Unit 42 details how attackers leveraged agentic AI platforms for post-exploitation following PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Discover how threat actors targeted a European government entity, accessed MFA secrets within two hours, and attempted Active Directory privilege escalation.
The attack on a European government organization
In at least one case, unknown attackers targeted a government agency in Europe. Within just two hours of the initial breach, they were able to gain access to passwords and two-step verification secrets. They then created a hidden connection to the organization’s internal network and attempted to take complete control of administrative accounts.
Security experts noticed that the commands executed by the perpetrators were structured with special markings, indicating that the steps were being read and guided by some artificial intelligence model in real time.
Global scanning and suspicious networks
At the same time, researchers have identified a separate scanning operation originating from dozens of servers and targeting hundreds of vulnerable systems in multiple countries, including the United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia, and countries in the European Union. Government agencies, banks, logistics companies, airports, construction companies, and e-commerce platforms are among the targets.
READ ALSO
Speed restrictions remain on Ukrainian military satellite internet despite Trump's urging of Musk
This specific activity is linked by researchers, with moderate certainty, to specific individuals and is attributed to groups with actions similar to those of North Korea, which were coordinated through covert communication channels.
The size of the problem
The problem concerns critical security vulnerabilities in the popular PHP programming language, which is widely used on millions of servers and websites around the world. According to security firm analyses, millions of attack attempts have been recorded since the issue was publicly disclosed. Because the issue is at the core of the software itself and not in a separate application or firewall, simple fixes are not enough to protect systems, only immediate updates to PHP itself by administrators.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)