{"data":{"id":"91509da2-6346-41b3-ab40-d88c1e10d589","title":"PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking","summary":"Threat actors have used agentic AI platforms for post-exploitation after abusing the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. In one case against a European government entity, attackers obtained password hashes and multi-factor authentication secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation, according to Palo Alto Networks Unit 42. CYFIRMA separately reports a suspected North Korea-linked campaign using PHP2Shell to scan 216 unpatched or partially mitigated hosts across government, financial, aviation and other sectors in multiple countries.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","publishedAt":"2026-10-25T17:19:46.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["PHP2Shell","Palo Alto Networks Unit 42","CYFIRMA"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-25T17:19:46.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}