PHP2Shell flaws exploited in government breach and global scans

Threat actors exploited PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to breach a European government entity. Within two hours of initial exploitation, attackers accessed password hashes and multi-factor authentication secrets. They established an NTLM-relay tunnel into Active Directory and attempted Domain Admin privilege escalation. Command batches used section-header delimiters to produce machine-parseable output for an AI model, indicating agentic post-exploitation activity.

CYFIRMA identified a suspected North Korea-linked campaign using compromised nodes to probe global PHP infrastructure. The low-volume scanning targeted 216 unpatched hosts across multiple countries. Coordination occurred via a closed I2P channel attributed to a Korean-speaking operator affiliated with the Lazarus Group ecosystem. Defused Cyber reported probes targeting its honeypots, while Datadog noted the technical difficulty of defeating ASLR to find valid memory addresses.

The PHP security team patched the flaws on October 21. Adel Karimi recorded evidence of confirmed remote code execution against an Apache mod_php installation. Marcus Hutchins confirmed these findings as the highest quality confirmation of in-the-wild exploitation. Prior to this, multiple cybersecurity companies detected unsuccessful exploitation attempts. The PHP Foundation also warned of a third remote code execution vulnerability, CVE-2026-115560.