Wiz
CompanySecurity timeline
- Activity reported by Wiz BlogSeries of agentic attacks on AI developer platforms drives LLMJacking at scale
- Zero-day reported by watchTowr LabsCISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw
- Vulnerability reported by NCSC (UK)Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.
Series of agentic attacks on AI developer platforms drives LLMJacking at scale
A Wiz Blog post describes a series of agentic attacks against AI developer platforms, which it calls "Black October", that have resulted in LLMJacking at scale. The article summary provides no further technical detail on affected platforms, entry points or indicators of compromise.
CISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw
CISA added VMware ESX CVE-2026-41709 (insufficient logging, CVSS 7.6) and Linux kernel CVE-2026-46300 (Fragnesia) to its KEV catalogue. CrowdStrike reports that Warp Panda exploited the ESX flaw as a zero-day in early 2026 to reduce audit log visibility. The Cyber Centre also flagged exploitation of a Siemens Software Center DLL sideloading flaw and Gitea vulnerabilities, and urged administrators to apply updates.
Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
Two memory-corruption flaws in PHP, CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and AWS advises upgrading rather than relying on configuration changes alone.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.