PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Unit 42 reports that attackers exploited the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 against a European government body, stealing password hashes and MFA secrets within two hours and attempting NTLM-relay-based Domain Admin escalation in Active Directory. Investigators found command patterns with machine-parseable delimiters, suggesting an AI agent was directing the post-exploitation steps. Separately, CYFIRMA linked a slow, rotating scanning campaign against 216 unpatched hosts across government, finance and aviation sectors in a dozen countries to Korean-speaking operators tied to the Lazarus Group, while Defused Cyber reported ongoing scans against Palo Alto GlobalProtect honeypots. PHP's maintainers also disclosed a third related remote-code-execution bug, CVE-2026-115560, as Bitsight estimates nearly 37 million internet-facing PHP systems remain exposed worldwide, underscoring the urgency of patching the PHP runtime itself.