Microsoft: AI agent ARTEX breached 2,250 cloud tenants as PHP flaws took down Wikipedia

Microsoft said China-linked group Storm-0940 used an autonomous AI agent called ARTEX to brute-force ConnectWise credentials and sign into 2,250 corporate Microsoft 365 tenants at up to 2,900 attempts per minute. Separately, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) rated 9.2 prompted Wikipedia, the Internet Archive and Steam to take infrastructure offline while patching.

• ARTEX made up to 2,900 sign-in attempts per minute and hit 2,250 tenants in hours
• Targets spanned aerospace, defense and finance companies
• The PHP flaws are rated 9.2 out of 10 and affect roughly 70% of the web
• Gemini 4 Argon and GPT-5.6 Sol helped validate the PHP patch