AI Agents Hit 2,250+ Microsoft 365 Tenants as Japan's PM Urges Overnight PHP Patching
A Microsoft account relayed on X describes a China-aligned group scaling attacks with an open-source AI agent framework against thousands of cloud tenants, while two critical PHP flaws drew a prime-ministerial patch warning and a new default-on Cloudflare WAF. Console security also had a rough stretch, with PS5 firmware reportedly cracked eight hours after release and a Switch 2 exploit landing on the latest firmware.
Quick Hits
- @kimmonismus relays Microsoft's account of a China-aligned group that used an open-source agent framework to hit 2,250+ Microsoft 365 tenants after the ConnectWise breach, running 2,900 sign-in attempts a minute and reaching privileged access in under three hours in some cases.
- Two critical PHP flaws escalated into a national alert: per @himanshustwts, Japan's prime minister urged operators to apply a same-night patch, while @eastdakota says Cloudflare had to invent a new form of WAF for the bug class and enabled it free for everyone.
- Sony shipped a PS5 patch two days after an exploit demo, and hackers broke it again within eight hours, per @TheodoreGrek; @onejailbreak_ also reports a tethered Switch 2 jailbreak for firmware 23.0.1, the current latest.
- The eMudhra/emSign certificate incident keeps widening: @ThePSF published CA-update guidance for Python users, and @IzzatStatus says more very small private keys from the Indian CA have surfaced.
- @aakashgupta digests Marathon Fusion's claim of turning mercury into gold, arguing the real business is medical isotopes, where a single neutron can be worth billions of times the electricity it would produce.
Machine-speed attacks, and the playbook for answering them
The day's sharpest claim comes from @kimmonismus, who summarizes Microsoft's finding that a China-aligned group used an open-source agent framework against 2,250+ Microsoft 365 tenants after the ConnectWise compromise, at 2,900 sign-in attempts per minute, with privileged access achieved in under three hours in some cases. He frames it as one of the first publicly documented cases of a state actor scaling attacks with AI agents at machine speed.
His wider roundup is a grim list: Microsoft attributing the ConnectWise compromise to the same group, CrowdStrike documenting four operators running AI-agent campaigns (one hitting at least 15 Argentine healthcare organizations), PHP2Shell exploitation with Cloudflare's CEO reporting millions of attempts, Railway disclosing possible access to customer secrets, LiteLLM shipping a backdoored release, Zeabur confirming a breach and shutting down, GitLab patching a maximum-severity flaw spanning 12 years of releases, and Node.js fixing a code-execution vulnerability while Vercel deployed firewall protections. He calls it "probably way worse than the Hugging Face incident" and a turning point.
The supply side matters too. @jonnym1ller reacted to @abliteration_ai's release of an "abliterated" GLM-5.3 derivative (which the release ranks #3 on Terminal-Bench 4.0, behind only Opus 5 and Fable), stripped of refusals so it will do offensive cyber work. His take: "seems like this is essentially an open-source publicly available cyber weapon??"
On defense, @mattshumer_ calls @DassieSpivack's cloud-breach response thread required reading. Written from the perspective of a former cyber insurance adjuster, it says to assume exposure, rotate every secret immediately with timestamps to prove it, document obsessively including traces from agent-led investigations, and not wait for the provider's investigation before meeting your own customer-notification obligations. @astuyve shows the operational mood, asking on-call staff to sit on the incident call overnight and promising to "sound the CVE claxon as 0-days drop."
A patch night for PHP, defended by a new kind of WAF
@himanshustwts flags the unusual spectacle of @takaichi_sanae, Japan's prime minister, posting an urgent late-night request: two critical PHP vulnerabilities, a fix published at 11pm local time, and a suggestion that temporarily taking websites offline is a valid risk reduction if patching can't happen quickly. In @kimmonismus's roundup, Cloudflare's CEO reported millions of exploitation attempts against PHP2Shell, where AI reportedly helped turn longstanding PHP flaws into working exploits, though AI involvement in the mass attempts is unknown.
Cloudflare's answer, per CEO @eastdakota: "We had to invent a new form of WAF to mitigate this latest set of vulnerabilities," now enabled by default for all customers, free. @dok2001 explains the mechanics: the WAF now evaluates the request and the origin response together, with response rules blocking a match before it reaches the requester, for example an unauthenticated hit on /admin that comes back 200 text/html.
The alarm spread to DNS chatter, where @OmegaNekoSimp posted "NOW THE DNS HAS RCE" while quoting @akses_0x00 asking whether it is "time to turn the internet off yet." Neither post includes specifics, so treat the DNS claim as unverified panic rather than a disclosed flaw.
A certificate authority incident, and keys picked from 1 to 384
The eMudhra/emSign incident now reaches language-level trust stores: @ThePSF published guidance for Python users to update CA certificates in response to the incident. @IzzatStatus reports that more private keys from the Indian certificate authority have been discovered, all of them small numbers, with community speculation, explicitly unconfirmed, that someone interpreted "384-bit keys" as an instruction to pick integers between 1 and 384. Whatever the cause, the PSF's guidance to refresh CA bundles signals that trust in the affected chain is being pulled.
Consoles: two-day patches, eight-hour cracks
@TheodoreGrek lays out a compressed timeline: an exploit was demonstrated on PS5 firmware 14.10, Sony shipped 14.20 two days later to close the hole, and a hacker known as master_s9 showed an exploit for the brand-new firmware about eight hours after release. His verdict on Sony's staying power: less than a day. On the Nintendo side, @onejailbreak_ reports that Sammy Hajhamid released a tethered Switch 2 exploit that runs on firmware 23.0.1, the current latest. Both are enthusiast or tracker accounts rather than vendor confirmations, but together they show the patch-and-crack cycle now measured in hours.
Agents as builders, and the toolbelt around them
@unclebobmartin describes his current loop: talk the system over with agents, let them write the spec, have them build in an hour or two what would have taken him a week, then run his "crapper, dryer, and mutator checks," which surface dozens of bugs, oversights, and dead code while cleaning things up.
The showpiece came out of Berlin. @SubhoGhosh02 reacts to @NousResearch's account of Jensen Huang closing his GTC Berlin 2026 keynote with a Hermes Agent demo: Hermes was installed and customized in one prompt on an Nvidia RTX Spark, then used to build a simulated training environment for Hugging Face's Microduck robot. Per the post, Hermes planned an obstacle course with Nemotron, GPT-6 Astra built it using FreeCAD, Omniverse, Blender, Newton, and Isaac Lab, and thousands of simulated ducks were trained before the validated policy ran on the physical robot. @demian_ai's photo op with Jensen adds little detail but fits the Berlin backdrop.
The surrounding toolbelt thickens. @humansand announced Ampersand, a collaborator model it says helped users accomplish more in multi-month simulations than Fable and other frontier models, and @realy0usaf shipped pi-ampersand so it can follow along in a @pidotdev session and speak up when useful. @jurbed recommends Cloudflare's security-audit skill as model-independent and usable in any agent harness, claiming it finds issues even after model-based audits. @mattpocockuk shares a /grill-me prompt for pressure-testing whether a "software factory" setup fits your team. And @sqs relays @thorstenball's news that orbs can now be self-hosted, free for individuals and teams.
Practical Takeaway
The strongest theme is active, machine-speed exploitation colliding with a coordinated patch night. If you operate PHP anywhere, treat the overnight patch as urgent, and if you genuinely cannot apply it quickly, the temporary-shutdown option from the Japanese PM's message is the documented fallback. If you ship Python, refresh your CA bundle per the PSF guidance. And if any of your providers appear in the breach list, the sequence from @DassieSpivack applies: rotate every secret immediately with timestamps, document everything including agent investigation traces, and check your own contractual notification deadlines rather than waiting on the provider to finish investigating.
Sources
@flowirin @itsnebulalol This is 100% what happened https://t.co/t4xb5RUkcf
No one changes the world alone Introducing Ampersand - the first model built for us. Ampersand is a collaborator trained to help people achieve their individual and collective goals. In multi-month simulations, users collaborating with Ampersand accomplished more than with Fable and other frontier models Available to everyone through our API
皆様に、今夜に対応して頂きたい大至急のお願いです。 多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。 公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。 修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。 国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。 国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
The new capability that we built to help defend php2shell is live. The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched. https://t.co/BZOa7G7siI
Today we're releasing abliterated-model-large-v2. Based on GLM-5.3, which is #3 on Terminal-Bench 4.0 (behind only Opus 5 and Fable), with 2× the cyber exploitation of 5.2. We abliterated and hosted it so it does the offensive cyber, red teaming, and agent testing work other models refuse to do. - US-hosted - FP8 - 1 million context window - Zero input/output prompt retention Live now. 🧵
Jensen closed his GTC Berlin 2026 keynote with this Hermes Agent demo as the finale. He introduced it by saying the way to build an agent is to ask an agent to build it for you, so he installed and set up a customized Hermes in one prompt. Then he used Hermes, running on @nvidia RTX Spark, to create a simulated training environment for the @huggingface Microduck. Hermes planned an obstacle course with Nemotron and had GPT-6 Astra build it using FreeCAD, Omniverse libraries, Blender, Newton, and Isaac Lab. Hermes trained thousands of simulated ducks on that course until the validated policy was ready to run on the real robot in the physical world. At Nous, we believe open source is a practical tool as much as a philosophical ideal. It gives users the ability to build powerful, complex workflows chaining numerous local+cloud models, devices, and tools themselves instead of waiting for a company to enable them.
What to do when your cloud provider is breached, from a former cyber insurance adjuster: If your provider just disclosed a breach, you have to assume you've been exposed. And every instinct you have about what to do next is probably wrong. So here's what you should actually do: When you first hear about the hack, even if you doubt you were exposed, you need to get on it. Right away. I don't care if you're on a date, or at your son's college graduation. Get to a computer and start rotating every secret…everything. When someone asks later how fast you responded, you want the answer to be "immediately," with timestamps to prove it. You're going to want to put as little in writing as possible. I get the instinct. Do the opposite. Document everything, obsessively. If your provider has locked things down and you can't rotate something yet, write that down too, with the time you tried. If you're using agents to investigate (and you should be, spread wide across everything), keep every trace and make them write down everything they find. This will feel wrong in your soul. Do it anyway. If this ever turns into a claim, if you can show you did everything you were supposed to, minute by minute, you will survive. You might tell yourself it's just names and emails and nobody cares. But this is wrong. All customer data counts. I've watched companies lose millions just because someone could see data they shouldn't have. You're going to want to wait for your provider to finish investigating before communicating with your own customers. Don't. Figure out what information may have been exposed, even if you’re not sure yet who it belongs to, and what obligations you have under your contracts / applicable law. Your cloud provider’s investigation doesn’t change the fact that you have your own obligations to meet. And learning about a deadline after you’ve missed it is a very expensive lesson. Bookmark this. I hope you never need it, but with everything happening lately, there's a real chance you will.
You can now self-host orbs. It's free for individuals and teams. https://t.co/FSFcICRPZ0 https://t.co/DSXGjOGC85
Last month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10. Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years. Now, we’re building a fusion reactor in San Francisco to achieve record power density.
is it time to turn the internet off yet https://t.co/RLrPu79z8g
Whats happening right now is probably way worse than the Hugging Face incident. AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws. - Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group. - CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations. - PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown. - Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down. - GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections. Feels like a turningpoint.
