Vapor Panda used agentic AI tool ARTEX against about 140 targets
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.
84
Organization
CrowdStrike
- Mentions · 7d15
- Mentions · 30d59
- All mentions87
- First seenAug 11, 2026
- Last mentioned9h ago
Timeline
87 articles · newest firstCrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Mistral Large 4 ships as open weights for coding and cyber
The 1.05T model has 52B active parameters and a 1M context; Mistral's ranking claims are narrower than independent scores.
64
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
WARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
76
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
62
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
74
Hirundo says weight edits can remove Qwen3-Coder's pro-CCP bias
Even after the change, generated apps still failed a security benchmark more than half the time.
36
123 Reg says AI-driven attack exposed customer contact and account data
The GoDaddy-owned registrar says the September 18 intrusion was limited to reading and suspects China-linked use of ARTEX.
70
Warp discloses breach exposing AI agent logs and telemetry
Lloyd estimates roughly 1% of users were hit via an unnamed infrastructure vendor; CrowdStrike is investigating.
55
GMO says attackers posted data from Onamae desktop breach
The firm shut the trading desktop service on October 21 after a roughly $50 million ransom demand and now advises password resets.
74
PHP 8.2–8.5 OOM RCE cited again (CVE-2026-109618)
Christian Fischer's October 23 reply only links a CrowdStrike blog about PHP RCE zero-days.
42
PHP 8.2–8.5 stale-state RCE cited again (CVE-2026-109619)
The follow-up only links CrowdStrike's blog and gives no patch or attack details.
42
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
AINews 'Black October' roundup clusters AI-linked security disclosures
The digest says many incidents were found earlier and disclosed together, while exploitation scale is disputed.
38
Phone scams shift toward texts, voice clones, and QR codes
Consumers reported $470 million lost to text scams in 2024, and CrowdStrike says vishing doubled in early 2026.
36
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
PHP2Shell exploit attempt hit Amazon honeypot before disclosure
CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.
91
Storm-0940 used ARTEX and AI coding agents against many targets
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
74
PHP emergency updates fix two unauthenticated RCE flaws, CVSS 9.2
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; updating WordPress does not update PHP.
86
Four groups bypass AI guardrails and compromise targets, CrowdStrike says
A Spanish- and English-speaking actor compromised at least 15 Argentine health care organizations.
74
Hirundo says Qwen3-Coder writes weaker code for some customers
Hirundo reports the gap closed after it removed CCP alignment from the weights, with coding success unchanged on ten other tasks.
62
Qwen3-Coder wrote more hackable apps for a US contractor
Of 1,840 generated apps, BaxBench attacks broke into 1,144; a security instruction did not remove the reported gap.
64
Bullhorn takes recruitment platform offline after a cyberattack
Services are back in the UK, US and Australia, but SSO, password resets and several products were still degraded as of Tuesday.
74
Bullhorn takes staffing platform offline after cyberattack
Forensics has not determined whether customer data was stolen, and Bullhorn has given no restoration date.
72
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
FBI raided Texas laptop farms as DOJ charged US facilitators of North Korean IT workers who earned $3 million from over 70 companies.
74
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
86
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
Open From Data Center to Desktop: NVIDIA Expands Nemotron Family With Highest Efficiency Super VL and Bolt Models
NVIDIA released open Nemotron 3.5 Super VL, a 120B agent model, plus Bolt edge models.
76
Top 10 Best Malware Analysis Tools in 2026 [Ranked & Scored]
A 2026 roundup ranks malware sandboxes and file-intelligence tools, led by context, interactive, and evasion-resistant analysis.
18
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
FBI raided Texas laptop farms, arrested two Americans, and charged people tied to DPRK IT-worker schemes.
74
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
U.S. prosecutors charged 14 people and seized laptop farms used in a North Korean remote IT-worker fraud scheme.
76
FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
FBI arrested two Americans and raided 40-plus laptop farms aiding North Korean IT-worker salary fraud.
76
Justice Department says North Koreans have infiltrated dozens of US companies
Prosecutors say North Korean IT workers infiltrated at least 70 U.S. companies using laptop farms and stolen identities.
82
DOJ charges 14 over a sprawling North Korean remote work scheme
DOJ charged 14 people for a North Korean remote-IT scheme that drew about $3 million from 70 U.S. employers.
74
Related CVEs
by mentions- CVE-2026-41709<1%2.7Insufficient logging in VMware ESX for admin operations
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2024-1235687%9.8Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support
Appears with
- CrowdStrikevendor · 24
- Anthropicvendor · 15
- Palo Alto Networksorganization · 15
- Microsoftvendor · 15
- Claudeai model · 14
- Microsoftorganization · 12
- Anthropicorganization · 10
- Claude Codeproduct · 9
- Palo Alto Networksvendor · 8
- Warp Pandathreat actor · 8
- FBIorganization · 8
- ARTEXmalware · 8
- Artexproduct · 7
- Mandiantorganization · 7
- Wizorganization · 7
- GLM-5.3ai model · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.