DARKTRACE reports that the October 2026 disclosures of CVE-2026-109618 and CVE-2026-109619, both allowing unauthenticated remote code execution in PHP contexts, prompted widespread scanning of internet-facing PHP deployments. Public guidance emphasised patching exposed systems and watching for exploitation indicators such as unexpected command execution, Webroot changes, and unusual outbound connections.
Darktrace observed hundreds of source IP addresses scanning affected environments, but noted that this volume did not by itself prove compromise. On 21 October 2026, the company recorded a six‑month high in detections aligned with zero‑day exploitation activity, though this increase had not been confirmed as linked to the PHP flaws.
The report underlines the difference between interest in exposed infrastructure (scanning) and actual compromise (subsequent evidence of command execution, file changes or outbound traffic).
The piece also discusses AI’s role in the vulnerability lifecycle and in offensive operations. It cites AI-assisted vulnerability research, including OpenAI’s Daybreak programme and Codex Security, and notes that Darktrace has joined Daybreak to explore defensive integrations.
In operational terms, the article documents ARTEX, a multi‑agent penetration toolkit linked to Storm‑0940, used against hundreds of organisations and involving rapid credential and OAuth abuse; Darktrace observed failed authentication attempts from a key infrastructure IP associated with the campaign, alongside extensive but unsuccessful password spraying.
Microsoft’s attribution of ARTEX to Storm‑0940 was published eight days after initial observations, but the article stresses that the detected authentication activity and related Graph/directory actions are the observable evidence, not conclusive proof of successful compromise.