Hackers Running an AI Agent Got From PHP2Shell to a European Government's MFA Secrets Within Two Hours

Two hours. That is how long it took attackers to go from exploiting the PHP2Shell bugs to holding a European government entity's password hashes and multi factor authentication secrets, according to Palo Alto Networks' Unit 42. The researchers say the intruders were not typing commands by hand. They were running an agentic AI attack platform.

In the same window, the attackers set up an NTLM relay tunnel into Active Directory and tried to escalate to Domain Admin. Unit 42 did not say whether that last step worked, and it did not name the victim.

How Unit 42 spotted the machine

The giveaway was in the commands. Every batch was wrapped in section headers such as ==SHELLUSER== and ==PASSWD==. In Unit 42's words, "these delimiters produce machine-parseable output for an AI model to read." The tasks were short and spaced out one after another, and the attacker pivoted quickly whenever something failed.

Unit 42 calls those markers "strong indicators of an agentic attacker." Put plainly, Unit 42 believes a model was reading the output of each step and choosing the next one.

The bugs underneath

PHP2Shell is a pair of remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS 4.0. The first leaves request memory uninitialized when PHP handles out of memory errors, which lets attackers reliably trigger code execution. The second leaves global memory pointing at freed memory after a fatal error, which later requests can read or branch on. Fixes landed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

The PHP Foundation shipped those patches on Wednesday, October 21, after an embargo that gave large companies a head start. PHP runs around 70% of the web facing internet, from WordPress to MediaWiki, so banks, retailers, hospitals and some government agencies pulled servers offline to patch. Amazon said it saw exploitation from as early as October 17, about a week before the fixes. We covered how the flaws leaked and drew attacks before the patch was out.

The bugs were found by researchers at Calif during OpenAI and Wiz's Hack the Planet initiative. Calif said AI helped with exploitation, though most of the work rested on the team's own knowledge.

Few breaches, but fast ones

So far the internet has mostly dodged the worst case. As of late Friday, Palo Alto Networks and Trail of Bits had confirmed compromises and post exploitation activity, but nobody has reported mass exploitation. Cloudflare CEO Matthew Prince said exploitation attempts grew exponentially after disclosure, and Unit 42 says at least one European government took its website offline as a precaution.

The exposure is still enormous. Palo Alto's Cortex Xpanse counts more than 22.6 million exposed instances that are potentially vulnerable. Unit 42 urges patching immediately and has published hunting queries that look for commands spawned by PHP web worker processes.

The government case shows how little time defenders get. In Unit 42's account, two hours separated the first exploit from stolen MFA secrets and an attempt on the domain itself.

Some offers on this page may be paid placements or contain affiliate links.