Unit 42: Attackers Reached Password Hashes and MFA Secrets at a European Government Within Two Hours of PHP2Shell Exploit

Since the PHP project shipped emergency releases on Oct. 21, the PHP2Shell flaws have gone from a patching race to documented break-ins. Three new developments landed between Oct. 23 and today, Oct. 25.

An intrusion that moved at machine speed

Palo Alto Networks' Unit 42 updated its threat brief on Oct. 23 with a specific case. Attackers exploited PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, against a government entity in Europe. Within two hours, Unit 42 said, they had reached password hashes and multi-factor authentication secrets.

They also set up an NT LAN Manager relay tunnel into Active Directory and tried to escalate to Domain Admin, according to Unit 42. The company has not said whether that escalation succeeded, and it has not named the agency.

Unit 42 says the commands and behavior point to an agentic AI attacker. Each batch of commands was wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==. Unit 42 said those delimiters produce machine-parseable output for an AI model to read. The attacker's identity is unknown.

The attacker also queried the authentication database with stolen credentials and ran anonymous LDAP queries with curl against the domain controller, looking for the administrator account.

A suspected North Korea-linked scanning campaign

Separately, security firm CYFIRMA said it found a suspected North Korea-linked campaign using PHP2Shell to probe PHP infrastructure from 21 compromised nodes. The targets are 216 unpatched or partially mitigated hosts across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia and the E.U. They span government, finance, logistics, airports and aviation, manufacturing and online transaction platforms.

CYFIRMA CEO Kumar Ritesh said the scanning is deliberately low-volume and paced. Nodes are rotated and dropped at the first sign of blocking, he said, so threshold-based alerting is unlikely to catch it.

CYFIRMA attributes the activity with moderate confidence to a Korean-speaking operator in the Lazarus Group ecosystem, coordinated through a closed I2P channel. That is one company's assessment, and moderate confidence is the company's own label. CYFIRMA said organizations in the targeted sectors and regions should assume they are in scope.

A third flaw the October 21 patches don't fix

The PHP project also published an informational advisory on Oct. 23 for a third remote code execution vector, CVE-2026-115560. The Oct. 21 releases do not fix it. The PHP security team describes it as reachable only under an unusual mix of configuration and application code. It is handling the fix in the regular release cycle rather than an emergency update.

The Oct. 21 releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both original bugs carry a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution. The PHP advisory singles out mod_php as the highest-risk setup, because a demonstrated exploit can trigger the attack before any application code runs.

The scale problem

PHP powers up to 70% of the world's websites, according to CBS News. Security researchers used an OpenAI model to find the flaws, Wall Street Journal reporter Robert McMillan told CBS.

The cleanup is moving unevenly. TokenCore CEO Kevin Surace said PHP developers first identified the underlying memory-handling issue in 2024. SC Media reported that the UK government took down 32 services. In Japan, Prime Minister Sanae Takaichi advised businesses to take systems offline and patch them.

Black Hills Information Security owner John Strand ran a Shodan query and found more than 150,000 systems advertising PHP versions that appear to fall in the affected range, including 7.x, 8.0 and 8.1. He called that a sign of potential exposure, not proof that each system is exploitable. He also said the aging-systems habit has to change: "Still working doesn't mean still secure."

Vicarius strategist Sagy Kratu said the patch is easy and finding where PHP runs is the hard part. He listed appliances in racks, portals untouched since 2019, contractor-built containers and trade-show WordPress sites. He also said watchTowr has confirmed that .ini workarounds do not block the flaws.

What ordinary users face

The consumer risk is indirect. Mediatech security head Voldemaras Kadys told CBS that visiting a PHP site does not by itself compromise a device. The danger is an attacker breaching a site that holds a person's name, address, email or birth date. Kadys said that a site being vulnerable does not mean a breach has happened. He said there is no reason to stop browsing or shopping online, but users should be wary of suspicious messages.

SentinelOne's Andrés Guerrero-Saade told CBS the gap between a patch being available and attackers exploiting it before anyone applies it is "the whole game." He said AI has shortened that gap.

Still open

The PHP team has not given a release date for the CVE-2026-115560 fix. Unit 42 has not said whether the European government network was fully compromised. Organizations running unpatched PHP, including legacy hosts that no emergency release covers, remain exposed to the two original flaws.