The Stack — October 23, 2026

Daily IT Briefing Cybersecurity

Security dominates again today. A China-attributed MSP supply-chain breach, a platform-wide secrets exposure, and the PHP2Shell fallout all point to the same theme: attackers are using automation and AI to move faster than defenders' timelines assume.

ConnectWise cloud backup breach used to reach ~2,250 organizations

Microsoft says China state-aligned attackers breached ConnectWise's cloud backup service. They stole application credentials that let them sign in to customers' Microsoft-hosted environments, including mail and files.

• Why it's severe: This is a classic MSP supply-chain pivot. A single vendor compromise produces valid credentials into thousands of downstream tenants, so the logins look legitimate.
• AI-driven speed:
• Microsoft says the attackers ran ARTEX, an open-source agent framework built for stress-testing defenses.
• That enabled close to 3,000 sign-in attempts per minute, which Microsoft says leaves defenders "little time to detect and respond."
• The same tooling was reportedly used in a recent compromise of South Korean financial systems, many of which lacked MFA.
• Status:
• ConnectWise has paused the backup service and is investigating.
• It was working to restore service as of Thursday.
• Caveats:
• Attribution comes from Microsoft. ConnectWise has not independently confirmed who the attacker is.
• Only one report covers this so far, so treat the details as preliminary.
• Action items for ConnectWise backup customers:
• Rotate the app registrations and secrets the backup integration used.
• Review Entra ID sign-in logs for anomalous service-principal activity.
• Enforce MFA and conditional access wherever the integration allows.

Railway: possible exposure of environment variables, all users told to rotate

The hosting platform Railway disclosed (dated Oct 21) that an unauthorized party may have accessed stored encrypted environment variables. In some cases the attacker also reached their decrypted contents, which can include API keys and database, cloud and registry credentials.

• Scope:
• Railway says initial analysis points to a "subset of users."
• Even so, it tells every user to rotate all environment variables and private registry credentials and to review service logs.
• Affected customers will be contacted by email.
• Operational impact:
• Deployments and builds are paused during the investigation.
• Reports differ on what that means in practice. One reading is that new deploys are blocked. Another describes hosted apps as effectively frozen.
• Check your own services rather than assuming either.
• Upstream response: Railway asked upstream providers to proactively revoke keys, so some integrations may break before you rotate them yourself.
• Unknowns: Railway has not disclosed how many users were affected, the root cause, or whether there was any ransom contact.
• Attribution and context:
• Railway believes the breach is part of a broader campaign against platform companies, aimed ultimately at AI inference providers. This is the company's own assessment and has not been independently verified.
• The coding tool OpenCode reported a similar breach this week. It says secrets from over 1% of customers were taken and calls it an "AI distillation attack."
• US authorities recently warned of large-scale intrusions by China-based AI firms seeking data to improve their models. That warning has not been formally tied to Railway.
• Some public explanations frame these attacks as malicious prompts that make AI systems leak data. That framing is loose and isn't backed by specific Railway findings.

PHP2Shell: exploited days before disclosure, now mass-exploited

Yesterday we covered the technical details: CVE-2026-109618/109619, CVSS 9.2, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Three things are new today.

1. Exploitation began four days before disclosure

• Amazon Threat Intelligence logged a honeypot exploitation attempt on Oct 17, from a commercial anonymization network.
• How the actor got pre-disclosure details is unknown. It's also unclear whether that attempt would have worked against real systems.
• Multiple PoCs and attempts from varied infrastructure appeared from about 02:00 UTC on Oct 21. That was hours before the 14:00 UTC embargo lift, which matches the 17:00 Moscow-time patch release reported elsewhere.
• Cloudflare separately reported seeing thousands of attempts before public disclosure, which corroborates the early activity.

2. Scale after disclosure

• Cloudflare's CEO said attempts reached hundreds of thousands within two hours of the announcement and "millions" by the morning of Oct 22.
• Microsoft's CEO called it a long day and night for security teams, unlike anything he'd seen in a long time.
• No major data breaches have been publicly confirmed so far.

3. Precautionary shutdowns worldwide

| Region | What was reported |

|---|---|

| UK | The BBC briefly took its site down. |

| Japan | Sega, Bandai Namco, MUFG, ANA, JR East, Nomura and Tokio Marine suspended services. The Ministry of Finance and National Tax Agency restricted their sites. |

| South Korea | The government put the private sector on cyber-threat alert. |

| Netherlands | Hospital and political-party sites went offline. |

| Finland and Netherlands | Government sites were restricted. |

| Germany and Austria | Some universities restricted their websites. |

| Russia | Many locally hosted sites went offline pre-patch. Bitrix24 and the host Beget restricted some features. |

Discovery narrative

• One account says the bugs were found and verified in late summer using OpenAI's model, reported as "GPT-5.6 Sol." It adds that PHP maintainers spent about two months on fixes and that OpenAI shipped a Codex "skill" to scan sites for exposure.
• This fits yesterday's reporting that frontier models were credited with turning the flaw into a working exploit.

Amazon's guidance

• Start incident investigations from the earliest observed exploitation (Oct 17), not the disclosure date.
• Measure patch SLAs for critical internet-facing systems in hours, not 7–30 days.
• Invest in detections that don't depend on CVE-specific signatures.
• Amazon attributes the shrinking patch-to-exploit window partly to AI-assisted patch diffing. That's plausible, but it offered no data to support it.

Remediation

• Upgrading PHP is the only complete fix.
• Stopgap: Block multipart uploads if you can't patch yet, after testing the impact on your app.
• Hunt:
• Look for POST form uploads containing `PHP_SESSION_UPLOAD_PROGRESS`.
• Watch for unexpected process execution or file changes on web servers.
• IOCs: The published IPs are shared anonymization infrastructure. Investigate matches instead of blanket-blocking them.

Tor: 333 exit nodes hijacked for three days

For three days this month, 333 Tor exit nodes were reportedly used to intercept traffic. The attackers targeted SSH sessions and tried to harvest plaintext email.

• Why exit nodes are a target: They see any traffic that isn't end-to-end encrypted once it leaves the Tor network.
• What was actually at risk:
• Email sent over unencrypted protocols was the most exposed.
• SSH interception only works if users click through or skip host-key verification warnings.
• Unknowns: It's unclear whether the nodes were taken over from legitimate operators or set up by the attackers. How much data was stolen is also unknown.
• Takeaway: Tor provides anonymity, not confidentiality. Always layer TLS and verified SSH host keys on top.

---

AI Industry DeepSeek reportedly raising ~$15B

The Chinese lab is reportedly raising about 100B yuan (~$15B), which would be one of China's largest rounds ever. The report came two days after the DHS order removing DeepSeek from federal civilian systems, which we covered Oct 21.

• Not confirmed:
• CATL and Tencent are named only as potential investors.
• DeepSeek hasn't commented.
• Funding history:
• June: more than $7B at a $50B valuation.
• July: reportedly sought another $1.5B at about $71B.
• A domestic IPO is possible as early as next year.
• Stated use of funds: AI infrastructure and open models for domestic and international markets.
• Ownership: Founder Liang Wenfeng, co-founder of the quant fund High-Flyer, reportedly holds about 81.6% of the operating entity, according to corporate ownership data.
• Other Chinese AI capital activity:
• Moonshot AI (Kimi): $2B at a $20B valuation in May.
• Manus: more than $500M this month.
• Zhipu (Z.ai) and MiniMax, both listed in Hong Kong in January: market caps of about $29B and $7.2B.

Anthropic's draft IPO prospectus: big headline loss, mostly non-cash

These figures come from press reports citing a draft prospectus and may change before any final filing.

Losses and revenue

• Net loss: $80.7B in H1 2026, versus $42B for all of 2025.
• About $72B of that is non-cash write-downs from revaluing convertible bonds and similar financing instruments.
• The operating picture is far less dramatic than the headline number.
• Revenue: $16.3B in H1 2026, up from $1.1B a year earlier.
• Most of it came from two customers.
• Anthropic expects a "limited" number of clients to keep supplying a "significant" share of revenue. That's a material concentration risk.

Compute and cloud commitments

• Compute spending: nearly $9B in H1, already above all of 2025 ($7.3B).
• Long-term cloud commitments: about $450B over 7–10 years.
• Google Cloud: ~$111B
• AWS: ~$110B
• Microsoft: ~$31B
• Up to $86B for Nvidia capacity through smaller AI-focused clouds

Risk factors

• They make up roughly a third of the document.
• They include real-world harm caused by models.
• They warn that a "catastrophic AI incident" could be too large to insure.
• They also cite growing local opposition to data center construction.

Anthropic launches Claude Duet (research preview)

Duet is a proactive background agent. Instead of waiting for a chat, it runs on its own cloud VM using apps you connect.

• Functions:
• A morning brief and alerts for inbox and calendar items that need attention.
• Drafted replies for your approval.
• Small-business tasks: chasing unpaid invoices, preparing payroll for review, readying contracts.
• Docs, decks and dashboards.
• Stack:
• Reportedly powered by Claude Opus 5.5.
• Reuses your existing Claude memory, skills and connectors in a single persistent thread.
• Has access to 6,000+ Marketplace connectors.
• Can buy through Stripe Link or Shopify Shop Pay, with approval required.
• Will not trade securities or move money between accounts.
• Safeguards:
• Requires approval before sending messages or making payments.
• Logins and approvals run in your own cloud environment.
• A new classifier screens messages for sensitive-data leaks.
• By default it declines requests for card numbers and government IDs.
• How visible its activity is:
• One report says you can view and steer what it does.
• Another notes that it doesn't show browser activity live and isn't suited to errands like booking tickets.
• Both can be true: you see task-level activity, not a live browser view.
• Availability:
• Waitlist for Pro and Max subscribers on iOS, Android and the web. One report says US-only.
• Team and Enterprise plans are excluded.
• Background checks count against usage limits, and large tasks consume more.
• Stated limitations: Anthropic says Duet may misread threads, misjudge urgency, or miss items between check-ins. Its capability claims haven't been independently evaluated.
• Competitors named: Meta Muse, OpenAI Dots, Hark, Instinct, Grok Bot and Fo.

OpenAI models coming to Google Cloud

OpenAI's latest models are expected on Google Cloud in the coming weeks. They will also be available inside Antigravity, Google's existing agentic development environment.

• Naming discrepancy:
• This report names them "GPT 6.1 Astra, Sol, and Luna."
• Coverage of the PHP2Shell discovery and earlier reporting refer to "GPT-5.6 Sol."
• Treat the exact version naming as unsettled until there's an official announcement.
• Missing details: Nothing yet on pricing, regions, or how the three variants differ in capability.
• Why it matters: OpenAI models running on a direct competitor's cloud is a notable shift in the multi-cloud model-distribution landscape.