What happened
Threat actors are using agentic AI platforms to automate post-exploitation activities after exploiting critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Palo Alto Networks Unit 42 observed an attack on a European government entity where AI-assisted commands facilitated rapid access to password hashes, multi-factor authentication secrets, and Active Directory reconnaissance. Simultaneously, CYFIRMA identified a suspected North Korea-linked campaign using low-and-slow scanning to target unpatched PHP infrastructure globally.
Palo Alto Networks Unit 42 disclosed that threat actors utilized agentic AI platforms for post-exploitation following the abuse of PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. In a specific incident targeting a European government entity, attackers accessed password hashes and multi-factor authentication secrets within two hours of initial exploitation. They also established an NTLM-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.
Unit 42 noted that the attacker enumerated the compromised endpoint using commands with behavioral markers suggesting agentic operation. These included reconnaissance of authentication databases, Active Directory via anonymous LDAP queries, and host enumeration for DNS/AD integration. The commands were wrapped in section-header delimiters like ==SHELLUSER== and ==PASSWD== to produce machine-parseable output for an AI model.
Concurrently, CYFIRMA reported a suspected North Korea-linked campaign employing PHP2Shell to probe global PHP infrastructure from 21 compromised nodes. The scanning was described as low-volume and paced, with nodes rotated to avoid detection. Targets included 216 unpatched hosts across the U.S., Japan, South Korea, and other regions, spanning government, financial, and logistics sectors. The campaign was attributed with moderate confidence to the Lazarus Group ecosystem based on I2P channel activity and linguistic markers.
Defused Cyber reported seeing PHP2Shell probes targeting Palo Alto Networks GlobalProtect honeypots, indicating attackers are building target lists for specific devices. Cloudflare detected millions of exploitation attempts after public disclosure. ReliaQuest reproduced CVE-2026-109618 in a lab, identifying a specific sequence of log artifacts that can help defenders detect exploitation, such as POST requests returning 500 errors followed by PHP memory exhaustion and Apache worker crashes.
The PHP Foundation warned of a third remote code execution vulnerability, CVE-2026-115560, which requires a specific configuration combination to exploit. Xint released a scanner to check for PHP2Shell exposure, noting that remote code execution is possible in any PHP script. Bitsight scans show nearly 37 million internet-facing systems running PHP, with most exposures in the U.S., Germany, France, the Netherlands, and Japan.
Source details: thehackernews.com
Why it matters
This incident marks a significant operational shift in cyberattacks, demonstrating that AI agents can now execute complex, multi-step post-exploitation tasks with speed and that outpace traditional human operators. The use of machine-parseable output delimiters indicates a deliberate integration of AI into the attack lifecycle, reducing the time from initial compromise to domain administration. This lowers the barrier for sophisticated attacks, forcing defenders to adapt detection strategies to identify AI-driven behavioral patterns rather than just known malware signatures. The widespread exposure of PHP systems amplifies the risk, as AI can rapidly triage and exploit vulnerabilities across large networks.
The use of agentic AI in post-exploitation represents a qualitative change in cyberattack capabilities. By automating reconnaissance and privilege escalation, AI reduces the time required to achieve high-impact objectives, such as accessing domain administration, from days to hours. This speed advantage allows attackers to establish persistence and exfiltrate data before traditional detection mechanisms can respond.
The delimiters observed by Unit 42 indicate that attackers are designing their tools specifically to interface with AI models. This suggests a maturation of AI-assisted hacking, where the AI is not just a tool for generating code but an active participant in the decision-making process of the attack. This trend could lead to more adaptive and resilient attacks that are harder to detect using signature-based methods.
The widespread exposure of PHP systems, with nearly 37 million internet-facing hosts, creates a large attack surface for these AI-assisted exploits. The fact that the vulnerabilities can be exploited in default configurations means that many organizations are at risk without even realizing it. This underscores the need for rapid patching and improved monitoring of PHP environments.
The attribution of the scanning campaign to the Lazarus Group highlights the intersection of state-sponsored threat actors and emerging AI technologies. If state actors are adopting AI for offensive operations, it could lead to an arms race in cyber capabilities, with significant implications for national security and critical infrastructure protection.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
What to watch next
Monitor for AI-driven post-exploitation patterns in network logs, specifically looking for structured command outputs and rapid reconnaissance sequences. Organizations should prioritize patching PHP2Shell vulnerabilities and review their Active Directory security posture to mitigate the risk of automated privilege escalation. Watch for further disclosures regarding the attribution of the Lazarus Group campaign and the development of defensive tools to detect AI-assisted intrusions.
Defenders should monitor for AI-driven post-exploitation patterns, such as rapid sequences of reconnaissance commands and formats. Network detection and response (NDR) tools may need to be updated to identify these behavioral markers.
Organizations should prioritize patching PHP2Shell vulnerabilities and review their Active Directory security posture. This includes implementing multi-factor authentication, restricting NTLM relay, and monitoring for anomalous LDAP queries.
Watch for further disclosures regarding the attribution of the Lazarus Group campaign and the development of defensive tools to detect AI-assisted intrusions. Security vendors may release new signatures or heuristics to identify AI-driven attacks.
The PHP Foundation's warning of a third vulnerability, CVE-2026-115560, suggests that the PHP ecosystem may be under continued pressure from researchers and attackers. Organizations should stay informed about new vulnerabilities and apply patches promptly.