Arctic Wolf reports widespread scanning and attempted command execution after disclosure of PHP2Shell CVE-2026-109618 and CVE-2026-109619, and links payload-hosting infrastructure to Potassium. Telemetry did not confirm successful exploitation at scale.
Arctic Wolf details two PHP2Shell flaws that allow unauthenticated code execution, their root causes and patched versions. The company reports scanning and malicious exploitation attempts, including requests to retrieve ELF and Go binaries.
Arctic Wolf describes how its Aurora Agentic SOC uses AI agents to investigate threats and recommend containment actions, while requiring human approval for high-impact responses across email, identity, endpoint, and network tools.
Arctic Wolf says Anthropic’s Claude models now power agents across its Aurora platform. The company says its Swarm of Experts autonomously resolves over 60% of investigations and helps customers resolve cases 26% faster year over year.
