AI Tool ARTEX Linked to 91APP Breach in Black October Wave
Is this a scandal?
Not yet — an early signal. Noise 40/100, holding steady, across 1 source.
Regulators will likely mandate AI-specific security audits for third-party tools because the alleged misuse of open-source AI in critical infrastructure breaches demonstrates current patch management is insufficient against automated exploitation.
Noise 40/100 — louder than 98% of tracked AI controversies.
Why it matters
The alleged use of open-source AI for automated vulnerability exploitation signals a shift toward accessible, AI-augmented cyberattacks that outpace traditional patching cycles.
Key points
- 91APP confirmed a breach originating from an unpatched Appsmith tool where attackers allegedly used open-source AI tool ARTEX.
- CrowdStrike and GMO Cybersecurity found ARTEX on servers targeting South Korean and Japanese firms, though no attacker link is proven.
- Zeabur plans to shut down after exposing 3.2 million environment variables due to plain-text credential storage.
- Security firms Calif and Wiz used AI models to rediscover a decade-old PHP bug, prompting emergency government warnings.
- Cloudflare recorded hundreds of thousands of attack attempts within two hours of the PHP vulnerability disclosure.
- Observers call the cluster of unrelated incidents "Black October," highlighting the accelerating pace of AI-influenced cyber threats.
The story
Taiwanese e-commerce platform 91APP announced a compensation plan on October 22 after confirming a data breach involving order information but no credit card data. The company attributed the intrusion to an unpatched Appsmith admin tool and reported finding traces of ARTEX, an open-source AI vulnerability scanner, on attacker infrastructure. Security firms CrowdStrike and GMO Cybersecurity independently identified ARTEX in separate campaigns targeting South Korean and Japanese entities, though no link between attackers has been established. This incident coincides with other major breaches this month, including Zeabur’s exposure of 3.2 million credentials and urgent patches for a decade-old PHP flaw discovered via AI. Japan’s Prime Minister urged immediate updates after Cloudflare reported hundreds of thousands of exploit attempts within hours of disclosure. While defenders also leverage AI for bug detection, the convergence of these events has prompted observers to label the period "Black October," despite no confirmed connection between the individual incidents.
Who's involved
Attributed breach to unpatched third-party tool and offered compensation while disclosing alleged ARTEX usage by attackers
Confirmed presence of ARTEX on attacker-controlled servers in South Korea without attributing specific actors
Verified ARTEX usage in campaigns against Japanese companies independent of the Taiwan incident
Urged site operators to update systems immediately following the accelerated release of the PHP patch
Reported massive volume of exploit attempts against the PHP vulnerability shortly after public disclosure
How the conversation shifted
Polarity (0–100) from the noise pipeline, sampled over time.
Noise Level
The timeline
91APP announces compensation and ARTEX link
Platform detailed reimbursement plan and disclosed traces of AI attack tool on attacker infrastructure
PHP patch released early; PM issues warning
Update expedited after CVE leak triggered mass exploitation attempts globally
91APP confirms breach; Zeabur compromised
E-commerce platform verified data theft same day Zeabur exposed 3.2 million variables
91APP network intrusion begins
Attackers exploited unpatched Appsmith tool and accessed database keys via GitLab
Calif reports decade-old PHP bug found via AI
Security firm used OpenAI model to identify long-hidden vulnerability later patched urgently
The full record
Sources & methodology
- twitter.com — twitter.com
Every claim above traces to these primary items. How we score →
The forecast
Regulators will likely mandate AI-specific security audits for third-party tools because the alleged misuse of open-source AI in critical infrastructure breaches demonstrates current patch management is insufficient against automated exploitation.
Forecast, not fact — an editorial estimate we score when this resolves.
That's the complete picture as of — nothing more to know right now. We'll update this page the moment it changes.
Follow this story
We keep this page current — no need to check back. We'll send the next real change to your inbox, nothing else.
Tracking this story since October 23, 2026.
Join the Discussion
Discuss this story
Community comments coming in a future update
Be the first to share your perspective. Subscribe to comment.