Darktrace sees a 64% increase in zero-day attack signs

On 21 October 2026, Darktrace saw the most zero-day attack signs in six months, 64% above the data from before. A zero-day attack uses a flaw that the vendor did not repair. The increase came after two PHP flaws became known, but Darktrace cannot connect the two, and it saw no sign of a break-in.

What was seen

Two PHP flaws can let an attacker send remote commands with no login. Updates for items that contain PHP come from other vendors. Hundreds of addresses sent scans to find the flaws, and scans show only that an attacker looks at a system. To show a break-in, you must see signs, such as commands that are not usual.

AI in attacks

• Microsoft tells that Storm-0940, a state-aligned group from China, used ARTEX against hundreds of organizations.
• ARTEX is an open-source tool that uses many AI agents.
• Some attacks got access to the cloud in less than three hours.
• A response team in Japan tells that attackers used AI scans.

What is not known

Darktrace saw 65 sign-ins that did not work in about 20 minutes from an address that Microsoft found after that. This does not show ARTEX use or a break-in.

Insight: Finding flaws is fast, repair is slow

AI models helped find two PHP flaws that are in each release of the last ten years. ARTEX agents get cloud access in less than three hours. Darktrace tells that fast tools to find flaws do not remove the work to find the software, test repairs and complete them. This reads as a race where the two sides find flaws fast, and the slow step of repair sets the result. Monitor your repair time.