Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said.
"They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation."
The network security company said it also observed the unknown attacker enumerating the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker. These include commands to facilitate -
Reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets.
Active Directory (AD) reconnaissance via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account.
Reconnaissance of the host to hunt for DNS/AD integration, internal hosts, privileged groups, and interactive users.
"Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==," it added. "These delimiters produce machine-parseable output for an AI model to read."
Suspected N. Korea Campaign Targets PHP2Shell
The disclosure comes as CYFIRMA said it uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.
"The scanning is deliberately low-volume and paced," Kumar Ritesh, CEO and founder of CYFIRMA, told The Hacker News. "Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it."
The targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.
"The campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set," CYFIRMA said. "Organizations in the prioritised sectors and geographies should assume they are in scope for deliberate targeting."
The activity, coordinated via a closed I2P channel, has been attributed with moderate confidence to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem. According to CYFIRMA, the two handles (전창혁 2 aka Jeon Chang-hyuk 2) and (최아린 aka Choi A-rin) active in the I2P channel have previously been observed running covert operations for the threat actors.
"Korean-speaking operators have used [the channel] to share target lists, exploit-hosting infrastructure, and tasking and prioritisation consistent with DPRK objectives," Ritesh said. "The captured conversation uses vocabulary and spelling specific to North Korean (Munhwaŏ) rather than the South Korean standard."
Other primary indicators that link the campaign to the Lazarus cluster are below -
- Command-and-control (C2) infrastructure that Lazarus has previously used to exploit web assets.
- Lazarus Group's documented history of compromising PHP and WordPress servers for C2 and planting of PHP and ASP web shells, as observed in the SyncHole watering hole campaign.
- Prioritizing government agencies and banks, specifically online transaction platforms, which is in line with Lazarus Group's track record of breaching financial institutions for financial and cryptocurrency theft.
"Exploitation is the next step," CYFIRMA said. "The operators said they would shortlist the most promising targets the same day and then choose which public exploits to adapt."
Other Exploit Efforts and Mitigations
In an October 25, 2026, post shared on X, Defused Cyber said it's also seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots. The activity originates from 204.76.203[.]7, a known mass-exploit IP address.
"The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker ('p2s-rider') and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices," the threat intelligence company said.
Both CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities that can lead to remote code execution in default PHP configurations. The security flaws have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure.
"An attacker faces two main constraints: they must size a request to fail allocation at the right moment, and they must defeat ASLR to find valid memory addresses," Datadog said. "The exploit needs one field name small enough to fit inside the accepted request body but large enough that copying its key exceeds memory_limit."
"When PHP parses a form-field name, it makes several copies along the way. The attacker uses that extra memory to force an allocation failure while PHP copies the name into a hash table."
ReliaQuest, in an update published on October 22, 2026, said it reproduced CVE-2026-109618 in a controlled lab and observed a sequence of errors that could help defenders identify exploitation.
"This testing identified a specific sequence of artifacts across PHP error, Apache access, Apache error, and system logs that may help defenders detect exploitation," it said. "Defenders should focus on the sequence: a POST request returns a 500 error, PHP reports memory exhaustion and heap corruption, and the Apache worker handling the request crashes."
The PHP Foundation has since warned of a third remote code execution vulnerability (CVE-2026-115560), which can only "occur under an unusual combination of configuration and application code." The issue is expected to be addressed as part of the regular release cycle.
"An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start()," the Foundation said. "Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled."
Xint has released a scanner to check if a host is exposed to PHP2Shell, stating remote code execution is possible in any PHP script regardless of the application and in applications where decoding occurs, such as with session_start() and unserialize().
Bitsight's internet-wide scans show that there are nearly 37 million internet-facing systems running PHP or PHP-related software, with most of the exposures in the U.S., Germany, France, the Netherlands, and Japan.
"PHP runs a very large portion of the web, from content management systems and online shops to bespoke internal tools," Bitsight said. "A flaw in the runtime can't be repaired by changing application code, and a web application firewall or plugin update won’t remove it. Only updating PHP on the host itself closes the gap."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.