PHP2Shell attackers target a European government entity

Palo Alto Networks’ Unit 42 reported that threat actors have been using agentic AI platforms for post-exploitation after abusing the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In one European incident, attackers targeted a government entity and, within two hours of initial exploitation, had access to password hashes and 2FA secrets, according to Unit 42. They also established an NT LAN Manager (NTLM) relay tunnel into Active Directory and attempted Domain Admin privilege escalation.

The attackers were observed enumerating the compromised endpoint, with command batches and behavioural markers described as indicative of an agentic attacker, including reconnaissance of authentication databases with stolen credentials and anonymous LDAP queries to the domain controller to locate administrator accounts.

CYFIRMA’s threat advisory linked the activity to a suspected North Korea–affiliated operation using PHP2Shell to probe global PHP infrastructure from 216 compromised hosts across the US, Japan, South Korea, and other regions, including government, banking, and logistics sectors. CYFIRMA noted the campaign has shifted from reconnaissance to active, low-volume scanning, with nodes rotated and abandoned at first signs of blocking, suggesting conventional threshold-based alerting may miss it.

The Lazarus Group ecosystem is cited as a possible attribution, supported by C2 infrastructure reuse and historical use of PHP/WordPress servers for C2 and shell deployments. Defences are further informed by corroborating observations from Defused Cyber and ReliaQuest regarding exploitation sequences and detection artefacts, alongside warnings from the PHP Foundation about an additional CVE (CVE-2026-115560) and updated mitigations. The report also notes global scanning activity and mass exploitation attempts across exposed PHP deployments.