AI-Assisted Attackers Hit European Government Via PHP2Shell While North Korea Quietly Builds a Target List
A European government body got compromised through the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, and the attackers wasted no time. Within two hours of initial access, they had pulled password hashes, MFA secrets, and established an NTLM-relay tunnel into Active Directory. Domain Admin escalation attempts followed shortly after.
Palo Alto Networks Unit 42 tracked the intrusion and noted something unusual about how the post-exploitation phase unfolded. The command sequences were wrapped in structured delimiters like ==SHELLUSER== and ==PASSWD==, which is not how humans typically operate. That kind of output formatting exists specifically so an AI model can parse the results cleanly. Unit 42 assessed the attacker was running an agentic AI platform to automate the exploitation chain, with the AI reading shell output and issuing the next command accordingly.
The reconnaissance activity itself was thorough: credential database enumeration, anonymous LDAP queries to domain controllers hunting for admin accounts, DNS and Active Directory mapping, and identification of privileged groups and active users. Systematic, fast, and clearly not someone typing commands one by one.
North Korea Is Quietly Watching
Separately, CYFIRMA has published findings pointing to a suspected Lazarus Group campaign using PHP2Shell to scan internet-facing PHP infrastructure globally. The operation is being run from 21 compromised nodes and has so far identified 216 unpatched or partially patched hosts across the US, Japan, South Korea, Australia, India, the UAE, Saudi Arabia, and several EU countries. Sectors in scope include government, financial services, logistics, aviation, manufacturing, and online payment platforms.
The scanning is deliberately quiet. Low volume, slow cadence, and nodes are rotated or dropped the moment they encounter rate-limiting or blocking. Threshold-based alerting is unlikely to catch it, which is rather the point.
Coordination is happening via a closed I2P channel. CYFIRMA attributes the activity with moderate confidence to Korean-speaking operators linked to the Lazarus ecosystem, citing two handles previously associated with DPRK covert operations. The language used in captured conversations is consistent with North Korean dialect rather than South Korean standard, which is a meaningful distinction.
The infrastructure overlaps with Lazarus C2 previously used to exploit web assets, and the targeting priorities align with the group's established pattern: government agencies, banks, and online transaction platforms. CYFIRMA says the operators have already discussed shortlisting the most promising targets and deciding which public exploits to adapt for the next phase. Reconnaissance has finished. What comes next is exploitation.
Honeypots and Widespread Scanning
Defused Cyber reported in late October that their Palo Alto GlobalProtect honeypots were also receiving PHP2Shell probes, originating from 204.76.203[.]7, an IP with a known mass-exploitation history. The requests included a PHP_SESSION_UPLOAD_PROGRESS marker labelled 'p2s-rider' alongside a dummy file upload carrying no payload. The interpretation is straightforward: someone is building an inventory of vulnerable Palo Alto devices before returning with something more damaging.
Cloudflare has logged millions of exploitation attempts since the vulnerabilities were publicly disclosed. The technical bar for exploitation is non-trivial but not prohibitive. Attackers need to size requests carefully to trigger allocation failures at the right moment and defeat ASLR to locate valid memory addresses. Datadog explained the mechanics: PHP makes multiple copies of form field names during parsing, and the attacker exploits that extra memory overhead to force an allocation failure mid-copy. It requires precision, but it is clearly achievable at scale.
ReliaQuest reproduced CVE-2026-109618 in a lab environment and documented a detection-friendly artifact chain. Defenders should watch for a POST request returning a 500 error, followed by PHP reporting memory exhaustion and heap corruption, culminating in the Apache worker crashing. That sequence, appearing across PHP error logs, Apache access logs, and system logs, is a reasonable indicator of active exploitation attempts.
A Third Vulnerability Joins the Party
The PHP Foundation has disclosed a third RCE vulnerability, CVE-2026-115560, though this one requires a fairly unusual configuration to trigger. Applications must be setting session.serialize_handler to php_binary or php_serialize and then switching it to php at runtime via ini_set() before calling session_start(), with session upload progress still enabled. Most applications will not meet that criteria, but those that do should be aware.
Xint has released a scanner to check host exposure. Bitsight's internet scans put the scale of the problem in perspective: roughly 37 million internet-facing systems are running PHP or PHP-adjacent software, with the heaviest concentrations in the US, Germany, France, the Netherlands, and Japan.
The uncomfortable truth here is that no amount of WAF rules or plugin updates fixes a flaw in the PHP runtime itself. The only actual remediation is updating PHP on the host. Given that PHP underpins a vast portion of the web, from CMS platforms to bespoke internal tooling, the attack surface is enormous and patching is not moving fast enough.