PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

What happened

Threat actors have been observed using agentic (AI that carries out multi-step tasks rather than answering one question) artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 (the public catalogue number for a specific software flaw) and CVE-2026-109619. PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking  Ravie Lakshmanan  Oct 25, 2026 Vulnerability / Artificial Intelligence Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.

The network security company said it also observed the unknown attacker enumerating the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker. "Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==," it added.

"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor (a second proof of identity beyond the password) authentication secrets," Palo Alto Networks Unit 42 said . "They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation (gaining powers on a system that the user was not given)."

These include commands to facilitate - Reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets. Active Directory (AD) reconnaissance via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account.