In a concerning development, hackers have leveraged agentic artificial intelligence (AI) to exploit PHP2Shell vulnerabilities, namely CVE-2026-109618 and CVE-2026-109619. This sophisticated approach has recently targeted a government organization in Europe, where attackers gained access to sensitive information such as password hashes and multi-factor authentication secrets within two hours of the breach.
AI-Driven Exploitation Techniques
Security experts at Palo Alto Networks Unit 42 revealed that the attackers established a relay tunnel into Active Directory with the intent to escalate privileges to a Domain Admin. The attack showcased advanced techniques suspected to be facilitated by AI, evident from the structured command batches and behavioral patterns observed during the breach.
These commands focused on probing the authentication database using stolen credentials, conducting reconnaissance of the Active Directory, and identifying critical components like DNS and AD integrations. Notably, each command batch was marked with delimiters to produce outputs that could be easily parsed by AI models.
Suspected North Korean Campaign
CYFIRMA, a cybersecurity firm, has linked the PHP2Shell exploitation to a broader campaign believed to be orchestrated by North Korea. This campaign involves probing global PHP infrastructures using compromised nodes, with a specific focus on unpatched hosts across multiple countries, including the U.S., Japan, and European nations.
The operation is characterized by low-volume, strategic scanning, evading traditional alert systems. The campaign is believed to be driven by actors associated with the Lazarus Group, known for its history of targeting financial and governmental institutions.
Global Probing and Mitigation Efforts
Cybersecurity companies like Defused Cyber have detected ongoing PHP2Shell probe activities targeting honeypots, indicating mass exploitation attempts. These efforts are marked by specific session upload markers, suggesting a systematic approach to identifying vulnerable systems.
Organizations are urged to implement robust defenses against these vulnerabilities, as highlighted by ReliaQuest’s findings on the exploitation sequences involving PHP errors and server crashes. The PHP Foundation has also reported additional vulnerabilities, stressing the importance of timely updates to PHP configurations to mitigate risks.
According to Bitsight, millions of systems worldwide run PHP or related software, underscoring the potential scale of exposure. The cybersecurity community continues to emphasize the urgency of updating PHP to close security gaps that cannot be addressed by mere application code changes.
