PHP2Shell attackers reached a European government network within two hours
Palo Alto Networks’ Unit 42 says attackers exploited PHP2Shell against a European government entity, accessing password hashes and multi-factor authentication secrets within two hours. They also attempted to relay into Active Directory and escalate privileges; Unit 42 said commands used to inspect the compromised system suggested agentic AI involvement.
Bottom line — PHP released fixes for PHP 8.2, 8.3, 8.4 and 8.5 on 21 October.
Go deeper 7
-
The two flaws, CVE-2026-109618 and CVE-2026-109619, can enable unauthenticated remote code execution, according to the PHP project.
-
The European incident is not proof of a North Korea link: CYFIRMA separately assessed a low-volume scanning campaign as probably connected to the Lazarus Group ecosystem, with moderate confidence.
-
CYFIRMA identified 216 unpatched or partly mitigated hosts across several countries and the EU, spanning government, finance, logistics, aviation and other sectors.
-
The Dutch NCSC’s operational repository says all PHP installations serving web requests may be at risk, including PHP embedded in appliances and network devices.
-
The PHP project no longer supports PHP 8.1 and older, though distributions and long-term support vendors may provide backported fixes.
-
Unit 42 said the attackers used machine-readable command-output markers while enumerating systems and credentials.
-
The Hacker News reported that Cloudflare detected millions of exploitation attempts after public disclosure; that figure describes attempts, not confirmed breaches.
techwithnani.blogspo…