Physix Frontier · News Briefing Card (enbrief · Nov 7, 2026)

Over 800 Artex pentest tool instances exposed online without passwords

KEY FACTS

Security firm Censys scanned and found more than 800 Artex instances accessible from the public internet without a password.
Artex is an open-source autonomous penetration testing tool that has been linked to multiple cyberattacks since its release in July 2026.
CrowdStrike said the September attacks on South Korea's financial sector were carried out by Chinese-speaking hackers using Artex.
In October, ConnectWise was attacked, and hackers used Artex to breach Microsoft cloud environments and steal data.
Artex has announced it is moving to closed source, but dozens of copies remain available on code-sharing sites.

KEY DATA

800+Exposed instances

July 2026Artex public release date

PHYSIX OBSERVATION

Open-source attack tools lower the barrier to entry, but the real risk lies on the deployment side: no authentication by default, weak passwords, and missing multi-factor authentication leave the attack infrastructure itself exposed first. This is a reminder to enterprises that misconfigurations are both an entry point for their own compromise and can turn their systems into a springboard for attacks on others. Moving to closed source can only slow proliferation; existing copies will remain active for a long time.

Source: enbrief original report ↗