PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking - The Hacker News

The attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets.

They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.

The network security company said it also observed the unknown attacker enumerating the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker.

These include commands to facilitate reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets.

Active Directory (AD) reconnaissance was conducted via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account.

The attackers also reconnoitered the host to hunt for DNS/AD integration, internal hosts, privileged groups, and interactive users.

Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==, which produce machine-parseable output for an AI model to read.

AI-assisted attack campaign

The exploitation of the PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, is part of a broader campaign attributed with moderate confidence to a Korean-speaking operator affiliated with the Lazarus Group ecosystem.

CYFIRMA uncovered the suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.

The targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U.

The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.

The campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set, with the activity coordinated via a closed I2P channel.

The captured conversation uses vocabulary and spelling specific to North Korean (Munhwaŏ) rather than the South Korean standard, linking the operators to the Lazarus Group.

Other primary indicators that link the campaign to the Lazarus cluster include command-and-control (C2) infrastructure that Lazarus has previously used to exploit web assets, and its documented history of compromising PHP and WordPress servers.

Widespread exploitation and detection

In an October 25, 2026, post shared on X, Defused Cyber said it's also seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots.

The activity originates from 204.76.203[.]7, a known mass-exploit IP address, with requests carrying a PHP_SESSION_UPLOAD_PROGRESS marker ('p2s-rider') and a dummy file upload with no payload.

This points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.

Cloudflare stated it detected millions of exploitation attempts after the public disclosure of the critical vulnerabilities.

An attacker faces two main constraints: they must size a request to fail allocation at the right moment, and they must defeat ASLR to find valid memory addresses.

The exploit needs one field name small enough to fit inside the accepted request body but large enough that copying its key exceeds memory_limit.

When PHP parses a form-field name, it makes several copies along the way. The attacker uses that extra memory to force an allocation failure while PHP copies the name into a hash table.

ReliaQuest, in an update published on October 22, 2026, said it reproduced CVE-2026-109618 in a controlled lab and observed a specific sequence of errors that could help defenders identify exploitation.

Defenders should focus on the sequence: a POST request returns a 500 error, PHP reports memory exhaustion and heap corruption, and the Apache worker handling the request crashes.

Mitigation and exposure

The PHP Foundation has since warned of a third remote code execution vulnerability (CVE-2026-115560), which can only occur under an unusual combination of configuration and application code.

An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start().

Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.

Xint has released a scanner to check if a host is exposed to PHP2Shell, stating remote code execution is possible in any PHP script regardless of the application and in applications where decoding occurs.

Bitsight's internet-wide scans show that there are nearly 37 million internet-facing systems running PHP or PHP-related software, with most of the exposures in the U.S., Germany, France, the Netherlands, and Japan.

PHP runs a very large portion of the web, from content management systems and online shops to bespoke internal tools.

A flaw in the runtime can't be repaired by changing application code, and a web application firewall or plugin update won’t remove it. Only updating PHP on the host itself closes the gap.