Oct 22, 2026 · 13 min
Attackers exploit critical flaws before patches arrive
AI agents behind ConnectWise breach, PHP2Shell exploited days before patches, Japanese cloud hack
The episode shows how defenders face simultaneous pressure from pre-patch exploitation, severe unpatched vulnerabilities, and increasingly capable AI-assisted intrusion campaigns.
- 1Attackers exploited critical PHP remote-code-execution flaws before patches were available, turning disclosure timing into an immediate defensive crisis.
- 2Unpatched Linux ksmbd SMB vulnerabilities and a maximum-severity GitLab flaw broaden the exposure across widely used infrastructure.
- 3Microsoft attributed the ConnectWise breach to China-aligned Storm-0940 using the Artex agentic AI framework, alongside related attacks in Japan.
Don't miss
The episode’s sharpest development is Microsoft’s attribution of the ConnectWise breach to Storm-0940 and its use of the Artex agentic AI framework.
The brief
David Shipley opens with a cluster of urgent stories: PHP flaws exploited before patches, unpatched Linux ksmbd vulnerabilities, a maximum-severity GitLab issue, and AI-assisted breaches.
The central tension is timing: defenders must contain active exploitation while vendors and maintainers are still preparing fixes for critical remote-code-execution flaws.
Microsoft attributed the ConnectWise breach to China-aligned Storm-0940 and linked the campaign to Artex, an agentic AI framework used in the intrusion.
The episode also examines related attacks in Japan and malware affecting thousands of Haname Desktopcloud servers, extending the story beyond one compromised provider.
Taken together, the reports show how unpatched software exposure and AI-assisted operations can compress the time defenders have to understand and respond.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.