Ethical Hacking News
Recent exploits targeting PHP2Shell vulnerabilities have highlighted the severity of the issue. A nation-state espionage operation has been linked to the exploitation of these vulnerabilities, with attackers using agentic artificial intelligence platforms for post-exploitation activity. The operation targets global PHP infrastructure from compromised nodes, highlighting the importance of ensuring PHP applications are patched and up-to-date.
Palo Alto Networks Unit 42 has revised its assessment on a European government agency attack, initially linking it to PHP2Shell vulnerabilities, but later concluding the attackers used agentic AI platforms. The attackers exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and accessed password hashes, multi-factor authentication secrets, and established an NTLM-relay tunnel. Attackers enumerated the compromised endpoint, targeting authentication databases, password hashes, and two-factor authentication secrets. A suspected North Korea-linked campaign is using PHP2Shell to probe global PHP infrastructure from compromised nodes. The campaign has moved from reconnaissance to active, low-and-slow scanning of a filtered target set, with organizations in prioritized sectors and geographies in scope. Defused Cyber has reported seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots. The PHP2Shell vulnerabilities are critical and have witnessed widespread scanning efforts, with Cloudflare detecting millions of exploitation attempts.
In a recent update to its threat intelligence, Palo Alto Networks Unit 42 has revised its assessment regarding the post-compromise activity targeting a European government agency. Initially, the company believed that the attack was related to the exploitation of PHP2Shell vulnerabilities, but it has since retracted this assessment. According to Unit 42, the attackers targeted a government entity in Europe, but the initial access was not associated with the specific PHP2Shell CVEs.
However, the company still notes that the attackers used agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In one case, the attackers successfully accessed password hashes and multi-factor authentication secrets within two hours of the initial exploitation. They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.
Furthermore, the attackers enumerated the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker. These commands included reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets. Active Directory (AD) reconnaissance via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account was also observed.
The attackers also conducted reconnaissance of the host to hunt for DNS/AD integration, internal hosts, privileged groups, and interactive users. Each command batch was wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==, which produced machine-parseable output for an AI model to read.
In a related development, CYFIRMA has uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes. The scanning is deliberately low-volume and paced, with nodes being rotated and abandoned at the first sign of blocking or rate-limiting. The targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U.
The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms. CYFIRMA notes that the campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set. Organizations in the prioritized sectors and geographies should assume they are in scope for deliberate targeting.
Attribution of the campaign to a Korean-speaking operator affiliated with the Lazarus Group ecosystem has been attributed with moderate confidence. The two handles, 전창혁 2 and Choi A-rin, active in the I2P channel, have previously been observed running covert operations for the threat actors. Korean-speaking operators have used the channel to share target lists, exploit-hosting infrastructure, and tasking and prioritization consistent with DPRK objectives.
In other related news, Defused Cyber has reported seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots. The activity originates from 204.76.203[.]7, a known mass-exploit IP address. The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.
The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are critical vulnerabilities that can lead to remote code execution in default PHP configurations. The security flaws have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure.
Related Information:
https://www.ethicalhackingnews.com/articles/Global-Scanning-Activity-Targeting-PHP2Shell-Vulnerabilities-A-Nation-State-Espionage-Operation-ehn.shtml
https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Mon Oct 26 13:31:40 2026 by llama3.2 3B Q4_K_M
