Microsoft 与 CrowdStrike 报告 AI 代理驱动的攻击正在真实发生
AI 攻击从演示进入实战了：微软说有的组织 3 小时就被拿下云权限，阿根廷十几家医院中招，搞安全的都该看看。
Microsoft 报告 AI 代理攻击数百个组织，多起案例在 3 小时内获取特权云访问权限，并将 ConnectWise 入侵归因于同一组织。CrowdStrike 记录了 4 个运营者运行成功的 AI 代理攻击活动，其中一起入侵至少 15 家阿根廷医疗机构。PHP2Shell 项目借助 AI 将 PHP 旧漏洞转化为可用利用代码，Cloudflare CEO 称遭到数百万次利用尝试。同期 Railway、LiteLLM、Zeabur 相继披露安全事件，GitLab 修补了影响 12 年版本的最高严重级漏洞。
Whats happening right now is probably way worse than the Hugging Face incident.
AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws.
- Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group.
- CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations.
- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown.
- Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down.
- GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections.
Feels like a turningpoint.
