Darktrace Links PHP Scanning Surge and ARTEX Sign-In Attempts to AI-Driven Attacks

PHP flaws bring scanning, but no confirmed exploitation

The disclosure of CVE-2026-109618 and CVE-2026-109619 put pressure on organizations running PHP. According to Darktrace, both vulnerabilities can allow unauthenticated remote code execution, including in products and appliances where PHP is embedded, and updates depend on third-party vendors. Early guidance centered on patching internet-facing systems and watching for unexpected command execution, Webroot changes and outbound connections from PHP servers.

Darktrace observed widespread scanning across monitored environments involving hundreds of distinct source IP addresses that public reporting has associated with activity targeting the PHP flaws. The scanning volume was significantly greater than the evidence available for successful exploitation. Darktrace stresses that scanning shows interest in exposed infrastructure, while establishing compromise requires evidence of later behavior such as command execution, file modification or unexpected outbound communication.

The company has not observed direct evidence of exploitation of either CVE. On October 21 it did record a six-month high in detections consistent with zero-day exploitation activity, a 64% increase compared with historic data. Darktrace says this increase has not been confirmed as related to the PHP vulnerabilities.

AI in vulnerability research and enterprise agents

Darktrace notes that AI systems have become more capable at vulnerability research. OpenAI launched Daybreak in June 2026, combining GPT-5.5-Cyber, Codex Security and partnerships with security researchers and software maintainers. OpenAI says its models have been applied to finding and patching vulnerabilities in browsers, network infrastructure, FreeBSD and the Linux kernel. Darktrace joined the Daybreak Cyber Partner Program in June. OpenAI reported in August that Codex Security Cloud had analyzed more than 30 million commits across more than 30,000 codebases.

Faster discovery still leaves defenders with the work of locating affected software, testing fixes and completing remediation, Darktrace says, and the PHP case shows that gap clearly, particularly where vulnerable runtimes sit inside other products.

Darktrace Signal Labs also examined how a trusted enterprise agent could be abused after an attacker has already gained access. In a controlled simulation, researchers showed that the Claude platform's memory stores feature could be used to set up a live command-and-control channel between an external operator and internal Claude Code agents. The operator could assign network discovery, credential access and data exfiltration tasks. Darktrace has not claimed it observed this technique in operational attacks.

ARTEX and the Japan incidents

On 21 October, JPCERT/CC published findings on unauthorized access incidents affecting organizations in Japan. It states that attackers used AI to scan for known vulnerabilities and conduct attacks through APIs, with attack infrastructure showing Android application analysis, API discovery and testing for weaknesses including server-side request forgery. JPCERT/CC does not name ARTEX in that publication.

Microsoft describes ARTEX as an open-source, multi-agent penetration-testing system that can automate activity with limited human interaction. It reported that Storm-0940, which it assesses to be a China state-aligned actor active since 2021, used ARTEX against hundreds of organizations and was behind the ConnectWise supply-chain compromise. Microsoft observed faster scanning, reconnaissance, password spraying and OAuth application abuse, with several operations reaching privileged cloud access less than three hours after initial targeting. After the ConnectWise compromise, Storm-0940 tried to authenticate to more than 2,250 tenants at up to 2,900 attempts per minute.

Darktrace found related activity in its own telemetry. On 13 October it recorded 65 failed authentication attempts in around 20 minutes involving 144.172.64[.]128, one of the addresses Microsoft later identified in ConnectWise customer environments. Darktrace says this shows repeated failed authentication from infrastructure later tied to the campaign, but not ARTEX execution or successful compromise.

What it means for defenders

Microsoft also documented a password-spray campaign against 327 accounts across eight organizations between 10 and 14 October, with more than 151,000 failed logons, including more than 111,000 on 11 October. It saw no successful authentication, token issuance, Graph call or directory change from that campaign, and said most Storm-0940 targeting was unsuccessful. Where the actor got further, Microsoft saw service-principal sign-ins followed by Graph and directory operations, and recommends correlating those with directory changes and resource access.

Darktrace's conclusion is that behavior matters before attribution is available. In the PHP case defenders knew what to patch but had little exploitation information. In the ARTEX case analysts had only repeated failed sign-ins from one source. Neither observation alone demonstrates compromise, so examining what happens after the first interaction is how investigators separate noise from impact.