PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Summary

Threat actors have used agentic AI platforms for post-exploitation after abusing the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. In one case against a European government entity, attackers obtained password hashes and multi-factor authentication secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation, according to Palo Alto Networks Unit 42. CYFIRMA separately reports a suspected North Korea-linked campaign using PHP2Shell to scan 216 unpatched or partially mitigated hosts across government, financial, aviation and other sectors in multiple countries.

Related items

• HighCVE-2026-116176: vLLM server-side request forgery via X-Request-Id decode addressSimilar attack · NVD/CVE Database
• InfoOpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox CommunicationSimilar attack · The Hacker News
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSimilar attack · GitHub Advisory Database
• MediumGHSA-7xgj-8392-5q4r: FastMCP: Post-transform component authorization is skipped on direct callsSimilar attack · GitHub Advisory Database
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSimilar attack · GitHub Advisory Database