Unit 42: attackers used an agentic AI attack platform after PHP2Shell exploitation, reaching a European government entity’s password hashes and MFA secrets within two hours
Partly confirmed
The takeaway
On Oct 23, 2026 Palo Alto Networks’ Unit 42 updated its PHP2Shell threat brief to report that attackers used “agentic AI attack platforms” for post-exploitation.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 25 October 2026
Your AI and this story
- GPT-6 Astra176 days after its cutoff
- Claude Opus 5.5115 days after its cutoff
- Gemini 4 Argon206 days after its cutoff
- Grok 4.7145 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 115 days before it.
Key facts
- Source: Unit 42 ‘Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619’, updated Oct 23, 2026 (12:30 p.m. PT) with the agentic AI details and Managed Threat Hunting queries
- Victim: a government entity in Europe, not named; Unit 42 does not say whether the Domain Admin escalation succeeded
- Stages described: exploitation of PHP2Shell and commands through a web shell; enumeration of the host; credential access (password hashes and MFA secrets) ‘within two hours of the initial exploitation’; an NTLM-relay tunnel into Active Directory; attempted Domain Admin escalation
- Why Unit 42 calls it agentic: commands wrapped output in machine-parseable section-header delimiters, apparently so a model could read it, plus short serially spaced tasks and quick pivots after failures. Unit 42: ‘The commands and behavioral markers used in the attack are strong indicators of an agentic attacker.’
- Attribution: none; the assessment is based on the structure and timing of commands, not on a named group (secondary write-ups stress it describes one observed case, not every PHP2Shell intrusion)
- Scale context: Unit 42 counted over 22.6M exposed instances potentially vulnerable to the two CVEs (Cortex Xpanse); PHP2Shell itself was found with frontier AI (see PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide)
What happened
Two days after PHP shipped fixes for PHP2Shell, Unit 42 added a section to its threat brief on what attackers did after getting in. It says they used agentic AI attack platforms for post-exploitation, and gives one case in detail: a European government entity where, within two hours of the first exploit, the intruders held password hashes and MFA secrets, had built an NTLM-relay tunnel into Active Directory and were trying to become Domain Admin.
The evidence is behavioural. Unit 42 points to command output wrapped in section headers that a model can parse, and to the rhythm of the session: short tasks in sequence and fast changes of approach after failures. It does not name the attacker, the AI system used or the victim, and we found no second source (government CERT or press) confirming the case independently as of Oct 25.
Why it matters
It is a reported case of the scenario defenders warned about when AI-found PHP2Shell was disclosed: a fresh, internet-wide flaw turned within hours into an identity-infrastructure compromise of a government body, with an AI agent doing the follow-up work. It also shows the compressed timeline: two hours from web-server foothold to credential material. Treat the agentic attribution as a vendor assessment, not a confirmed fact.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 2 primary
Primary
- Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (updated Oct 23)unit42.paloaltonetworks.com, official
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, revised Oct 23)cisa.gov, official
Changes
- Filed from Unit 42’s Oct 23 update (item cited by Gemini; verified on the Unit 42 page; single-source, confidence medium)