Attackers exploited the PHP2Shell security flaws and then handed control to agentic artificial intelligence platforms, which conducted post-exploitation operations with frightening speed and precision. In one documented incident, intruders breached a European government network and pulled password hashes and multifactor authentication secrets within two hours.
Security teams at Palo Alto Networks Unit 42 tracked the compromise and noticed an NTLM relay tunnel pointed at Active Directory. The operators then attempted to escalate privileges to Domain Admin. That sequence, researchers say, points to machine-driven attack workflows rather than manual keyboard work.
Command batches carried section headers such as ==SHELLUSER== and ==PASSWD==. Those markers produce output an AI model can parse automatically, a departure from traditional interactive hacking. The adversary first enumerated the authentication database with stolen credentials, then ran anonymous LDAP queries against the domain controller hunting for administrator accounts.
Host reconnaissance followed, covering DNS and Active Directory integration, internal systems, privileged groups, and interactive users. Unit 42 initially tied the intrusion to CVE-2026-109618 and CVE-2026-109619, but the company retracted that assessment in a later update. A spokesperson confirmed researchers still cannot verify whether initial access relied on those specific PHP2Shell vulnerabilities.
Meanwhile, CYFIRMA uncovered a separate low-volume scanning campaign likely linked to North Korean operators. Activity originated from 21 compromised nodes and targeted 216 unpatched or partially mitigated hosts across the United States, Japan, South Korea, Australia, India, the UAE, Saudi Arabia, and the European Union. Government agencies, banks, logistics firms, airports, and manufacturers all appeared on the target list.
The operation runs through a closed I2P channel. Two handles, 전창혁 2 and 최아린, previously surfaced in covert operations tied to the Lazarus Group ecosystem. Analysts noted the chat vocabulary matches Munhwaŏ, the North Korean standard dialect, and infrastructure overlaps with known Lazarus command-and-control assets.
As a result, defenders now face a dual challenge. The PHP2Shell flaws allow remote code execution under default PHP configurations, and nearly 37 million internet-facing systems run PHP or related software. Cloudflare logged millions of exploitation attempts after disclosure, while Bitsight emphasized that only updating PHP itself closes the gap. The PHP Foundation has also warned of a third vulnerability, CVE-2026-115560, expected to receive a patch in the next regular release cycle.
