Cleared to Act: Special Edition

What

Attackers were exploiting the PHP flaw four days before the embargo lifted

Two remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, rated 9.2 by the PHP security team and reported to reach back to PHP 5, were set for a coordinated announcement on October 22. The details leaked on October 20 instead: a forum post named the CVEs, a researcher published full details with proof-of-concept code within hours, and PHP moved its security release up to October 21 while saying that a vendor's early patched images had broken the embargo for everyone else. Amazon Threat Intelligence says its honeypots logged the first exploitation attempt on October 17, four days before the disclosure, while the bugs were still officially secret, and Palo Alto Networks counted more than 22 million internet-facing PHP instances that might be vulnerable. The Australian Signals Directorate and CERT-EU both issued pre-patch alerts telling organizations to get ready to update immediately. (ThreatLandscape)

Valid credentials put unvetted agents inside US bank accounts

Axios reported on October 22 that Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo have all found third-party AI agents operating inside customer accounts, logged in with the customers' own credentials. Some agents appeared to act beyond the instructions their users gave, and banks told Axios they often cannot tell whether a given action came from the customer or from software the customer pointed at the account. The banks are now restricting agent access, and JPMorgan's Jamie Dimon has signaled that customers who hand their passwords to outside agents may bear the liability for what those agents do. Reuters said it could not independently verify the report, and a Morgan Stanley spokesperson said the bank had not seen rogue agents on its own platforms. (Today News Brief, summarizing the Axios report)

A state-aligned actor ran an open-source agent framework at machine speed

Microsoft disclosed on October 21 that Storm-0940, an actor it assesses as aligned with China, has used ARTEX, an open-source agentic penetration-testing framework, since September to automate attacks against hundreds of organizations. In the ConnectWise Cloud Backup compromise, agents working for the actor used stolen application credentials to authenticate into Microsoft 365 tenants with no human sign-in at all, then ran reconnaissance and changed application credentials to persist. Microsoft counted sign-in attempts against more than 2,250 tenants peaking at 2,900 a minute, and puts the time from first targeting to privileged cloud access at under three hours in several cases. (Microsoft Threat Intelligence)

Two 9.0 kernel RCEs were posted to public lists with no patch attached

Trend Micro's Zero Day Initiative reported five kernel flaws this week, and the reports went to public mailing lists rather than a private embargo channel. Two are remote code execution flaws in KSMBD, the kernel's built-in SMB server, each rated 9.0: one triggers before any authentication on a KSMBD server listening on port 445, and the other corrupts memory through the SMB Direct path. Neither has a fix in the mainline kernel yet, and neither has a CVE, because the kernel project assigns those only after a stable fix exists; fixes then take weeks to reach distribution kernels. The routing followed the kernel's own security policy, updated this year, which holds that bugs found by AI tools are already public by definition. The finder here was Trend Micro's AI scanner, and a stable-kernel maintainer replied on the public thread that a report with no patch gives maintainers little to work with. (The Hacker News)

Six more kernel exploits went public the same week, this time by the book

Researcher Hyunwoo Kim posted "Infinity Core" to the oss-security list on October 17: six privilege-escalation flaws across the timer, signal, memory, futex, scheduler, and SLAB subsystems, five of them with public proof-of-concept code that yields a root shell, usable for server compromise and container escape, with the timer flaw also reaching Android. Kim reported the bugs privately first and posted only after the embargo agreed with the distribution maintainers had expired, and the Android exploit is being held back until Samsung patches. Fixes exist upstream, which puts this set ahead of the KSMBD pair on the one axis defenders control: the patch clock is already running, and every unpatched kernel is racing public exploit code. (oss-security)

Why

Read the four stories as one. Every control that failed was checking an arrival, and the damage was done by an action nobody checked. The PHP embargo verified that a list of people could keep a secret; the attackers were already inside the window, four days early. The bank login verified a credential; it never asked whether the action matched an instruction the customer actually gave. The kernel's disclosure policy verified which list a report landed on; the exploit material is public either way, while the fix travels at the speed of three separate release processes. Storm-0940's application identities verified perfectly, because they were the vendor's own trusted apps, signing in 2,900 times a minute.

The attackers have agents now, and agents do not queue. They probe every path in parallel, at machine speed, on weekends. A defense built on standing trust, standing credentials, and scheduled disclosure windows is a defense built for a slower opponent. The control that survives this week sits at the action itself: what is this actor allowed to do, under whose instruction, proven by what evidence, and written down where someone can check it later. Identity tells you who arrived. Authority, checked at the moment of action, is the part we keep skipping.

How

Near term (this week)

• Patch PHP to the October 21 security releases today, and hunt for exploitation back to October 17, the date Amazon's honeypots first logged attempts. Anything internet-facing that cannot be patched goes behind filtering rules or comes offline until it can.
• Audit every third-party application identity in your cloud tenants. Review service-principal sign-ins since October 1, credentials added to existing applications, and consent grants you do not recognize. Disable vendor connections you are not actively using; a dormant multi-tenant application is standing access with a logo on it.
• Inventory the agents holding financial credentials, yours and your customers'. Move them to read-only or narrowly scoped API access, and put a human approval in front of any money movement. A password shared with an agent is a credential you no longer control.
• Check whether KSMBD is even loaded on your Linux servers (lsmod will tell you). If you do not serve SMB from the kernel, turn it off. If you do, restrict port 445 and queue the kernel updates that carry the Infinity Core fixes.

Medium to long term

• Give agents their own credentials, scoped to the task and short-lived, instead of lending them human ones. A bank, a cloud tenant, or an internal platform should be able to tell the agent apart from the person, limit what it can spend or change, and cut it off without locking the human out.
• Require per-action authority for anything consequential: a grant bound to the instruction, checked when the action runs, with require-approval above the threshold you set. Standing access is what turned a valid login into an unbounded one this week.
• Build disclosure plans that assume the embargo leaks. Shorter windows, mitigations published first, patches pre-staged so release day is an execution day. The kernel community has already conceded the point for AI-found bugs; plan as if every critical is public on discovery.
• Demand records that answer the action question. When a bank cannot say whether the customer or the agent acted, the missing control is the record: what acted, under which grant, on whose instruction, kept where the agent cannot rewrite it.
• Put monitors and revocation outside the agent's reach and make them automatic. When the measured time from targeting to privileged access is under three hours, a response that waits for a human to read an alert is a plan written for a slower attacker.