ARTEX is an AI-powered autonomous hacking platform used by cybercriminals to conduct large-scale, financially motivated attacks. It leverages AI agents to discover and exploit web vulnerabilities such as Remote Code Execution (RCE) and conduct supply chain attacks with minimal human interaction. The platform, originally open-source, has been forked and remains publicly accessible despite being closed by its developer. ARTEX operators primarily use Chinese AI models and deploy attacks broadly, targeting various industries including gray-market code-signing certificate shops. Misconfigurations expose many ARTEX instances publicly, enabling remote access to administrative interfaces and operator data.
OpsShield, an Indian IT security company, suffered a supply chain attack where attackers used compromised credentials to access its update servers and distribute malicious updates of cPGuard versions 5.88.12 to 5.88.19. The malicious updates contained scripts that collected data from customer servers, deployed hidden root shells, and uploaded stolen data to the attackers. Approximately 2,950 servers executed the fake updates during a 70-minute window. The attackers also copied about 7,900 client account records, including sensitive information such as hashed passwords, root SSH keys, and MySQL root passwords. OpsShield has since removed the attackers, reset credentials, rotated keys, and released patched cPGuard versions starting at 5.88.25 that remove the malicious components.
Malicious versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were distributed via the Cursor VS Code Extension Marketplace in a supply chain attack. These versions contained JavaScript code that performed host reconnaissance and attempted to establish a reverse SSH tunnel for persistence and remote access. The malicious extension was live for approximately 11 hours and potentially downloaded by around 5,000 developer systems on macOS and Windows. Cursor removed the malicious versions promptly, suspended the marketplace for investigation, rotated keys, and worked with the cloud provider to take down the attacker's server. The attack failed to establish the SSH tunnel on most systems due to lack of administrative privileges. Users are advised to remove the malicious extension versions and follow Cursor's remediation guidance to detect and eliminate persistence mechanisms.
A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was briefly available on the Cursor marketplace, embedding a JavaScript loader that attempts to establish persistent SSH backdoor access. The loader collects host information, adds an attacker-controlled SSH public key to authorized_keys, enables the local SSH service, creates a reverse SSH tunnel, configures persistence mechanisms, and attempts to exfiltrate host details. The incident is limited to the Cursor marketplace; official Microsoft Visual Studio Marketplace and npm packages were not affected. Successful remote access depends on host privileges and SSH configuration. Organizations should identify affected systems, preserve evidence, remove malicious artifacts, and rotate credentials if exposure is suspected.
A supply chain attack targeting Polymarket traders involved malicious code injected via a compromised third-party website monitoring tool, DebugBear. The malicious JavaScript hijacked logged-in user sessions to siphon funds by selling positions or transferring tokens to attacker-controlled addresses. Polymarket's international platform was affected, resulting in over $2 million in losses, while the US platform remained unaffected. Polymarket halted trading temporarily, removed the malicious script, and pledged to reimburse affected users. DebugBear confirmed the incident and advised users to remove its monitoring snippet.
This analysis discusses the challenges and security principles for protecting AI systems, particularly AI agents that autonomously perform tasks with access to critical tools. It highlights the need to treat language models as untrusted, consider all external data potentially malicious, and require human approval for irreversible actions. The approach adapts Security by Design and Cyber Immunity principles, emphasizing minimal attack surfaces, least privilege, component isolation, default deny policies, and defense in depth. The analysis also addresses risks from supply chain components and cloud model updates, as well as practical pitfalls like user fatigue and evolving vulnerabilities in AI frameworks.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
LiteLLM version 1.107.0 was compromised in a supply chain attack where attackers used leaked GitHub CLI OAuth tokens to push malicious packages to PyPI and Docker. The malicious packages were available for about three hours and downloaded over 49,000 times. The malware included an information stealer and a remote access trojan (RAT) that harvested sensitive credentials and secrets, then communicated with attacker-controlled servers. The incident was traced to leaked tokens exposed via logs and involved disabling branch protections and redirecting release workflows. Enterprise customers using private repositories were not affected. Users are advised to remove the compromised version and rotate credentials.
Storm-0940, a China-state aligned threat actor, has used the AI-driven ARTEX penetration testing framework since September 2026 to automate large-scale attacks targeting hundreds of organizations globally across multiple industries. These attacks have enabled the actor to gain privileged access to cloud infrastructures rapidly, sometimes within three hours of initial targeting. The actor leveraged ARTEX to accelerate scanning, reconnaissance, password spraying, and OAuth application abuse, notably in the ConnectWise supply chain compromise. The activity involved abuse of Microsoft 365 OAuth applications to access customer environments without interactive user sign-in, followed by reconnaissance and privilege escalation attempts via Microsoft Graph. Microsoft confirmed that these attacks did not stem from vulnerabilities in Microsoft corporate systems or products. Microsoft Defender XDR provides detections and hunting queries to identify suspicious activity related to this threat. Customers are advised to review service principal sign-ins and investigate unexpected credential or privilege changes while following published containment guidance.
Oracle released its October 2026 Critical Patch Update (CPU), addressing 1209 unique CVEs with 1295 security patches across 33 product families. Among these, 112 patches address critical severity issues. Oracle Fusion Middleware received the highest number of patches. Many vulnerabilities can be exploited remotely without authentication. Customers are advised to apply all relevant patches from this CPU.
Between April and July 2026, AOMEI Backupper, a Windows backup and disk cloning software, was compromised multiple times in short-lived supply chain attack windows. During these brief periods, users received a downloader for the ShinyRoad modular backdoor framework. The attacker, tracked as UNC7017, tampered with update server configurations to redirect users to malicious payloads, including the CrossRoad dropper, a modified Radmin Server with a malicious DLL, and the Adaptix C2 framework. The campaign used ephemeral tampering windows lasting only five to ten minutes, reverting quickly to authentic versions, which complicated detection. The attack affected a broad range of users opportunistically, with some higher education, IT services, and telecommunications organizations in multiple countries identified as compromised. AOMEI initially dismissed reports of tampering but later took corrective actions after repeated notifications.
Some downloads of the Rank Math PRO WordPress plugin from the official vendor website were compromised to include malware that planted hidden backdoors in a supply-chain attack. This incident was reported recently and involves the distribution of malicious plugin versions that could allow unauthorized access to affected websites.
The Rank Math PRO WordPress plugin version 3.0.123 was compromised in a supply chain attack, with malware injected into packages distributed between October 15 and October 16, 2026. The malicious code could allow attackers to take over websites where the plugin was activated. The malware is persistent, recreating hidden backdoors and modifying files and settings to maintain access. Rank Math released a clean version 3.0.124 immediately after discovering the compromise. Users who installed or activated version 3.0.123 during the affected window should consider their sites compromised and restore from clean backups or follow detailed cleanup steps.
This analysis discusses the emerging security challenge of managing AI agent identities in cloud environments. Traditional identity categories—human and non-human identities (NHIs)—are insufficient for AI agents, which make autonomous, adaptive decisions and interact dynamically with external systems. Microsoft has introduced the Entra Agent ID model, a specialized identity framework designed to securely manage AI agents across platforms. Tenable One Cloud Exposure now supports discovery and inventory of these AI agent identities to improve visibility and reduce security blind spots. The report emphasizes avoiding assigning human or over-privileged service accounts to AI agents and adopting official identity models like Microsoft Entra Agent ID. The complexity and novelty of AI agent identities create new attack surfaces, including supply-chain risks from cross-tenant links in identity blueprints.
Hackers exploited a supply-chain attack via ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenants. The attackers used compromised application identities (service principals) with previously granted permissions to access tenant data without triggering multi-factor authentication. ConnectWise shut down the Cloud Backup service to prevent further unauthorized access and is investigating the incident. No evidence currently indicates that backup archives were compromised, but attackers performed reconnaissance and persistence activities in some tenants.
Ledger has requested that resellers and distributors in several Asian countries suspend sales and remove their wallets from shelves due to an ongoing investigation into device tampering linked to a supply-chain attack.
The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.
Threat actors are increasingly leveraging Web3 decentralized blockchain architectures to enhance command-and-control (C2) infrastructure in cloud supply chain attacks. These attacks target developer workstations and CI/CD pipelines by poisoning open-source dependencies to steal ephemeral cloud credentials and establish persistence. Notable campaigns include the ChainDrop npm worm and the PolinRider campaign, which use Web3 smart contracts and multi-chain transaction queries to dynamically update malware infrastructure and evade traditional detection. DPRK-affiliated actors have been observed using these techniques in recent supply chain compromises. Defensive measures include restricting Web3 network connections where unnecessary, deploying endpoint and network protections, and automating policy controls across CI/CD environments.
Since August 2023, a threat actor has conducted a long-running malware campaign on the NPM registry called MALFEX, publishing eight malicious packages that have accumulated over 40,000 downloads. The campaign distributes malware including the Overlord RAT and various infostealers targeting Windows systems. Some malicious packages remain installable as of October 2026, with one package, function-flag, having over 37,000 downloads and no advisory flags. The malware enables remote control, data theft from browsers, Discord clients, and cryptocurrency wallets. The infection routines are designed to fail silently on non-Windows systems, limiting impact to Windows users who directly install these packages. No geographic or organizational targeting has been observed.
