Agentic AI accelerates PHP2Shell exploitation in global attacks

Threat actors are leveraging agentic artificial intelligence platforms to accelerate post-exploitation activities following the abuse of critical PHP vulnerabilities known as PHP2Shell. In late October 2026, security researchers observed these AI-assisted attacks targeting a European government entity, marking a significant shift in how quickly adversaries can move from initial access to privilege escalation.

What happened

Palo Alto Networks Unit 42 reported that attackers exploited CVE-2026-109618 and CVE-2026-109619 to gain initial access to a government system in Europe. Within just two hours of the initial breach, the attackers had accessed password hashes and multi-factor authentication secrets. They further established an NT LAN Manager relay tunnel into Active Directory and attempted to escalate privileges to Domain Admin level. The speed and precision of these actions suggested the involvement of automated, agentic AI tools rather than manual human operation alone.

Simultaneously, CYFIRMA identified a separate campaign linked to the Lazarus Group ecosystem, likely originating from North Korea. This group used the same PHP2Shell vulnerabilities to probe global PHP infrastructure from 21 compromised nodes. The scanning was deliberately low-volume and paced to evade threshold-based alerting systems. The targets included 216 unpatched hosts across multiple countries, spanning government, financial, and logistics sectors. The operators coordinated via a closed I2P channel, using handles associated with previous covert operations.

How it works

The PHP2Shell vulnerabilities allow for remote code execution in default PHP configurations by exploiting memory allocation failures. When PHP parses a form-field name, it creates several copies in memory. An attacker crafts a request with a field name sized to fit within the accepted body but large enough to exceed the memory limit during copying. This forces an allocation failure while PHP attempts to copy the name into a hash table, potentially leading to heap corruption and code execution. Defeating Address Space Layout Randomization is also required to find valid memory addresses for the exploit to succeed.

In the AI-assisted attacks, the post-exploitation phase was marked by specific behavioral indicators. The attackers issued commands wrapped in section-header delimiters like ==SHELLUSER== and ==PASSWD==. These delimiters create machine-parseable output, allowing an AI model to read the results and decide on the next steps. The AI agent performed reconnaissance on authentication databases, queried Active Directory via LDAP, and hunted for internal hosts and privileged groups, automating the traditional manual steps of an intrusion.

Key details

• CVE-2026-109618 and CVE-2026-109619 are critical remote code execution flaws in default PHP configurations.
• Agentic AI tools were used to parse command output and automate post-exploitation reconnaissance in under two hours.
• A suspected North Korean campaign used low-volume scanning from 21 nodes to target 216 unpatched hosts globally.
• The Lazarus-linked operators coordinated via I2P and used vocabulary specific to North Korean Munhwaŏ.
• Bitsight estimates nearly 37 million internet-facing systems run PHP, with major exposure in the U.S. and Europe.
• A third vulnerability, CVE-2026-115560, affects applications that change session serialize handlers at runtime.

Why it matters

For software engineers and IT leads, this incident highlights the dual threat of critical runtime vulnerabilities and AI-accelerated attack chains. The PHP2Shell flaws cannot be fixed by application code changes or web application firewall rules; they require updating the PHP runtime on the host itself. With millions of systems exposed, the window for patching is narrow, and the consequences of delay are severe, as demonstrated by the rapid compromise of the government entity.

The use of agentic AI changes the defensive calculus. Traditional detection methods that rely on spotting manual hacker behaviors may fail against AI agents that generate structured, machine-readable output and make autonomous decisions. Security teams must now consider how to detect not just known exploit signatures, but also the behavioral patterns of automated agents, such as the use of specific delimiters and rapid, sequential reconnaissance commands. This shifts the focus from perimeter defense to deeper runtime monitoring and anomaly detection.

What you can do

• Update PHP on all hosts to the latest version to patch CVE-2026-109618 and CVE-2026-109619 immediately.
• Monitor logs for the specific sequence of a POST request returning a 500 error, followed by PHP memory exhaustion and Apache worker crashes.
• Scan for the presence of section-header delimiters like ==SHELLUSER== in command outputs to detect AI-assisted activity.
• Review session configuration to ensure session.serialize_handler is not switched at runtime if not necessary, mitigating CVE-2026-115560.
• Implement rate-limiting and behavioral analysis to catch low-and-slow scanning campaigns that rotate nodes.
• Use tools like Xint’s scanner to check for exposure to PHP2Shell across your infrastructure.