The Hacker News reported on October 25 that Palo Alto Networks’ Unit 42 had seen attackers use agentic AI for post-exploitation after abusing the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619): against a European government entity, they reportedly reached password hashes and multi-factor authentication secrets within two hours and tried to escalate to Domain Admin. That account has since been withdrawn. Unit 42’s threat brief now says it “initially thought” the attack was related to PHP2Shell, that the target was a vulnerable PHP application, and that it is “unable to confirm that initial access is associated with the specific PHP2Shell CVEs.” Unit 42 retracted its October 23 update at 2:15 p.m. PT on October 25. The Hacker News article is dated the same day, so treat its agentic-AI and government-breach details as unconfirmed.
The other development in that report stands on its own. Security firm CYFIRMA published an advisory (version 3, dated October 24) describing what it calls a suspected North Korea-linked campaign. It says Korean-speaking operators have filtered a 216-host target set of unpatched or partially mitigated PHP hosts across government, finance, logistics, aviation, manufacturing and online-transaction sectors, and are running slow, low-volume checks from 21 compromised nodes. CYFIRMA attributes this with moderate confidence to an operator affiliated with the Lazarus Group ecosystem, based on a closed I2P channel, language usage and infrastructure overlap; that is the firm’s assessment, not a confirmed attribution. It also warns that nodes are rotated at the first sign of blocking, so threshold-based alerting may not catch it. Separately, The Hacker News cites Defused Cyber seeing PHP2Shell probes (marked p2s-rider) against its Palo Alto GlobalProtect honeypots. This follows our posts on the patch release, Amazon’s early-exploitation finding and the third PHP flaw.
How to check if you’re affected
Affected products are PHP installations older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 within their release branch (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0). Check the version with php -v or your hosting panel, and do the same for PHP inside container images.
- Patch, then restart all PHP workers so the old code is not still running.
- CYFIRMA says to treat any internet-facing PHP host still reporting an older version as a likely member of the operators’ target set.
- Hunt back from at least October 17 (Amazon’s earliest observed attempt); ReliaQuest’s reproduction points to a POST returning HTTP 500, PHP memory-exhaustion and heap-corruption errors, and a crashed Apache worker.
- Look in web logs for POST requests containing
PHP_SESSION_UPLOAD_PROGRESS.
Sources
- Unit 42 (Palo Alto Networks): Threat Brief, Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (updated Oct 25, with retraction)
- CYFIRMA: Threat Advisory, Suspected DPRK Campaign staging PHP2Shell targeting global PHP infrastructure
- The PHP Foundation: Today’s PHP security release
- Defused Cyber on X: PHP2Shell probes against GlobalProtect honeypots
- The Hacker News: PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking