PHP2Shell exploited at a European government entity, Unit 42 says
Original title: PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
Palo Alto Networks Unit 42 said attackers abused PHP2Shell, CVE-2026-109618 and CVE-2026-109619, against a European government entity and then used agentic AI-style command batches for post-exploitation. CYFIRMA separately describes a moderate-confidence North Korea-linked scanning campaign against 216 PHP hosts from 21 nodes, and says exploitation of that set is still planned. Cloudflare reported millions of exploitation attempts after disclosure. The PHP Foundation has also warned of a third RCE, CVE-2026-115560, under unusual conditions.
Unconfirmed: Lazarus attribution is moderate confidence from CYFIRMA, and agentic-AI use is inferred from command markers rather than a named model.
- Unit 42 says password hashes and MFA secrets were accessed within two hours.
- Attackers opened an NTLM-relay tunnel into Active Directory and tried Domain Admin escalation.
- CYFIRMA attributes low-volume scanning to a Lazarus-linked operator with moderate confidence.
- Defused Cyber saw PHP2Shell probes against GlobalProtect honeypots from 204.76.203.7.
- ReliaQuest says a POST 500, PHP memory exhaustion, and an Apache worker crash can mark exploitation.
Impact: remote code execution, then password hashes and MFA secrets
| Product | Affected |
|---|---|
| PHP | — |
- 1.Watch for a POST returning 500, PHP memory exhaustion and heap corruption, then an Apache worker crash.
- 2.Treat government, finance, logistics, aviation, and transaction platforms in the named regions as in scope for scanning.
- Vendors
- PHP
- Threat actors
- Lazarus Group
- Victims
- European government entity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-115560 | — | — | PoC ×8 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 204.76.203.7 | works GlobalProtect honeypots. The activity originates from 204.76.203[.]7 , a known mass-exploit IP address. "The requests carry a |
From the original article
5 min read at thehackernews.com
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.