Two days after PHP shipped fixes for the PHP2Shell flaws, Palo Alto Networks’ Unit 42 described a break-in at a European government entity where the attackers appear to have used an agentic AI platform for the follow-up work. Within two hours of getting in, they had reached password hashes and multi-factor authentication secrets.
The account was added Friday to Unit 42’s threat brief on CVE-2026-109618 and CVE-2026-109619, the two remote code execution bugs that make up PHP2Shell. Unit 42 said the intruders also set up an NTLM-relay tunnel into Active Directory and tried to escalate to Domain Admin. The brief doesn’t name the government body, and it doesn’t say whether the Domain Admin attempt worked.
How the researchers spotted a machine at the keyboard
The tell was in the formatting. Each batch of commands run through the web shell was wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, which Unit 42 said produce output an AI model can parse. The researchers also saw short, serially spaced tasks and quick pivots after failed steps, and called the pattern “strong indicators of an agentic attacker.”
Unit 42 has flagged that habit before. In a separate report on a government-focused campaign it tracks as CL-UNK-1211, with activity from October 2025 to April 2026, it listed section headers in scripts and shell commands among the traits it considers consistent with AI-operated attacks, alongside heavy use of Base64-encoded commands.
Elsewhere, defenders mostly see failed attempts
Other defenders were reporting something different at the end of the week. CrowdStrike wrote Friday that it had not seen successful exploitation in the wild or in its honeypots, only testing, probing and failed attempts. The PHP Foundation’s executive director, Elizabeth Barron, told The Register the same day that the foundation had no evidence of exploitation on patched PHP versions.
Part of the reason is the quality of what’s circulating. Mandiant CTO Charles Carmakal said in a LinkedIn post, quoted by The Register, that many public proof-of-concept exploits “appear to be ‘vibe-coded’” and can’t achieve remote code execution, though Mandiant validated some that work against default mod_php deployments, but not PHP-FPM. By late Friday, TechCrunch’s Zack Whittaker reported, Palo Alto Networks and Trail of Bits had confirmed compromises and post-exploit activity tied to the bugs.
The pool of possible targets is large. Unit 42 said its Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to the two CVEs, and that at least one European government took its website offline as a precaution. Amazon had already said at least one attacker tried to exploit PHP2Shell on Oct. 17, four days before the flaws went public. For teams that want to look back through their own logs, Unit 42 added XQL hunting queries to the brief, with a warning that they also catch other web application exploits and can return false positives.
Patching, plus one setting to change
The fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which PHP released on Wednesday. The Dutch National Cyber Security Centre’s tracking page warns that PHP also runs inside appliances, network devices, management interfaces and other vendor products where administrators may not be able to update it directly, so those depend on vendor patches.
There is also a third flaw, CVE-2026-115560. Barron told The Register it “requires a very unlikely combination of configuration and specific PHP application code,” and the foundation plans to ship the fix with the next regular PHP release. Until then, an informational advisory published Friday tells users to set session.upload_progress.enabled=0.