Unit 42 Says an Agentic Attacker Reached MFA Secrets Two Hours Into a PHP2Shell Break-In

Unit 42 Says an Agentic Attacker Reached MFA Secrets Two Hours Into a PHP2Shell Break-In

Two days after PHP shipped fixes for the PHP2Shell flaws, Palo Alto Networks’ Unit 42 described a break-in at a European government entity where the attackers appear to have used an agentic AI platform for the follow-up work. Within two hours of getting in, they had reached password hashes and multi-factor authentication secrets. The account was added Friday to Unit 42’s threat brief on CVE-2026-109618 and CVE-2026-109619, the two remote code ex…

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets,"

AI-assisted attackers breach European government via PHP2Shell

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach Attackers exploited the PHP2Shell remote code… Read more →

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application," a spokesperson for the company told The Hacker News via