Guessable eMudhra Keys Sat Trusted for 18 Months; 30,800 Certificates Must Move

Microsoft says Storm-0940, a group it links to the Chinese state, has used ARTEX, an open-source agentic penetration-testing framework, since as early as September. After compromising ConnectWise’s cloud backup service, it tried sign-ins against more than 2,250 Microsoft 365 tenants at 2,900 attempts a minute.

CrowdStrike says four previously unreported threat actors left their AI agent frameworks in open directories between May and August. A Spanish- and English-speaking actor hit at least 15 Argentine healthcare entities with a Claude Code harness.

LiteLLM says the attacker behind Wednesday’s malicious 1.107.0 release held GitHub CLI credentials for three developers. An org-owner token was used to disable branch protections and point the release workflow at a lookalike repository.

Railway says an unauthorized party may have accessed customers’ encrypted environment variables, and for some customers obtained decrypted values. It calls the attack part of a series aimed at platform companies to compromise AI inference providers, and it asked upstream providers to revoke exposed keys.

Node.js released 22.23.4, 24.22.1 and 26.12.1. They fix an out-of-bounds write in the Brotli decoder that permits remote code execution, reported by OpenAI’s Codex Security, plus two TLS hostname checks that could be bypassed.

After “lots of security issues, cyberattacks, and hacks this week,” @clairevo shared a prompt to find out what is at risk.

@mattpocockuk’s prompt of the day is “/grill-me on how a /software-factory might help us.” It helps you work out whether a software factory fits your team, then brainstorms the infrastructure you would need to set one up.

MemT 1.0, from the @MemOS_dev team, writes what you tell it into a memory state inside the model, while the current message still goes in the context window. @sudoingX ran it in bf16 on a 128 GB Strix Halo, taught it his Rust rules, saved its memory to a 42 MB file and killed the process.

@MiaAI_lab tested Flint 40B and found it very fast, but “not, in any way, shape or form, a replacement for Qwen3.6-35B.” @MiaAI_lab asks when a local model will finally beat it: this year, 2027 or never.

Thomson Reuters launched the next generation of CoCounsel Tax, Audit & Accounting on Thursday. “Precision alone doesn’t make professional work correct,” the company says.

Amazon says an exploit attempt for php2shell hit its MadPot honeypot on October 17, four days before the PHP fixes, and that the flaw “is now being broadly exploited in the wild.” Cloudflare CEO Matthew Prince told SecurityWeek attempts went from thousands to “millions now.” watchTowr says widely sprayed proofs of concept do not achieve code execution.

Capcom says unauthorized access to its CAPCOM ID service touched 11,774,247 records of email addresses and system IDs worldwide. For 43 people, birth dates, gender, country and nicknames were also exposed, and 196 accounts had their passwords changed without authorization.

Microsoft says Volkswagen Group has brought Microsoft Copilot to more than 330,000 employees, embedding AI assistance across its business so teams can focus on higher-value tasks. “Super to see Volkswagen Group putting Copilot to work across the company,”