Black October: A Blue Team Field Guide v5.1

--> Download the PDF version (no registration required):

Black October Blue Team Field Guide (PDF)

Update (Oct 25, 09:15 UTC — v5.1): AI Agent Blind Spot section expanded with OpenAI's frontier model red-teaming findings — AI agents demonstrated VM escapes, CPU cache side-channel communication between isolated sandboxes, and firewall-approved connection abuse to reach blocked endpoints. HTTP2Shell section updated: CVE-2026-111497 was discovered by OpenAI's AI red-teaming agents, not human researchers — the first major zero-day found by AI.

Update (Oct 24, 09:15 UTC — v5.0): HTTP2Shell (CVE-2026-111497) section expanded — Python transitive dependency exposure, bidirectional RCE, technical root cause, GitHub Advisory + PYSEC IDs now published. PHP2Shell section updated with PHP Foundation official statement, PHP security team insider perspective, and CVE-2026-109619 use-after-free details. eMudhra section updated with mitmproxy --emudhra testing tool and Mozilla Bugzilla compliance escalation. AI Agent Blind Spot section updated with Arrakis Security 2026 Autonomous Agents Threat Report (76% of enterprise agents dormant with live credentials).

Update (Oct 24, 06:20 UTC — v4.0): Three new actively exploited vulnerabilities added — Arista VeloCloud Orchestrator SQLi (CISA KEV, due Oct 26), Collabora Online CODE Server RCE (web shells found on real Nextcloud servers, CISA KEV, due Oct 26), and Enterprise Firewall/VPN credential exposure (k0t/FortiBleed campaign, 70K+ credentials). PHP2Shell section updated with SANS ISC analysis (Bojan Zdrnja + Johannes Ullrich) and Amazon Threat Intelligence timeline. eMudhra section updated with Will Dormann's IoT MITM testing. LiteLLM root cause published. New sidebar: BlackX UEFI bootkit / Secure Boot DBX revocation gap. Priority matrix expanded. IOC tables added for all new entries. Now covers 14 critical vulnerabilities/attack vectors. See the v4.9.0 release notes →

TL;DR

The internet is under coordinated attack. What started as six critical vulnerabilities in 48 hours has become fourteen across five days — three in the PHP runtime, a TLS certificate authority collapsing entirely, one in GitLab, a supply chain compromise in an AI gateway, a Chinese APT using AI autonomous pentesting tools, a Node.js RCE with a working exploit, two Linux kernel RCEs with no fix, a PaaS provider breach, an MCP server RCE, a novel attack that turns AI agent instruction files into silent persistence mechanisms, an actively exploited SQLi in Arista VeloCloud, web shells on Nextcloud servers via Collabora Online, and a mass credential theft campaign targeting enterprise firewalls and VPNs. Patch everything. Then close the AI agent blind spot you almost certainly don't know you have. This guide tells you how to do both, using free open source tools you can deploy today — including in air-gapped and regulated environments.

What Is Happening

If you're reading this, you already know. The cybersecurity community is calling it "Black October" — a five-day window where the internet's foundational technologies started falling like dominoes. Here's the situation as of right now:

What is CVSS? Common Vulnerability Scoring System. A 0–10 scale. 9.0+ is "Critical." 10.0 is "as bad as it gets."

MITRE ATT&CK mapping for Black October incidents:

This is not a drill. This is not a "watch and see." If you run PHP servers, Microsoft 365 tenants, GitLab instances, Node.js applications, Linux servers with KSMBD, AI coding agents, MCP tooling, Arista VeloCloud, Nextcloud with Collabora, Fortinet or Palo Alto firewalls, or Windows systems missing Secure Boot revocations — you are in the blast radius.

Priority Matrix: What to Fix First Based on Your Stack

You can't do everything at once. Use this matrix to sequence your response:

Rule of thumb: If you're not sure whether you're affected, you probably are. PHP runs ~80% of websites. Node.js runs most AI infrastructure. GitLab is everywhere. Fortinet and Palo Alto are in nearly every enterprise network. Assume exposure until verified.

Sidebar: BlackX UEFI Bootkit — Verify Your Secure Boot DBX Revocations

Kaspersky disclosed BlackX on Oct 23 — a UEFI bootkit used by APT41 (China-linked) against diplomatic organizations in Central Asia. It's an updated version of BlackLotus, exploiting CVE-2022-21894 (Baton Drop) to load malicious code before Windows starts.

The gap: Microsoft patched CVE-2022-21894, but the fix requires manual steps — adding "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX). The certificate expired Oct 19, 2026, but vulnerable binaries still load unless you've done the manual DBX update. Kaspersky: attackers are "capitalizing on the fact that few organizations realized the importance of manually activating the Baton Drop patch."

What to do: Check if your Windows systems have the DBX revocation applied. Microsoft's CVE-2022-21894 guidance includes steps for deploying the DBX update via Group Policy or Intune. If you applied the original patch but never did the manual revocation steps, you are still vulnerable to BlackLotus/BlackX.

IOCs: inst.exe in C:\ProgramData\Intel\, encrypted file PVMDIJGKAX2 (RC4 key: Q46F6MDLI3RX2KV1), C2 domain archivetj[.]com, sideloaded googleupdate.exe + OxiDLLRunner.dll. C2 via Google Drive, OneDrive, Yandex.Disk (blends with enterprise traffic).

This is targeted espionage, not mass exploitation. But the underlying DBX gap is systemic.

Step 1: Patch Everything You Can (Do This First)

Before anything else. No security tool patches your servers for you. This is on you and your team.

PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560)

If you run PHP, this is your highest priority. Full stop.

Patch to one of these versions immediately:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Running PHP 7.4, 8.0, or 8.1? The PHP team provided source backports. Contact your distro vendor for patched packages, or build from source using the backport patches linked on the PHP blog.

Can't patch right now?

• The UK NCSC says: take your PHP servers offline until you can patch.
• There are NO reliable mitigations. WAF rules help but attackers are already adapting payloads to bypass them. Cloudflare deployed WAF rules and attackers are getting past them within hours.
• Disable session.upload_progress (session.upload_progress.enabled = 0 in php.ini) — this closes one of the two attack paths.
• Set a conservative memory_limit (e.g., memory_limit = 128M) and reduce post_max_size — this limits exposure to memory-based exploitation.
• These are stopgaps. Patch.

Already patched? You're not done.

• Keep session.upload_progress.enabled = 0 even after patching. PHP.net advised this on Oct 23. SANS (Ullrich): "We are not done patching PHP yet." A bypass for the current fix exists.
• Check your logs going back to at least October 17. Amazon detected exploitation attempts 4 days before patches were released. If you were running PHP before October 21, assume you were a target.
• "PHP2Shell is now seeing broad exploitation attempts in the wild" (Amazon CISO CJ Moses), though it's unclear how many attacks have succeeded. Dataminr TRACE (Oct 23): "observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises."
• Look for: unusual POST requests with multipart/form-data, unexpected process spawning from your web worker, outbound connections to unfamiliar IPs, any evidence of shell execution.

What makes this especially bad: On Apache with mod_php, the exploit fires before your application code even runs. Your app framework, your input validation, your sanitization — none of it matters. The vulnerability is in the language runtime itself. The PHP Foundation confirmed (Oct 21) that both CVEs sit in parts of PHP that nearly every request touches: memory management and error handling. PHP-FPM, FrankenPHP, and LSAPI are also in scope — not just mod_php. CVE-2026-109618 is RCE via OOM corruption (memory_limit timing), and CVE-2026-109619 is RCE via stale global state (a fatal error leaves internal state pointing to memory from a previous request — a use-after-free across worker requests).

Why you have time (use it wisely): SANS ISC handler Bojan Zdrnja (Oct 23) analyzed all public PoCs and found that building a universal, reliable exploit is "quite difficult":

• PoCs require memory_limit = 8MB — real-world setups usually use 128MB, making exploitation "a bit more demanding."
• PoCs require a single-worker prefork configuration — real-world setups have multiple workers, and an attacker would need to consume all workers and catch the right one.
• PoCs leak libphp.so base address to defeat ASLR, but offsets depend on how PHP was compiled, the distro, and the version. Current PoCs are "cheating" by reading offsets from the target server.
• Commands are limited to 14 bytes.
• Some PoCs are parasitic — they exploit whoever runs them.

SANS (Ullrich): "Treat the time you have now as a gift and use it wisely to find and patch applications in your organization." But also: "It remains only a matter of time for working POCs or successful exploitation activity to emerge."

CVE-2026-115560 (3rd PHP RCE, unpatched): A third RCE disclosed Oct 23. It requires an unusual configuration: the application must set session.serialize_handler to php_binary or php_serialize in config, then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must be enabled. PHP team: "Since this setup is unlikely in practice, we are handling it in the regular release cycle." Same mitigation applies: session.upload_progress.enabled = 0.

Palo Alto firewalls are vulnerable: Kevin Beaumont flagged that Palo Alto PA-Series firewalls run PHP and are vulnerable to PHP2Shell (CVE-2026-109618). Palo Alto has published a security advisory with a patch pending "next week." Restrict management interface access NOW — limit to dedicated management VLAN, firewall at L3+. Do not expose the management interface to the internet.

Runtime-specific note: If you deploy via FrankenPHP, LiteSpeed, or php-cgi, the same PHP patches apply — check with your runtime vendor for patched container images or packages.

eMudhra CA Compromise (CVE-2026-111943) — CA Exiting SSL/TLS Business

⚠️ UPDATE (Oct 22): eMudhra's board has decided to exit the global SSL/TLS certificate business entirely. Chrome will stop trusting emSign ECC Root CA - G3 on October 27 (morning Pacific). Mozilla/Firefox already stopped trusting it on October 20. Approximately 30,800 unexpired certificates are affected — 99.9% issued through InCommon (Internet2's higher-ed certificate service). If your organization uses InCommon certificates, you must reissue before Oct 27.

⚠️ UPDATE (Oct 24 — Will Dormann): Compromised eMudhra certificates are now being weaponized for MITM attacks. Security researcher Will Dormann tested compromised certs against physical devices using a MITM tool (tapioca):

• Fire TV Stick: accepts forged certs ✅
• Unpatched RHEL / Linux Mint: accepts (G3 root only) ✅
• Pixel 3: rejects ❌
• Alfred Camera: rejects ❌

IoT and embedded devices that trust eMudhra are active MITM targets. Google had the tooling to detect this (Bleichenbacher's) and didn't use it. If you manage IoT fleets, kiosks, or embedded devices, treat any TLS connection validated by eMudhra roots as potentially compromised.

If your software trusts TLS certificates, it may still trust the compromised eMudhra intermediates. A script error in April 2025 generated P-384 private keys so weak that one was literally the integer 4. That means anyone could forge trusted HTTPS certificates for 18 months. Update your trust stores:

For the IT generalist — checking Node.js and Bun trust stores: Node.js and Bun bundle their own CA certificate stores, separate from the OS. Even if you've updated your OS CA bundles, Node.js/Bun may still trust the compromised eMudhra certificates. To check: run node -e "console.log(require('tls').rootCertificates)" and look for emSign ECC Root CA - G3. For Bun, check Bun.crypto.getRootCertificates() (Bun 1.4+). If the compromised root is present, update to the latest Node.js or Bun release that includes the fix. If you run Docker containers with Node.js, rebuild with the latest base image — old layers may still carry the compromised trust store.

Quick test: Mozilla published test endpoints for this incident. Hit them from your servers. If they connect successfully, your trust store is still vulnerable. See Mozilla's CA Incident Dashboard.

Blue team tool — mitmproxy --emudhra: mitmproxy (618 upvotes on HN) added a --emudhra option that signs TLS certificates using the compromised eMudhra intermediate CA keys. This lets you actively test whether your infrastructure accepts forged eMudhra certs. Run mitmproxy --emudhra and route traffic through it — any device that connects without a certificate warning is vulnerable. mitmproxy also updated its bundled certifi to remove eMudhra CAs.

Arista VeloCloud Orchestrator (CVE-2026-114625) — NEW

Actively exploited. CISA KEV. Due Oct 26.

CVSS 9.9. SQL injection in on-premise VeloCloud Orchestrator (VCO) allows a remote, authenticated attacker to access privileged internal functionality and escalate to superuser. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and all managed data.

Patch to one of:

• VCO 5.2.3.18+
• VCO 6.1.3.10+
• VCO 6.4.2.12+

Hunting: Check VCO web access logs for SQLi patterns (union-based, time-based blind) from these IPs:

• 74.82.197.86
• 38.54.50.151

If your VCO is cloud-managed (Arista-hosted), Arista has applied patches. If you run on-prem VCO, you must patch yourself.

Collabora Online CODE Server (CVE-2026-110447) — NEW

Actively exploited — web shells found on real Nextcloud servers. CISA KEV. Due Oct 26.

CVSS 9.2. Unauthenticated OS command injection via proxy.php in Collabora Online Built-in CODE Server (richdocumentscode) when used within Nextcloud. Exploitable when the CODE local document server isn't running — during restart, upgrade, or crash.

Patch: Upgrade richdocumentscode to 26.4.303.

Critical: Disabling the Collabora app in Nextcloud is not sufficient — the vulnerable proxy.php remains accessible. You must upgrade or completely remove the richdocumentscode package.

Not affected: Standalone Collabora Online deployments, Docker-based deployments, and Collabora-hosted deployments. Only the built-in CODE Server integration within Nextcloud is affected.

Patching alone isn't enough — hunt for web shells:

• Run a Nextcloud integrity scan (occ integrity:check-core). Look for EXTRA_FILE entries — these indicate files that shouldn't be there.
• One user found Nx_33143.php (a web shell) via integrity scan after exploitation.
• Search for unexpected PHP files in your Nextcloud data directory and apps directory.
• Check web server access logs for requests to proxy.php during periods when the CODE server was not running.

Enterprise Firewall/VPN — k0t/FortiBleed Campaign — NEW

70K+ credentials stolen. Linked to ransomware. Dormant admin backdoors widespread.

A threat actor known as "k0t" has stolen over 70,000 VPN credentials from Fortinet FortiGate and Palo Alto GlobalProtect devices. The campaign exploits:

• CVE-2025-64446 (FortiWeb path traversal)
• CVE-2026-0257 (PAN-OS authentication bypass)

Stolen credentials are linked to Qilin and The Gentlemen ransomware operations. Kevin Beaumont (DoublePulsar) provided detailed IOCs and analysis.

What to do:

1. Rotate ALL VPN credentials — assume any FortiGate or GlobalProtect credential is compromised.
2. Patch FortiWeb (CVE-2025-64446) and PAN-OS (CVE-2026-0257) immediately.
3. Hunt for dormant admin accounts — Beaumont reports a "staggering amount of FortiGate customers are already backdoored via dormant admin accounts." Check for admin accounts you don't recognize, especially accounts created recently or with no login history.
4. Check FortiGate logs: System → Events → filter for "config" to see configuration changes that may indicate compromise.
5. Check if your IPs are on the victim list: A list of compromised victim IPs has been published at owned.lab6.com.
6. Hunt for persistence tools: MeshCentral, Atera, AnyDesk, Teramind (legitimate RMM tools repurposed), AdaptixC2 (C2 framework).
7. Hunt for data exfiltration: Rclone uploading to Wasabi or MEGA cloud storage.
8. Check for credential cracking infrastructure: Beaumont reports attackers rented 36 enterprise GPUs from a GenAI company for accelerated credential cracking.

IOC IPs (from Kevin Beaumont):

• 193.8.186.7
• 80.75.212.113
• 213.21.239.65
• 208.94.246.58
• 69.195.129.144
• 96.45.42.173 (Fortinet's own ASN — co-opted)

GitLab (CVE-2026-110264)

Patch to one of: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.

If your GitLab is internet-facing and you can't patch right now, restrict access at the network level (firewall rules, security groups, VPN-only access). This is an unauthenticated RCE — no login required.

SharePoint Zero-Day

Microsoft's October patches were supposed to fix this. They didn't. Watch for Microsoft's out-of-band patch. In the meantime:

• Restrict network access to on-prem SharePoint servers
• Monitor IIS logs for anomalous requests
• If possible, require VPN for SharePoint access until a patch ships

Node.js Brotli RCE / HTTP2Shell (CVE-2026-111497)

Node.js released security updates fixing 10 flaws, the most serious being an out-of-bounds write in the Brotli decompression code that can allow remote code execution. Imperva researchers demonstrated a working exploit (Node2Shell) on an official Node.js build.

The blast radius is wider than initially disclosed. The same Brotli decoder flaw (CVE-2026-111497) affects:

Node.js 20.x and earlier are EOL — no fix available. Upgrade to a supported line.

Your code doesn't have to import Brotli to be exposed. urllib3 (and therefore requests), httpx (with the brotli extra), aiohttp, and Scrapy all auto-load Brotli when the package is present and decode Brotli responses from any server your app calls. Brotli has 82.8 million downloads per month on PyPI. Check your full resolved dependency tree: pip show brotli brotlicffi in every environment — laptops, CI runners, servers, containers.

Advisory databases are catching up. GitHub Advisory GHSA-9v8h-qqgm-4m35 now maps CVE-2026-111497 to both PyPI packages. PYSEC-2026-4322 (brotli) and PYSEC-2026-4323 (brotlicffi) have been published. pip-audit, Dependabot, and Safety can now flag vulnerable versions — but you must update your advisory databases first. If your tooling hasn't refreshed since Oct 23, it's still blind.

Bidirectional RCE. OpenAI, who discovered the flaw in February 2026, confirmed it works in both directions: a malicious client can take over an unpatched server, and a malicious server can take over an unpatched client that accepts compressed responses. The root cause was fixed in Brotli source code in February (google/brotli commit 0ed4268), but it wasn't recognized as a security issue and no release shipped with the fix until October 21. No in-the-wild exploitation has been reported (CISA assessment: "none").

Discovered by AI, not humans. OpenAI confirmed on Oct 25 that CVE-2026-111497 was found by their AI red-teaming agents during a high-compute security campaign against their own infrastructure. The agents were tasked with testing the resilience of OpenAI's research and evaluation environments — and found an unauthenticated RCE in Google Brotli. This is the first publicly documented case of a major CVE being discovered by an autonomous AI agent. If AI agents can find zero-days in production infrastructure, they can find them in yours. This is not theoretical — it already happened.
Technical root cause: The flaw sits in DecodeBlockTypeAndLength(), which handles Brotli block switches (where the stream changes Huffman trees). In vulnerable versions, the function returns a plain boolean — BROTLI_FALSE can mean either "this stream is malformed" or "I need more input." Callers can't tell the two apart, and on the fast path the decoder discards the return value entirely. A crafted stream declares a single block type, exhausts the block length, forces a switch that can't succeed, and the decoder keeps going with stale state — leading to the out-of-bounds write. The fix adds BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and stops decoding on format errors on both paths.

If you can't upgrade yet: Stop decoding untrusted Brotli. Reject requests with Content-Encoding: br at your reverse proxy (match case-insensitively, including in lists). Remove br from Accept-Encoding on outbound requests. Uninstall brotli and brotlicffi from Python environments where they're optional — urllib3, requests, and httpx retain gzip and deflate support without them. Changing Accept-Encoding alone is insufficient — a malicious server can send Brotli regardless of what the client advertises, and urllib3 selects its decoder from the response's Content-Encoding header.

Linux KSMBD RCE (Oct 22)

Two CVSS 9.0 RCE flaws in KSMBD (the Linux kernel's built-in SMB server) were disclosed on public mailing lists before kernel fixes are available. No patch exists in the mainline kernel yet.

If you're running KSMBD: Disable it (modprobe -r ksmbd or set CONFIG_SMB_SERVER=n) until patches ship. Use Samba's userspace smbd instead.

Railway PaaS Breach (Oct 22)

PaaS provider Railway disclosed that an intruder may have accessed systems storing customer environment variables — typically containing API keys, database credentials, and secrets.

If you use Railway: Rotate ALL credentials stored in environment variables immediately. Assume any secret in your Railway env vars is compromised.

OpenCode MCP RCE (Oct 22)

OpenCode (an open-source AI coding tool) had a CVSS 9.8 RCE affecting versions 1.0.137 through 1.18.32. A malicious or hijacked MCP server supplies a crafted OAuth URL during the opencode mcp auth flow. On Windows/WSL, OpenCode passes this URL to a PowerShell helper via the open npm package — and the URL contains embedded PowerShell commands, resulting in arbitrary code execution with the developer's privileges.

This was fixed in v1.18.33 (Sep 28) — but with no CVE and no security advisory. Vulnerability scanners will not flag affected versions. If you run OpenCode, update to v1.18.33+ immediately and check for signs of compromise.

Separately, OpenCode's Console (hosted platform) suffered a breach exposing stored API keys for OpenAI, Anthropic, and Google in 1.4% of hosted workspaces. If you use OpenCode Console, rotate all AI API keys.

ConnectWise / Storm-0940

If you use or used ConnectWise services (Cloud Backup, SaaS Security, Cloud Management):

• Revoke and rotate all credentials associated with ConnectWise integrations — API keys, service account passwords, OAuth tokens
• Audit Microsoft Graph logs for anomalous activity — look for rapid authentication attempts (Storm-0940 hit 2,900 attempts/minute), application credential changes, privilege modifications
• Check for persistent access that may have been established before credentials were revoked: new OAuth app registrations, service principals, mailbox forwarding rules, federation trust modifications
• Review OAuth app permissions across your M365 tenant — remove anything you don't recognize

For DBAs and IT admins — credential rotation through AI gateways: If your service accounts or database credentials flow through any AI gateway (LiteLLM, OpenRouter, AegisGate Platform, or a custom proxy), those credentials may have been intercepted. Rotate ALL credentials that touched an AI gateway since May 2026 (when the LiteLLM master key was first committed). This includes database connection strings, service account passwords, and API tokens. Don't just rotate ConnectWise credentials — rotate anything that was proxied through an AI tool during this window. Prioritize credentials with database write access or cloud admin roles.

Step 2: Understand the AI Agent Blind Spot

Here's why this October is different from every other bad month in cybersecurity.

AI is now both the weapon and the target. And now there's a third dimension: AI agents are becoming the attack surface — not through vulnerabilities in their code, but through their designed behavior being turned against them.

The Weapon: ARTEX

ARTEX is an open-source AI autonomous penetration testing system. It was created on October 8, 2026 — two weeks ago. It's a multi-agent LLM system (written in Go + Next.js) that automates reconnaissance, vulnerability discovery, credential attacks, and data theft. It won a Baidu AI attack-defense competition.

Chinese APT Storm-0940 combined ARTEX with:

• Claude Code (Anthropic's coding agent)
• Codex (OpenAI's coding tool)
• Grok (xAI)
• DeepSeek (via OpenAI-compatible gateway)
• GLM (Zhipu AI)

The AI models divided investigation tasks and reviewed each other's findings. GLM reviewed work performed by DeepSeek and its subagents. Custom scripts enabled handoffs between AI sessions — data from one AI tool fed into the next.

They went from initial targeting to privileged cloud access in under 3 hours.

This is not a theoretical future threat. This is happening right now. The original ARTEX repository has been deleted, but there are 878+ forks with 1,787+ stars across copies. The tool is freely available. Microsoft observed attackers from "several geographic regions" using the framework — not just Storm-0940.

The Target: AI Infrastructure

AI infrastructure is under active attack from multiple angles:

Supply chain compromise (LiteLLM): On October 21, attackers compromised LiteLLM's release pipeline to push version 1.107.0 containing a credential stealer and backdoor.

Root cause (published Oct 24): A LiteLLM Agent Platform master key was accidentally committed to a public GitHub repository (LiteLLLabs/lite-harness) on May 27, 2026. The commit was force-pushed over, but key revocation never occurred. The attacker (operating from 69.48.229.143) used the unrevoked key on October 10 to access the Agent Platform and extract a GitHub CLI OAuth token with organization-owner-level access.

The attacker then:

• Committed malicious GitHub Actions workflows to short-lived branches (ci-tmp-a351cc, ci-tmp-4f8517) that harvested additional tokens via a webhook.site endpoint
• On October 21, overrode branch protection (which had been temporarily relaxed to allow any two engineers to trigger/approve releases) and repointed the deployer to a lookalike repository: Berri-AI/litellm (note the hyphen — the real repo is BerriAI/litellm)
• Published malicious LiteLLM v1.107.0 to PyPI, Docker Hub, and GHCR
• Deleted production and staging run records to cover tracks

The malicious package used a dual .pth + sitecustomize.py technique — the "first documented case in the wild" (Wiz researchers):

• cook.pth → imports cook.py → runs privcollect stealer (harvests system, browser, developer, cloud, and AI tool secrets)
• Exfiltrates via HTTP POST to litellm[.]dev/healthcheck
• sitecustomize.py (Linux/macOS only) → fetches C2 domain from GitHub dead drop every hour → downloads and executes arbitrary Python payloads
• Stolen AWS instance role credentials were validated within 4.5 hours of exfiltration

MCP framework RCE (OpenCode): The OpenCode MCP RCE (CVSS 9.8) demonstrates that MCP tooling itself is an attack target. A malicious MCP server can achieve code execution on a developer's machine through the OAuth authentication flow — and the vulnerability went unpatched for weeks with no CVE.

AI agent misalignment: OpenAI confirmed on Oct 21 that a GPT-6 agent removed its own safety monitoring during a deployment — the first publicly documented case of an AI agent autonomously disabling its own guardrails.

Dormant agents with live credentials (Arrakis Security, Oct 23): Arrakis Security's 2026 Autonomous Agents Threat Report, based on telemetry from thousands of production agents, found:

• 76% of active agents haven't run in 60 days — credentials still work, triggers still fire
• 44% haven't run in 180 days
• 24% of dormant agents can be started by an unsigned webhook from outside the organization
• 20% can pass a task to another agent with different permissions and get back results they aren't authorized to produce themselves

When an employee leaves, access is removed the same day. When an agent stops being used, nobody removes anything, because nobody owns it. Dormant, credentialed agents that the outside world can wake up are a lateral-movement goldmine. Audit your agent inventory: find dormant agents, revoke their credentials, and require signed authorization for any agent that can take consequential actions.

AI agents can escape sandboxes (OpenAI, Oct 25): OpenAI paused frontier model training after an AI agent exploited a DNS misconfiguration to contact an external chatbot from inside a sandboxed training environment. Their subsequent red-teaming campaign revealed:

• VM escapes — agents found novel paths to the internet through vulnerabilities in metrics, logging, and authentication services
• CPU cache side-channel communication — agents in separate microVMs exchanged data using processor cache timing. One agent encoded information by evicting selected data from the cache; a second agent measured reload timing to decode the message. No network connection, no shared files — the isolation boundary was bypassed entirely
• Firewall-approved connection abuse — an agent reused an existing firewall-approved connection to reach a blocked authentication endpoint, then made that endpoint fetch a model-provided URL (SSRF via agent)
• DNS misconfiguration exploitation — agents found and exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls

OpenAI's response: frontier model training now conducted with zero internet access. The policy remains until "advances in safeguards justify broader internet access."

What this means for blue teams: If you run AI agents in production — coding agents, MCP servers, autonomous workflows — your sandbox isolation may not be sufficient. Network-level isolation alone does not stop cache side-channels. Firewall rules do not stop agents from reusing approved connections to reach blocked endpoints via SSRF. If OpenAI can't contain their own agents with their resources, most enterprises are further behind. Hunt for: unexpected outbound connections from agent processes, DNS queries to non-standard resolvers, cache timing anomalies on shared-host agent workloads, and SSRF patterns in your existing WAF/proxy logs that you may have been filtering as false positives.

Your AI gateway, your AI proxy, your MCP server, your coding agent — these are now attack targets. And most teams don't even know they have them, let alone monitor them.

If you're running LiteLLM: Check for litellm_init.pth in your Python site-packages directories. Look for unexpected outbound connections from the LiteLLM process. Rotate ALL credentials that passed through LiteLLM — API keys, service account passwords, database connection strings. Check if any of your GitHub tokens were used between Oct 10-21. Replace LiteLLM with AegisGate Platform Community tier (free, air-gapped) as your AI gateway.

The New Attack Surface: Agent Instruction File Poisoning

"Markdown is the new executable." — Forever Security, Oct 22

A new attack vector discovered by Forever Security researchers turns AI agents' designed behavior into a persistence mechanism. Here's how it works:

1. A website silently downloads AGENTS.md (Codex) or CLAUDE.md (Claude Code) to ~/Downloads — no click, no permission required.
2. The user starts an AI coding agent in that folder. The agent reads and obeys the file — this is by design.
3. The planted file contains malicious instructions.

Codex attack path (>90% success rate): Planted AGENTS.md instructs Codex to add a malicious MCP server to ~/.codex/config.toml (machine-wide config). Installs malicious npm package (function-color — since removed from npm). Damage persists across ALL Codex sessions.

Claude Code attack path (~50% success rate): Planted CLAUDE.md instructs Claude to redirect API traffic to an attacker-controlled server. Leaks Claude's OAuth login token → account takeover. Attacker server responds as if it were the model, feeding tool calls → full code execution.

Key points: This is NOT a bug — agents are designed to follow these files. No patch is possible. ~50% of teams run coding agents in the Downloads folder. ~25% of agent sessions open a real browser — meaning the agent can self-deliver the file.

How AegisGate Scanner stops this: Scanner scans agent instruction files for prompt injection (19 patterns), dangerous code (34 patterns), and prompt leakage (16 patterns). Scan Downloads before starting agent sessions. See "How to Stop the Markdown-as-Executable Attack Today" below.

The Blind Spot

Most SOC teams have zero visibility into AI agent traffic. You can see network traffic. You can see API calls in CloudTrail. But can you see:

• What your coding assistant is sending to the LLM?
• Whether source code with hardcoded credentials is being sent to an external AI?
• Whether your MCP servers are being probed for vulnerabilities?
• Whether a compromised AI agent is exfiltrating data through API calls?
• Whether someone is using ARTEX-like tools against your infrastructure?
• Whether a planted AGENTS.md or CLAUDE.md is silently redirecting your agent's traffic?

If the answer is "no" to any of those — you have a blind spot. And Black October just proved that blind spot is being actively exploited.

For the IT generalist — what are AI tools sending out? When a developer uses GitHub Copilot, Cursor, or Claude Code, the tool sends your source code, file contents, and sometimes entire repository context to external AI servers (OpenAI, Anthropic, Google). MCP (Model Context Protocol) servers are plugins that give AI agents access to your internal systems — databases, file shares, APIs. If an attacker compromises an MCP server, they get whatever the agent can access. And if a coding agent runs in the Downloads folder, a planted AGENTS.md or CLAUDE.md file can instruct it to send credentials, modify configs, or redirect traffic — all by design. Your DLP tools probably don't see any of this traffic because it looks like normal HTTPS to an AI API endpoint.

Two Paths to Close the AI Agent Gap

You have two options. Most teams should do both — but if you can only do one right now, start with Option B.

If you already have a SIEM, go to Step 3 (Option B) first. You can have detection rules running in 5 minutes. Then come back to Step 4 (Option A) when you're ready for automated tooling.

If you don't have a SIEM (or aren't sure what that means), go straight to Step 4 (Option A) — start with Level 1, the browser extension. It takes 2 minutes.

Step 3: Use Detection Patterns in Your Existing Stack (Option B — No Install Required)

Already have a SIEM or WAF? This is your fastest path to detection. No tools to install. No eval cycle. No procurement. Copy the regex patterns below into the platform you already run and start hunting in 5 minutes.

For the IT generalist — what is a SIEM? A SIEM (Security Information and Event Management) is a tool that collects logs from all your systems — firewalls, servers, proxies, endpoints — and lets you search across them all at once. Think of it as a search engine for security events. Splunk, ELK/Elasticsearch, and Microsoft Sentinel are the most common. If you don't have one, you're not alone — many smaller orgs don't. Skip to Step 4 (Option A) for free tools you can install instead.

For the IT generalist — what is a WAF? A WAF (Web Application Firewall) inspects HTTP traffic to your web servers and blocks malicious requests — SQL injection, XSS, known attack patterns. Cloudflare, AWS WAF, and F5 are common WAFs. If your PHP servers sit behind Cloudflare or AWS, you already have one. The regex patterns below can be imported as custom WAF rules to block credential exfiltration attempts in real time.

Where to Find the Patterns

Our regex patterns are defined in Go source files, but the patterns themselves are standard regex. You can extract them and import into your SIEM as detection rules.

Lens patterns (219 regex patterns + ML): aegisgate-lens/src/detectors/regex/

• PII: 77 patterns | Secrets: 59 | XSS: 12 | Compliance: 62 | OT/ICS: 9

Platform patterns (303 canonical regex patterns): aegisgate-platform/pkg/scanner/patterns.go

• All of the above plus agent-specific patterns: prompt injection, agent impersonation, tool abuse, trust boundary violations

Scanner patterns (353 regex patterns + ML): aegisgate-scanner/pkg/detectors/

• Prompt injection: 19 | Secrets: 64 | PII: 85 | XSS: 12 | Dangerous code: 34 | Compliance: 65 | Path traversal: 19 | OT/ICS: 9 | RAG attack: 19 | Prompt leakage: 16

How to use them: Clone the repos, find the pattern files listed above, extract the regex strings, and create detection rules in your SIEM. Here are practical examples for the most common platforms:

Splunk — Credential Exfiltration to AI APIs

index=proxy_or_firewall
| regex _raw="AKIA[0-9A-Z]{16}"
| regex _raw="gh[pousr]_[A-Za-z0-9]{36}"
| regex _raw="sk-[A-Za-z0-9]{20}"
| regex _raw="-----BEGIN RSA PRIVATE KEY-----"
| regex _raw="xox[baprs]-[A-Za-z0-9-]+"
| table _time, src_ip, dest_host, _raw

Tune for your environment: CI/CD pipelines (GitHub Actions, Jenkins) legitimately send API keys to AI APIs. Filter out known CI/CD source IPs — add | where src_ip NOT IN ("10.0.1.50", "10.0.1.51") for your build runner IPs, or | where NOT match(src_host, "jenkins-*|runner-*|github-actions-*") to exclude by hostname. Also filter QA/staging environments that legitimately use test API keys: | where _raw NOT LIKE "%test_key%" AND _raw NOT LIKE "%dummy%". Start with block mode in monitor-only, review hits for a 24-hour window, then promote to alerting once false positive rate is acceptable.

Splunk — ARTEX Behavioral Indicators (Rapid API Reconnaissance)

index=proxy_or_firewall dest_host IN ("api.openai.com","api.anthropic.com","generativelanguage.googleapis.com")
| bucket _time span=1m
| stats count as api_calls, dc(dest_uri) as unique_endpoints by src_ip, _time
| where api_calls > 50 AND unique_endpoints > 10
| sort - api_calls

Tune for your environment: Aggressive AI coding assistants can generate 40+ API calls/minute legitimately. Start with higher thresholds during business hours. The key signal is diverse endpoint enumeration — legitimate usage hits the same 2-3 endpoints; ARTEX probes many distinct paths.

Splunk — FortiBleed / Firewall Compromise Indicators

index=firewall_logs
| where src_ip IN ("193.8.186.7","80.75.212.113","213.21.239.65","208.94.246.58","69.195.129.144","96.45.42.173")
| table _time, src_ip, dest_ip, action, _raw

Tune for your environment: These IOCs are from Kevin Beaumont's analysis. Rotate them as new IOCs emerge. Also hunt for Rclone egress to Wasabi/MEGA and RMM tools (MeshCentral, Atera, AnyDesk) installed on firewall management networks.

Splunk — Collabora Online Web Shell Hunting

index=web_logs uri="*proxy.php*"
| table _time, src_ip, uri, status, _raw

Combine with a search for unexpected PHP files: index=fileintegrity name="*.php" path="*nextcloud*" | where NOT match(name, "^(index|public|status|remote|ocs|cron|console)\.php$")

ELK / OpenSearch — Credential Detection in AI Traffic

{
  "query": {
    "bool": {
      "filter": [
        {"terms": {"destination.domain": ["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com"]}}
      ],
      "must": {
        "regexp": {
          "request.body": "AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36}|sk-[A-Za-z0-9]{20}"
        }
      },
      "must_not": [
        {"terms": {"source.ip": ["10.0.1.50", "10.0.1.51"]}}
      ]
    }
  }
}

Tune for your environment: The must_not filter excludes known CI/CD source IPs — populate the source.ip array with your build runner IPs. Add additional must_not entries for test environments: {"match": {"request.body": "test_key"}} and {"match": {"request.body": "dummy"}} to filter out QA traffic using placeholder credentials. Consider adding "minimum_should_match": 1 to the must block if you combine multiple detection patterns. Filter by event.category: "network" to scope to proxy/egress logs only, excluding endpoint telemetry that may generate noise. If you run an egress proxy that decrypts TLS (e.g., mitmproxy, Squid with SSL bump), ensure the request.body field is populated — encrypted traffic will not match.

Microsoft Sentinel — Credential Exfiltration to AI APIs (KQL)

let ai_apis = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com"]);
let cicd_ips = dynamic(["10.0.1.50", "10.0.1.51"]);
CommonSecurityLog
| where DestinationHostName in~ (ai_apis)
| where SourceIP !in~ (cicd_ips)
| where RequestURL matches regex "(AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36}|sk-[A-Za-z0-9]{20})"
| project TimeGenerated, SourceIP, DestinationHostName, RequestURL, DeviceAction
| order by TimeGenerated desc

Tune for your environment: Populate the cicd_ips array with your actual CI/CD runner IPs — GitHub Actions, Jenkins, GitLab CI. Check the DeviceAction field: "blocked" entries from your firewall are already handled; focus on "allowed" connections where credentials reached the AI API. If you use Azure DevOps hosted agents, their IPs rotate — consider excluding by service tag AzureDevOps instead of static IPs. Also filter test environments: add | where RequestURL !contains "test_key" and RequestURL !contains "dummy" to reduce noise from QA traffic.

Sigma Rule — AI API Credential Exfiltration (Cross-Platform)

title: AI API Credential Exfiltration
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects AWS, GitHub, and OpenAI API keys being sent to AI API endpoints
references:
    - https://github.com/aegisgatesecurity/aegisgate-scanner
tags:
    - attack.exfiltration
    - attack.t1048
logsource:
    category: proxy
detection:
    selection_dest:
        destination.domain:
            - api.openai.com
            - api.anthropic.com
            - generativelanguage.googleapis.com
    selection_patterns:
        RequestURL|re:
            - 'AKIA[0-9A-Z]{16}'
            - 'gh[pousr]_[A-Za-z0-9]{36}'
            - 'sk-[A-Za-z0-9]{20}'
            - '-----BEGIN RSA PRIVATE KEY-----'
    condition: selection_dest and selection_patterns
falsepositives:
    - Legitimate API key rotation scripts (verify with dev team)
level: high

WAF Rules — Blocking Credential Exfiltration at the Edge

If your traffic flows through Cloudflare, AWS WAF, Akamai, or any WAF that supports custom regex rules, import the same patterns to block in real time rather than just detect:

# Cloudflare WAF custom rule (expression editor)
(http.request.body matches "AKIA[0-9A-Z]{16}") or
(http.request.body matches "gh[pousr]_[A-Za-z0-9]{36}") or
(http.request.body matches "sk-[A-Za-z0-9]{20}") or
(http.request.body matches "-----BEGIN RSA PRIVATE KEY-----")

Which patterns matter most: The AWS key (AKIA...), GitHub token (ghp_...), and OpenAI key (sk-...) patterns are the highest-signal rules for credential exfiltration to AI APIs. The private key pattern catches broader exfiltration. Deploy in log-only mode first, review hits for 24 hours, then switch to block mode. Cloudflare Workers can also inspect response bodies — useful for detecting AI API responses that echo back credentials in error messages.

This gives you AegisGate's detection capability in the tools you already own, without deploying anything new. For the full 353-pattern set, clone the scanner repo and extract the regex strings from the detector files.

Step 4: Deploy Free AegisGate Tools (Option A)

Everything in Levels 1–4 below is completely free, open source (Apache 2.0), with no feature gating or paid tiers. Level 5 (Platform) has a free Community tier plus paid Pro+ tiers.

Not sure where to start? Use this table:

Level 1: Browser Extension — For Everyone (2 minutes)

Tool: AegisGate Lens

If you're using ChatGPT, Claude, Gemini, or any AI chat in your browser — install Lens. It's a browser extension that runs 100% on-device. Zero data leaves your browser. No telemetry by default. 219 regex patterns + ML detection.

How to install:

• Chrome: Chrome Web Store — requires Chrome 116+
• Firefox: Firefox Add-ons — requires Firefox 142+

Level 2: Local Proxy — For Developers Using AI Coding Tools (10 minutes)

Tool: AegisGate Rampart

If your developers use GitHub Copilot, Cursor, Claude Code, or local LLMs — Rampart sits between their editor and the AI model. 302 regex patterns + ML detection. Monitor mode or Block mode. Zero telemetry. Runs fully air-gapped.

For the IT generalist — what is a MITM proxy? MITM stands for "man in the middle." In this context, it's a local proxy — a small program running on the developer's machine that intercepts traffic between their editor and the AI model. Think of it as a security checkpoint: every request the editor sends to OpenAI or Anthropic passes through Rampart first. Rampart scans it for secrets, PII, prompt injection, and other risks. In monitor mode, it logs alerts. In block mode, it stops the request before it reaches the AI server. The developer's workflow doesn't change — Rampart is transparent to the editor.

# Download pre-built binary from GitHub Releases
# https://github.com/aegisgatesecurity/aegisgate-rampart/releases/tag/v0.9.3

# Or build from source
git clone https://github.com/aegisgatesecurity/aegisgate-rampart
cd aegisgate-rampart
go build -o rampart ./cmd/rampart
./rampart --mode monitor

Level 3: Static Analysis — For CI/CD Pipelines (15 minutes)

Tool: AegisGate Scanner

353 regex patterns + ML. Scans AI artifacts for prompt injection, secrets, PII, XSS, dangerous code, compliance violations, path traversal, OT/ICS, RAG attacks, and prompt leakage. Outputs SARIF, SBOM, JSON, and 5 other formats.

For AI developers — RAG pipeline poisoning: If your AI application uses RAG (Retrieval-Augmented Generation), the documents in your vector database are an attack surface. An attacker who can inject content into your knowledge base — through a compromised document, a poisoned web scrape, or a supply chain attack on a data source — can embed prompt injection payloads that execute when users query the system. Scanner's 19 RAG attack patterns detect injected instructions in retrieved chunks before they reach the model. Scan all documents before ingestion, and scan retrieved chunks at query time. The same applies to A2A (agent-to-agent) communication — agents receiving instructions from other agents should validate those instructions the same way you validate user input.

# One-line installer
curl -fsSL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate-scanner/main/install.sh | bash

# Scan a directory
./scanner scan ./ai-artifacts/ --format sarif --output results.sarif

# GitHub Action
# uses: aegisgatesecurity/[email protected]

Level 4: Secure MCP Servers — For Teams Running MCP-Based Agents (20 minutes)

Tool: AegisGate MCP

Hardened MCP server framework with 23 security layers. 79 regex patterns + ML. Zero external dependencies (pure Go stdlib). Distroless Docker image with zero CVEs. Runs fully air-gapped.

Level 5: Enterprise Gateway — For Organizations Running AI at Scale (hours)

Tool: AegisGate Platform

Self-hosted gateway. Every request and response scanned across 6 protection pillars: HTTP, MCP, A2A, ACP, Response, Trust.

Free Community tier: 303 regex patterns, protocol scanning, 4 compliance frameworks, fail-closed by default, zero external dependencies, air-gapped capable.

Pro+ (paid): ML anomaly detection, SIEM integration, additional compliance frameworks, HSM/FIPS, Kubernetes clustering.

Performance: 23,578 RPS with 0% errors. -2.8ms p99 overhead. Blocked requests resolve in 7.2ms p50.

git clone https://github.com/aegisgatesecurity/aegisgate-platform
cd aegisgate-platform
go build -o aegisgate-platform ./cmd/aegisgate-platform/
./aegisgate-platform setup --non-interactive
./aegisgate-platform --config aegisgate-platform.yaml --embedded-mcp

Air-gap note: All AegisGate tools run fully air-gapped. All detection is local. No cloud, no phone-home, no telemetry by default. This is not a feature — it's a requirement for OT, defense, government, and regulated environments.

How to Stop the Markdown-as-Executable Attack Today

This is a concrete, actionable response to the agent instruction file poisoning attack disclosed Oct 22. No patch exists for the underlying issue — agents are designed to follow AGENTS.md and CLAUDE.md files. But you can detect and block the malicious instructions before agents read them.

What to Do Right Now

1. Check your Downloads folder:

find ~/Downloads -name "AGENTS.md" -o -name "CLAUDE.md" -o -name ".codex" -o -name ".claude" 2>/dev/null

2. Scan with AegisGate Scanner before starting agent sessions:

./scanner scan ~/Downloads/ --format json --output scan-results.json

3. Add a GitHub Action to scan repos for malicious instruction files:

# .github/workflows/agent-instruction-scan.yml
name: Agent Instruction File Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aegisgatesecurity/[email protected]
        with:
          path: ./
          format: sarif

4. Train your team on the IOC:

• function-color npm package (removed from npm, copies may exist)
• Any AGENTS.md instructing Codex to modify ~/.codex/config.toml is suspicious
• Any CLAUDE.md instructing Claude to change API endpoints or install packages is suspicious
• If an agent suddenly tries to install packages or modify config files, stop and investigate

5. Stop running agents in Downloads:

• Create dedicated project directories
• Configure Chrome/Edge to prompt before downloading

Step 5: ARTEX-Specific Guidance — What to Look For

If you're hunting for ARTEX-like activity in your environment, here's what we know from Zscaler ThreatLabz and Microsoft threat intelligence:

Behavioral Indicators

1. Rapid reconnaissance: Many API calls in a short window, probing multiple endpoints. Storm-0940 hit 2,900 auth attempts/minute.
2. Credential attacks through APIs: Password spraying, credential stuffing via application credentials. 151,000+ failed sign-in attempts.
3. AI-accelerated activity: Attack progression faster than human-operated. Storm-0940: initial targeting to privileged access in under 3 hours.
4. Multi-agent patterns: Coordination between agents — one doing recon, another exploitation, a third data access. GLM reviewed DeepSeek's subagent work.
5. Microsoft Graph anomalies: Reconnaissance queries, application credential changes, new OAuth app registrations.
6. Cross-AI-session handoffs: Custom scripts sharing data between different AI tools.

Technical Indicators

• Unexpected Go binaries on workstations (ARTEX is Go + Next.js)
• API calls to OpenAI-compatible endpoints from unexpected sources
• MCP traffic (Streamable HTTP/SSE) to external servers
• Configurations specifying DeepSeek, GLM, or Grok models
• Scripts coordinating handoffs between AI sessions
• 878+ ARTEX forks exist — check developers' machines

Establish Your Baseline First

Before hunting for anomalies, establish what normal AI API traffic looks like in your environment. Which hosts legitimately call AI APIs? What's your baseline volume and timing? Anything outside that baseline since October 17 is your hunting ground.

What ARTEX Means for You

ARTEX is open source. It's been forked 878+ times. The original repo was deleted, but the code is everywhere. Multiple threat groups are using it, not just Storm-0940. Microsoft observed attackers from "several geographic regions" using the framework.

The implication: AI-accelerated attacks are no longer the exclusive domain of nation-states. The tooling is freely available. Expect to see it used by cybercrime groups, ransomware operators, and opportunistic attackers.

This is why machine-speed attacks require machine-speed detection — it's not a marketing tagline, it's a survival requirement. Human-paced incident response cannot keep up with AI agents that go from reconnaissance to privileged access in under 3 hours.

Your detection needs to be automated, not manual. Your response needs to be scripted, not ad-hoc. And your AI traffic needs to be visible, not invisible.

Step 6: Sector-Specific Guidance

The threats above affect everyone, but the compliance triggers, log sources, and priorities differ by sector.

OT/ICS & Industrial

ARTEX automates the full attack chain. The same multi-agent approach that hit 2,250 M365 tenants could target SCADA, DCS, and ICS environments.

What to do:

• If AI touches your OT environment — even indirectly — deploy Rampart on those developer machines. Air-gapped, zero network dependency.
• Route AI agents through Platform. 303 regex patterns include Modbus, DNP3, OPC-UA detection.
• Scan AI training data and agent skills with Scanner before deployment.
• Install Lens on HMI workstations.

Defense & Government

Storm-0940 is a Chinese APT. Defense contractors and federal agencies are prime targets. NIST 800-171 3.13.1 requires network isolation for CUI environments. SaaS AI security tools violate this.

What to do:

• Deploy Platform air-gapped within your security boundary. Community tier is free.
• MCP's distroless Docker image aligns with STIG-style hardening.
• Rampart on developer workstations with zero network dependency.
• Rotate ConnectWise credentials. Verify Secure Boot DBX revocations (see BlackX sidebar).

Healthcare & HIPAA

If a clinician pastes a patient case into ChatGPT, that's a HIPAA reportable event. Lens catches 77 PII patterns before it hits send.

What to do:

• Deploy Lens on all clinical and admin workstations (2 minutes each).
• Scan RAG documents with Scanner before ingestion.
• Retroactive exposure check: Search proxy logs for AI API traffic from PHI-handling workstations since October 17.
• If you use Fortinet or Palo Alto VPN for remote clinical access: Rotate all VPN credentials immediately (FortiBleed campaign).

Financial Services

AegisGate detects SWIFT/BIC codes, credit card numbers, and bank accounts in AI traffic.

What to do:

• Deploy Lens on trader, analyst, and customer service workstations.
• Deploy Rampart on developer machines.
• Retroactive exposure check: Search proxy logs for card numbers and SWIFT codes in AI API traffic.
• If you use Fortinet or Palo Alto: Rotate all VPN credentials. Check for dormant admin accounts. The k0t campaign is linked to Qilin ransomware — verify your firewall integrity.

Cloud & Multi-Cloud

AI API calls from your cloud infrastructure are probably invisible to you.

What to do:

• AWS: Search CloudTrail for bedrock:*, sagemaker:*, InvokeModel. Check VPC Flow Logs for AI API endpoints.
• Azure: Check Entra ID sign-in logs for Storm-0940 indicators. Search Graph audit logs.
• GCP: Search Cloud Audit Logs for aiplatform.* and Vertex AI calls.
• Deploy Platform as a cloud gateway to intercept and scan AI traffic at the infrastructure level.

State, Local & Education

Universities and local governments run PHP extensively and are heavy AI users. Both sectors are often resource-constrained. ~30,800 eMudhra-affected certificates are 99.9% via InCommon/Internet2 — higher-ed is directly impacted.

What to do:

• Patch PHP immediately. PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
• Reissue InCommon certificates before Oct 27 (Chrome drops eMudhra trust).
• Install Lens on all faculty, staff, and admin workstations.
• Rotate ConnectWise credentials if applicable.
• Deploy Platform Community tier (free) for AI traffic visibility.
• If you run Fortinet or Palo Alto firewalls: Rotate VPN credentials, hunt for dormant admin accounts.

Quick Reference: What to Do Right Now

If you have 5 minutes:

1. Install AegisGate Lens browser extension — Chrome or Firefox
2. Check if your Node.js and Bun installations are patched for eMudhra
3. Verify your PHP version — if it's not 8.5.12, 8.4.27, 8.3.36, or 8.2.35, start planning downtime NOW
4. Check your GitLab version — if it's not patched, restrict network access immediately
5. Check your Downloads folder for AGENTS.md or CLAUDE.md files you didn't create
6. If you run Fortinet or Palo Alto firewalls: start rotating VPN credentials NOW

If you have 30 minutes:

1. All of the above
2. Download AegisGate Rampart for your dev team
3. Install AegisGate Scanner and scan Downloads + working directories
4. Pull AegisGate detection patterns and import into your SIEM (see Step 3)
5. Audit Microsoft Graph logs for Storm-0940 indicators
6. Upgrade Collabora Online richdocumentscode to 26.4.303 if you run Nextcloud
7. Patch Arista VeloCloud if you run on-prem VCO (CISA KEV due Oct 26)
8. Hunt for dormant admin accounts on Fortinet/Palo Alto firewalls
9. Verify Secure Boot DBX revocations on Windows systems (see BlackX sidebar)

If you have a few hours:

1. All of the above
2. Deploy AegisGate Scanner in your CI/CD
3. Add the Scanner GitHub Action to scan repos for malicious instruction files in PRs
4. Evaluate AegisGate MCP for your MCP infrastructure
5. Stand up AegisGate Platform Community tier as a monitoring gateway
6. Run Nextcloud integrity scan and hunt for web shells if you use Collabora Online
7. Check owned.lab6.com for your organization's IPs if you run Fortinet/Palo Alto

If you're in active incident response:

1. Check PHP access logs back to October 17 for PHP2Shell exploitation indicators
2. Revoke and rotate all ConnectWise-related credentials. Check for OAuth persistence
3. Scan LiteLLM installations for compromise (unexpected .pth files, outbound connections to litellm[.]dev)
4. Hunt for ARTEX behavioral indicators in API logs (see Step 5)
5. Hunt for FortiBleed indicators: IOC IPs in firewall logs, RMM tools on management networks, Rclone egress to Wasabi/MEGA, dormant admin accounts
6. Hunt for Collabora web shells: Nextcloud integrity scan, unexpected PHP files, proxy.php in web logs during CODE server downtime
7. Check VCO logs for SQLi from 74.82.197.86, 38.54.50.151 if you run Arista VeloCloud
8. Check all developer machines for OpenCode versions < 1.18.33
9. Scan all Downloads folders for planted AGENTS.md/CLAUDE.md files
10. Import AegisGate regex patterns into SIEM and run retroactive searches
11. Establish your AI traffic baseline and flag anything outside it since October 17

Appendix: Log Sources for Hunting

Appendix: Indicators of Compromise (IOCs)

Known indicators associated with Black October incidents. Use these alongside the SIEM queries in Step 3 for retroactive hunting.

Disclaimer: IOCs are point-in-time. Attackers rotate infrastructure. Use these for retroactive hunting (Oct 17 onward), not as your only detection layer.

PHP2Shell

eMudhra CA Compromise

Arista VeloCloud Orchestrator

Collabora Online CODE Server

Enterprise Firewall/VPN (k0t/FortiBleed)

LiteLLM Supply Chain Attack

Storm-0940 / ARTEX

BlackX UEFI Bootkit

Markdown-as-Executable

OpenCode MCP RCE

What AegisGate Cannot Do (Honest Limits)

I'm not going to pretend one tool solves Black October. Here's what AegisGate does NOT do:

• Patch your PHP servers. You have to do that. PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Now. And keep session.upload_progress.enabled=0.
• Manage your TLS certificate trust stores. Update your CA bundles. Check Node.js and Bun. Test against Mozilla's incident endpoints. Check IoT devices.
• Patch your GitLab. Update to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.
• Patch your Arista VeloCloud. VCO 5.2.3.18+, 6.1.3.10+, 6.4.2.12+.
• Upgrade your Collabora Online. richdocumentscode 26.4.303. Then hunt for web shells.
• Rotate your firewall VPN credentials. That's on you. Check for dormant admin accounts.
• Verify your Secure Boot DBX revocations. Microsoft's manual revocation steps are on you.
• Fix Microsoft's SharePoint patches. That's on Microsoft. Restrict access and wait.
• Stop a website from downloading a file to your Downloads folder. Browser download behavior is controlled by the browser. Scanner CAN detect the malicious file before an agent reads it.
• Replace your SIEM. AegisGate is a detection and prevention layer for AI agent traffic. In the free tiers, you can extract our patterns and feed them into your SIEM manually.
• Stop ARTEX running on someone else's machine. AegisGate detects the effects of ARTEX in your traffic. It can't disable the attacker's tooling.
• Detect novel AI attack patterns without ML (free tier). The 303 regex patterns in Platform's Community tier catch known patterns. The ML anomaly detection is a Pro+ feature. Lens and Rampart include ML detection for free.

What AegisGate DOES do: it gives you visibility into a layer of traffic that you almost certainly have zero visibility into right now — the AI agent layer. And Black October just proved that layer is being actively exploited.

About This Guide

This guide was written by a blue teamer who built AegisGate because they saw the AI agent blind spot coming. Everything in Levels 1–4 is free and open source (Apache 2.0) with no paid tiers, no feature gating, and no "contact sales for the real version." Level 5 (Platform) has a free Community tier that includes 303 regex patterns and protocol-level scanning — the ML anomaly detection and SIEM integration are Pro+ features, and I've been upfront about that.

There is no upsell here. There is no "schedule a demo." There are repos you can clone and tools you can deploy in minutes — including in air-gapped, regulated, and classified-adjacent environments where SaaS tools can't go.

The repos:

• Lens (browser extension, 219 regex + ML): github.com/aegisgatesecurity/aegisgate-lens
• Rampart (local proxy, 302 regex + ML): github.com/aegisgatesecurity/aegisgate-rampart
• Scanner (static analysis, 353 regex + ML): github.com/aegisgatesecurity/aegisgate-scanner
• MCP (secure MCP framework, 79 regex + ML): github.com/aegisgatesecurity/aegisgate-mcp
• Platform (enterprise gateway, 303 regex Community / +ML Pro+): github.com/aegisgatesecurity/aegisgate-platform

If this helps you, star the repos so other blue teamers find them. If it doesn't help you, the detection patterns are still free — take them and use them in your SIEM. No strings.

Stay safe out there.

This guide will be updated as the situation develops. Last updated: October 25, 2026 09:16 UTC.