AI-driven, large-scale nation-state campaign using ARTEX" (Oct 21, 2026); Reuters via Investing.com (Oct 21); CSO Online (Oct 22); Sophos X-Ops; ConnectWise remediation guide; TechCrunch on Railway and ConnectWise (Oct 22); CISA PHP alert (Oct 21) and KEV update (Oct 20); PHP.net release notes (Oct 21); The Hacker News and BleepingComputer on Plex2Shell (Oct 21); AP, Reuters and Quest's 8-K (Oct 21–22); The Hindu, India Today and Economic Times on SBI (Oct 21–22); Security Affairs and Cybernews on SafePay (Oct 22).
Thank you for being a part of the community
Before you go:
👉 Be sure to clap and follow the writer ️👏️️
👉 Follow us: Medium
Disclosure: This post includes affiliate and partnership links.