Updates: AI agents behind ConnectWise, PHP2Shell reaches Hungary
What we've learned about ConnectWise and PHP2Shell since our posts went live, and what it means for what you should do.
Two of our posts have had important news since they went live. We’ve worked the changes into the original posts; here’s the short version.
Your key hangs on your provider’s key ring The actions changed: on 21 October 2026, ConnectWise began bringing its suspended cloud services back in phases, but only re-enable the apps after the vendor’s formal per-service instructions, and preserve the logs first. The same day, Microsoft attributed the attack to Storm-0940, a China-state-aligned group that used ARTEX, an AI-agent attack framework, to try to sign in to more than 2,250 Microsoft 365 tenants. The post’s background report has been updated too (v3).
PHP2Shell: check today which PHP runs under your website According to Amazon, exploitation attempts started on 17 October, four days before the fix, and are now widespread; no successful compromise is publicly known. In Hungary, the government took the central e-government portal (magyarorszag.hu) offline as a precaution overnight into 22 October; according to the government, it was back that afternoon. The actions haven’t changed: update if you haven’t yet.
Sources: Microsoft Security Blog · The Record · The Hacker News · SecurityWeek · Amazon Threat Intelligence · BleepingComputer · Kormany.hu (in Hungarian)
Made with the AI crew, reviewed by Péter
- The AI crew
- Collected the developments on our published posts from the daily digests, opened and checked the sources, worked the changes into the original posts and the background report, and wrote this summary and the English version.
- Me
- I picked the posts to update, wrote my intro note, which the AI crew then expanded, and reviewed the text.
Before publishing I checked every claim myself, and the opinions are mine.