PHP2Shell Exploitation Targets European Government as Global Scanning Expands
Summary
Unit 42 says attackers used PHP2Shell against a European government entity and accessed password hashes and MFA secrets. CYFIRMA reports suspected low-volume scanning of 216 hosts, while researchers describe detection clues and another PHP RCE flaw.
Key points
- Unit 42 reports attackers exploited CVE-2026-109618 and CVE-2026-109619 against a European government entity, accessing password hashes and MFA secrets within two hours and attempting an NTLM relay into Active Directory and Domain Admin escalation.
- Unit 42 observed post-exploitation commands and section-header delimiters that it said could make command output machine-parseable for an AI model; it described the activity as suggesting an agentic attacker.
- CYFIRMA reported suspected North Korea-linked PHP2Shell scanning from 21 compromised nodes, targeting 216 unpatched or partially mitigated hosts across multiple countries and sectors. It attributed the activity to a Korean-speaking operator linked to the Lazarus Group ecosystem with moderate confidence.
- Defused Cyber reported PHP2Shell probes against Palo Alto Networks GlobalProtect honeypots from 204.76.203[.]7; the requests included a PHP_SESSION_UPLOAD_PROGRESS marker but no payload.
- Cloudflare reported millions of exploitation attempts after disclosure. Bitsight scans found nearly 37 million internet-facing systems running PHP or PHP-related software; Bitsight said updating PHP on the host is necessary to close the gap.
- ReliaQuest reproduced CVE-2026-109618 in a lab and identified a possible detection sequence involving a POST response of 500, PHP memory-exhaustion and heap-corruption errors, and an Apache worker crash.
- The PHP Foundation warned of CVE-2026-115560, a separate RCE flaw requiring an unusual combination of session-serialization settings and runtime code changes; it said the issue is expected to be addressed in a regular release.
Article Details
- Event Type
- Exploitation and global scanning of PHP2Shell remote-code-execution vulnerabilities, with reported AI-assisted post-exploitation activity.
- Impact
- Palo Alto Networks Unit 42 reported that attackers compromised a European government entity and accessed password hashes and multi-factor authentication secrets within two hours of initial exploitation. They established an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation. CYFIRMA reported low-volume scanning of a filtered set of 216 unpatched or partially mitigated hosts across multiple countries and sectors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 204[.]76[.]203[.]7 | Reported source of PHP2Shell probes against Palo Alto Networks GlobalProtect honeypots; described as a known mass-exploit IP address. |
MITRE ATT&CK
T1069.002 · Domain GroupsReported reconnaissance included searching for privileged groups in the domain.T1087.002 · Domain AccountAttackers used LDAP queries to search Active Directory for the administrator account.T1190 · Exploit Public-Facing ApplicationAttackers exploited PHP vulnerabilities in internet-facing systems.
CVE
CVE-2026-109618Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.CVE-2026-109619Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.CVE-2026-115560The PHP Foundation has since warned of a third remote code execution vulnerability (CVE-2026-115560), which can only "occur under an unusual combination of configuration and application code." The issue is expected to
People
Threat Actors
Choi A-rinCYFIRMA said this handle was active in the closed I2P channel and had previously been observed running covert operations for the threat actors. The source identifies 최아린 as an alias.Jeon Chang-hyuk 2CYFIRMA said this handle was active in the closed I2P channel and had previously been observed running covert operations for the threat actors. The source identifies 전창혁 2 as an alias.Lazarus GroupCYFIRMA assessed with moderate confidence that the campaign was conducted by an operator affiliated with the Lazarus Group ecosystem.전창혁 2CYFIRMA said this handle was active in the closed I2P channel and had previously been observed running covert operations for the threat actors. The source identifies Jeon Chang-hyuk 2 as an alias.최아린CYFIRMA said this handle was active in the closed I2P channel and had previously been observed running covert operations for the threat actors. The source identifies Choi A-rin as an alias.
Vendors
BitsightBitsight's internet-wide scans show that there are nearly 37 million internet-facing systems running PHP or PHP-related software, with most of the exposures in the U.S., Germany, France, the Netherlands, and Japan.Cloudflarein default PHP configurations. The security flaws have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure.Datadogto fail allocation at the right moment, and they must defeat ASLR to find valid memory addresses," Datadog said. "The exploit needs one field name small enough to fit inside the accepted request body but largePalo Alto Networksthey had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said.ReliaQuestReliaQuest, in an update published on October 22, 2026, said it reproduced CVE-2026-109618 in a controlled lab and observed a sequence of errors that could help defenders identify exploitation.
Products
GlobalProtectshared on X, Defused Cyber said it's also seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots. The activity originates from 204.76.203[.]7, a known mass-exploit IP address.Microsoft Active Directory"They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation."PHPThe disclosure comes as CYFIRMA said it uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.
Countries
Australiaor partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financialIndiamitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions,Indonesiaof 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government,JapanThe targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. TheNorth KoreaThe disclosure comes as CYFIRMA said it uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.Saudi Arabiathe U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation,Singaporehosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics,South Koreatargets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. TheTaiwanor partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financialThailanda set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts spanU.A.E.across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports andUnited StatesThe targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The
Industries
Airports and aviationU.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.Financial institutionsTaiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.Government"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo AltologisticsSingapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.Manufacturingand the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.Online transaction platformsspan government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.