The rapid advancements in artificial intelligence technologies are accelerating the digital transformation processes of organizations while also changing the nature of cyber threats. In particular, autonomous AI agents are making it easier for attackers to discover vulnerabilities, coordinate different attack phases, and carry out complex operations with less human intervention.
Recent research by Zscaler ThreatLabz reveals that AI-powered attacks are expanding globally, and critical software vulnerabilities are being exploited faster than ever before.
Two key developments stand out in the research published in October 2026:
- ARTEX-based AI-powered attack campaigns: Operations that utilize different AI models in a coordinated manner and target organizations in multiple countries.
- PHP2Shell vulnerabilities: Two critical vulnerabilities affecting the PHP architecture that could allow remote code execution (RCE) without requiring authentication.
These developments show that organizations should not only identify existing threats but also adopt proactive defense strategies that reduce the attack surface, prioritize vulnerabilities, and are based on a Zero Trust approach.
AI-Powered Cyberattacks Are Spreading Globally
Zscaler ThreatLabz’s research revealed that an attack campaign initially linked to financial institutions in South Korea extended to a much broader target audience.
The study found that the attackers leveraged different AI models through ARTEX, an open-source AI-powered penetration testing framework.
In operations using models such as DeepSeek, GLM, and Grok, as well as various AI coding assistants, it was observed that various tasks were distributed among the models and attack processes were coordinated.
How are attackers using artificial intelligence?
According to ThreatLabz findings, artificial intelligence was used in attack operations for three main purposes:
1- Automation of research and attack missions
Different artificial intelligence models were used in research and vulnerability investigation tasks related to target systems. This allowed multiple activities to be carried out in parallel.
2- Task validation among artificial intelligence agents.
The work of an AI agent was evaluated by another model. This approach demonstrated how multi-agent coordination could be used in attack operations.
3- Maintaining context and continuity in attack processes.
Session recordings and synchronization mechanisms allowed the results of previous research to be transferred between different agents and study sessions.
These methods can make certain attack activities, which traditionally required a high level of technical knowledge and time, more accessible.
Targets are not limited to Asia.
The investigation examined command histories and identified research requests directed to organizations in South Korea, as well as Japan, Canada, the United States, the United Kingdom, India, China, the United Arab Emirates, and many other countries.
The attackers’ instructions, which focused on personal data, phone numbers, financial transaction information, and the sale of the compromised data on illicit platforms, suggest that the operations may have been financially motivated.
These findings demonstrate that AI-powered attacks are not limited to any particular industry or geography, and that organizations need to update their threat models to reflect this new reality.
PHP2Shell: Critical PHP Vulnerabilities Pose a New Risk
On October 21, 2026, two critical security vulnerabilities affecting the widely used PHP operating system worldwide were publicly announced.
These vulnerabilities, known as PHP2Shell, are:
- CVE-2026-109618
- CVE-2026-109619
Both vulnerabilities have a critical severity rating of 9.2 in the CVSS v4.0 assessment.
Successful exploitation of these vulnerabilities can lead to remote code execution (RCE) without requiring authentication on servers using vulnerable PHP versions.
Why is PHP2Shell critical?
PHP is used in numerous enterprise web applications, servers, and embedded systems, as well as in popular content management and e-commerce platforms such as WordPress, Drupal, Joomla, and Magento.
Therefore, vulnerabilities affecting PHP’s core operating environment create a broad attack surface.
Potential security implications include the following:
- Server system compromise: Attackers can execute unauthorized code on vulnerable systems.
- Exposure of sensitive data: The seizure of corporate data and sensitive information stored in system memory.
- Identity compromise: Exposure of access credentials and session tokens.
- Lateral movement: The ability to use the compromised system to access other resources within the organization.
- Impact on business continuity: Increased risk of service interruption and operational disruption in critical applications.
How is AI changing the risk of attacks?
Artificial intelligence models can be used in security research as well as by attackers to analyze complex software vulnerabilities.
The PHP2Shell example demonstrates how advanced models can accelerate the process of investigating vulnerabilities and developing exploit scenarios for different application environments.
This means that the time between security vulnerabilities being publicly disclosed and being exploited by attackers could be further shortened.
For organizations, the critical point is not just identifying security vulnerabilities, but prioritizing and addressing them before attackers can exploit them.
Priority Steps for CISOs and Security Leaders
The increasing prevalence of AI-powered attacks and the rapid exploitation of critical security vulnerabilities necessitate a reassessment of organizations’ defense strategies.
1- Reduce the Attack Surface
Regularly evaluate applications, systems, and services that are accessible via the internet. Limit resources that attackers can discover by shutting down unnecessary access points.
2. Proactively manage security vulnerabilities.
Don’t just scan for vulnerabilities. Prioritize risks based on exploitability, asset criticality level, and business impact.
AI-powered Exposure Management solutions can help organizations identify critical risks faster and effectively manage remediation processes.
3. Promote the Zero Trust Approach
Apply the Zero Trust security model not only to remote access processes, but also to the entire digital infrastructure, including users, applications, workloads, and internal connections.
4. Utilize Segmentation and Deception Technologies
Network and application segmentation helps limit an attacker’s access to other resources in the event of a system compromise.
Deception technologies like Zscaler Deception can help make the activities of attackers and automated attack tools visible at an early stage.
5. Prepare Security Operations for the Age of Artificial Intelligence.
In an environment where attackers are gaining speed thanks to artificial intelligence, security operations also need to be more agile.
Security teams can enhance their response capabilities by leveraging automation in threat analysis, incident investigation, continuous risk assessment, and authorised security testing.
6- Update critical PHP systems.
It is crucial to urgently identify systems that may be affected by the PHP2Shell vulnerabilities and apply security updates.
The updated versions released by the PHP security team include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Organizations should check the update status of their PHP distributions and application infrastructures; for versions whose support period has ended, they should evaluate the security fixes provided by the manufacturer.
Cyberresilience is being reshaped in the age of artificial intelligence.
While artificial intelligence offers significant efficiency and innovation opportunities to organizations, it also enhances the skills of attackers.
Global attack campaigns based on ARTEX and PHP2Shell vulnerabilities reveal that traditional defense approaches alone may not be sufficient.
In this new threat landscape, reducing the attack surface, proactively managing vulnerabilities, implementing Zero Trust architecture, and employing AI-powered security operations are more important than ever for organizations.
Zscaler’s threat research and security solutions help organizations better understand these risks and develop strategies to protect their digital assets.