PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor
Agentic artificial intelligence platforms have been utilized by threat actors for post-exploitation activities following the exploitation of PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. A government entity in Europe was targeted within two hours of initial exploitation, resulting in the acquisition of password hashes, multi-factor authentication secrets, and an NTLM-relay tunnel into Active Directory.
The attackers also attempted Domain Admin privilege escalation and conducted extensive reconnaissance of the compromised endpoint. The security indicators suggest the use of an agentic attacker, including commands for authentication database reconnaissance, Active Directory queries, host reconnaissance, and privileged group enumeration.
This attack comes on the heels of CYFIRMA's discovery of a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes across various sectors and geographies. The operators, attributed with moderate confidence to a Korean-speaking Lazarus Group ecosystem, have previously used the I2P channel for sharing target lists, exploit-hosting infrastructure, and tasking. Organizations in the prioritized sectors should assume they are in scope for deliberate targeting.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
