Researchers Link PHP2Shell Exploitation to AI-Assisted Attack on European Government Agency

Attackers who abused a pair of PHP2Shell vulnerabilities went on to use agentic artificial intelligence platforms for post-exploitation work, according to Palo Alto Networks Unit 42.

In one case, the intruders hit a government entity in Europe and within two hours of the initial exploitation had accessed password hashes and multi-factor authentication secrets, the company said. They also set up an NTLM-relay tunnel into Active Directory and tried to escalate to Domain Admin privileges.

Unit 42 said the unknown attacker enumerated the compromised endpoint, with commands and behavioral markers pointing to an agentic attacker. Those included reconnaissance of the authentication database using stolen credentials, with password hashes and 2FA secrets as the target. The attacker also ran Active Directory reconnaissance through curl-based anonymous LDAP queries to the domain controller in search of the administrator account, and probed the host for DNS/AD integration, internal hosts, privileged groups and interactive users.

Each command batch was wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, producing machine-parseable output for an AI model to read, Unit 42 added.

Separately, CYFIRMA said it uncovered a suspected North Korea-linked campaign using PHP2Shell to probe global PHP infrastructure from 21 compromised nodes. CEO and founder Kumar Ritesh described the scanning as deliberately low-volume and paced, with nodes rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it.

The targets are 216 unpatched or partially mitigated hosts across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU, spanning government, financial institutions, logistics, airports and aviation, manufacturing and online transaction platforms.

CYFIRMA said the campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set, and that organizations in the prioritized sectors and geographies should assume they are in scope for deliberate targeting. The activity was coordinated through a closed I2P channel and attributed with moderate confidence to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem.

According to CYFIRMA, two handles active in the channel have previously been seen running covert operations for the threat actors. Ritesh said Korean-speaking operators have used the channel to share target lists, exploit-hosting infrastructure and tasking consistent with DPRK objectives, and that the captured conversation uses vocabulary and spelling specific to North Korean rather than South Korean standard.

CYFIRMA cited other indicators tying the campaign to Lazarus: command-and-control infrastructure the group has previously used to exploit web assets; its documented history of compromising PHP and WordPress servers for C2 and planting PHP and ASP web shells, as seen in the SyncHole watering hole campaign; and its prioritization of government agencies and banks, particularly online transaction platforms, matching a track record of breaching financial institutions for financial and cryptocurrency theft.

Exploitation is the next step, CYFIRMA said, with the operators stating they would shortlist the most promising targets the same day and then choose which public exploits to adapt.

In an October 25, 2026 post on X, Defused Cyber said it was also seeing PHP2Shell probes against its Palo Alto Networks GlobalProtect honeypots, originating from a known mass-exploit IP address. The requests carried a PHP_SESSION_UPLOAD_PROGRESS marker and a dummy file upload with no payload, which the threat intelligence company said points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.

Both PHP2Shell vulnerabilities are critical and can lead to remote code execution in default PHP configurations. Cloudflare has said it detected millions of exploitation attempts after public disclosure.

Datadog explained the constraints on an attacker: sizing a request to fail allocation at the right moment, and defeating ASLR to find valid memory addresses. The exploit needs one field name small enough to fit inside the accepted request body but large enough that copying its key exceeds memory_limit, with PHP making several copies as it parses a form-field name and the attacker using that extra memory to force an allocation failure while the name is copied into a hash table.

ReliaQuest, in an October 22, 2026 update, said it reproduced one of the vulnerabilities in a controlled lab and observed a sequence of errors that could help defenders identify exploitation. Its testing identified a specific sequence of artifacts across PHP error, Apache access, Apache error and system logs: a POST request returns a 500 error, PHP reports memory exhaustion and heap corruption, and the Apache worker handling the request crashes.

The PHP Foundation has since warned of a third remote code execution vulnerability that can only occur under an unusual combination of configuration and application code, and said the issue is expected to be addressed in the regular release cycle. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(), with session upload progress still enabled; applications that never change the serialize handler at runtime can keep the feature enabled.

Xint has released a scanner to check whether a host is exposed to PHP2Shell, stating remote code execution is possible in any PHP script regardless of the application, and in applications where decoding occurs, such as with session_start() and unserialize().

Bitsight's internet-wide scans show nearly 37 million internet-facing systems running PHP or PHP-related software, with most exposures in the U.S., Germany, France, the Netherlands and Japan. PHP runs a very large portion of the web, from content management systems and online shops to bespoke internal tools, Bitsight said, and a flaw in the runtime cannot be repaired by changing application code, nor removed by a web application firewall or plugin update. Only updating PHP on the host itself closes the gap.

Source: The Hackers News