PHP2Shell, Agentic Attacks, CISA 2030

A long-standing PHP flaw affected almost 70% of websites and prompted government shutdowns and emergency patching. The Guardian led the PHP2Shell cycle. Cloudflare saw exploitation attempts rise from tens of thousands within 45 minutes to millions within two hours. Amazon later detected an attempted exploit four days before disclosure, extending the response window backward. The episode makes software inventory, pre-disclosure monitoring, and remediation ownership more important than patching alone. Axios, Bloomberg, CNBC, Inc., and The Hacker News also covered the story.

PHP2Shell is being framed as evidence that AI-assisted research is producing vulnerabilities faster than many organizations can remediate them. CNBC and Business Insider led that reading. PHP supports nearly 70% of websites, while one cited estimate found that 3% of all critical vulnerabilities ever discovered appeared in the preceding month. The coverage supports a shift from periodic vulnerability management toward continuous scanning, rapid patching, and stronger visibility into legacy infrastructure. The Guardian, The Globe and Mail, and The Hacker News also covered the story.

Microsoft attributed ConnectWise-related intrusions to Storm-0940, a China-aligned group using the ARTEX AI penetration-testing framework. The Record from Recorded Future News reported the campaign generated 2,900 sign-in attempts per minute and reached privileged cloud access in some cases within three hours. Cybersecurity Dive separately reported a threefold increase in agentic intrusions during the second half of 2026. The implication is that identity, managed-service, and supply-chain defenses must detect coordinated activity at machine speed. Cybersecurity Dive also covered the incident.

A ransomware ecosystem used commercial AI models, human-approved agents, and exposed remote-access systems. The Hacker News detailed the activity. Researchers recorded 8,257 messages across 133 sessions and estimated that 62 organizations were targeted, mostly in U.S. industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. The activity connects AI-enabled reconnaissance with familiar weaknesses such as reused credentials and exposed VPNs, reinforcing the need to protect recovery infrastructure as well as endpoints.

CISA introduced CISA 2030 with reviews due within 60 days, an implementation plan within 180 days, and progress reporting within 365 days. Cybersecurity and Infrastructure Security Agency CISA published the strategy. Separately, Accenture, Dragos, and SANS committed $10 million to support up to 500 under-resourced utilities with OT tools and training. These developments create a more practical resilience narrative, especially for critical infrastructure operators that lack staff and funding. The Record from Recorded Future News also covered the utilities commitment.

Compliance spending alone has not reduced human-driven risk. Harvard Business Review cited Verizon's finding that 62% of breaches involved a human element last year. TechRadar similarly centered identity hygiene and least privilege rather than AI branding. Together, the pieces suggest that cybersecurity messaging will resonate more when it links AI risk to concrete controls, ownership, and measurable resilience outcomes.

Cybersecurity stocks rose as investors connected AI-related threat growth with demand for security products. CNBC reported the Amplify Cybersecurity ETF rose 3.2%, while Palo Alto Networks, CrowdStrike, and Zscaler gained 7%, 5.2%, and 7.8%, respectively. This market narrative may support continued investment, but insurance data points to the cost of failure: large-business claims averaged $4.4 million in 2025, double the prior year. The Globe and Mail also covered the market move.