AI-Assisted PHP2Shell Exploitation Hits European Government, Exposes Hashes and MFA Path

En bref

• Two PHP-related CVEs, CVE-2026-109618 and CVE-2026-109619, were exploited in October 2026.
• The intrusion involved PHP2Shell and AI-assisted post-exploitation against a European government entity.
• Attackers obtained password hashes and gained MFA access, contributing to government compromise.
• Global scanning activity was observed, suggesting broad reconnaissance beyond the victim.

In October 2026, unknown threat actors took advantage of two PHP security flaws, CVE-2026-109618 and CVE-2026-109619, to target a government entity in Europe. The operation used PHP2Shell tooling and autonomous AI platforms, indicating a machine-driven approach to intrusion. Observed activity included scanning, exploitation, and post-compromise actions.

The intrusion unfolded quickly: the key sequence reportedly took about two hours from initial exploitation to deeper access. Attackers exfiltrated password hashes and reached systems guarded by multi-factor authentication, which contributed to the compromise of the government environment. The exact entry point and full scope remain unclear.

Scanning tied to the campaign was seen across the internet, not limited to the victim. That worldwide footprint raises concern that other PHP deployments may be probed. The use of agentic AI platforms suggests attackers are automating reconnaissance and post-exploitation tasks, reducing the time between discovery and abuse.

For K-12 and government IT teams, the case underscores why PHP estate inventory, patch velocity, and MFA hardening matter. Watch for signs of PHP2Shell activity, unusual authentication attempts, and hash-dumping behavior. Because details are limited, treat the CVEs as medium priority but validate exposure immediately.

À faire maintenant

1. Inventory internet-facing PHP applications and confirm exposure to CVE-2026-109618 and CVE-2026-109619; patch or mitigate immediately.
2. Search logs for PHP2Shell indicators and unusual request patterns; isolate any affected hosts.
3. Force password resets for accounts whose hashes may have been exposed; rotate service credentials and API keys.
4. Review MFA enrollment and session tokens; revoke active sessions and require reauthentication for privileged accounts.
5. Block or alert on scanning from known malicious sources; monitor for rapid exploitation attempts and post-compromise behavior.
6. Apply least privilege and network segmentation to PHP systems; disable unnecessary functions and restrict outbound traffic.
7. Brief incident response and validate backups; prepare containment if government data access is suspected.

Références CVE

• CVE-2026-109618
• CVE-2026-109619

Source originale

The Hacker News