{"schema":"postcutoff/event@1","as_of":"2026-10-25T23:49:00+01:00","url":"https://postcutoff.com/e/2026-10-23-unit42-agentic-ai-attack-php2shell-european-government/","md":"https://postcutoff.com/e/2026-10-23-unit42-agentic-ai-attack-php2shell-european-government/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-23-unit42-agentic-ai-attack-php2shell-european-government","date":"2026-10-23","date_precision":"day","short_title":"Unit 42: attackers used an agentic AI attack platform after PHP2Shell exploitation, reaching a European government entity's password hashes and MFA secrets within two hours","deck":null,"takeaway":"On Oct 23, 2026 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief to report that attackers used \"agentic AI attack platforms\" for post-exploitation.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (updated Oct 23)","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","type":"official","group":"primary","domain":"unit42.paloaltonetworks.com"},{"n":2,"title":"CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, revised Oct 23)","url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","type":"official","group":"primary","domain":"cisa.gov"}],"official":2,"filed":"2026-10-25","updated":"2026-10-25","orgs":["Palo Alto Networks"],"title":"Unit 42: attackers used an agentic AI attack platform after PHP2Shell exploitation, reaching a European government entity's password hashes and MFA secrets within two hours","summary":"On Oct 23, 2026 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief to report that attackers used \"agentic AI attack platforms\" for post-exploitation. In one case, against an unnamed government entity in Europe, they obtained password hashes and multi-factor authentication secrets within two hours of exploiting the PHP flaw, then tunnelled into Active Directory and attempted Domain Admin escalation. The assessment rests on command patterns, comes from a single vendor, and names no actor.","key_facts":["Source: Unit 42 'Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619', updated Oct 23, 2026 (12:30 p.m. PT) with the agentic AI details and Managed Threat Hunting queries","Victim: a government entity in Europe, not named; Unit 42 does not say whether the Domain Admin escalation succeeded","Stages described: exploitation of PHP2Shell and commands through a web shell; enumeration of the host; credential access (password hashes and MFA secrets) 'within two hours of the initial exploitation'; an NTLM-relay tunnel into Active Directory; attempted Domain Admin escalation","Why Unit 42 calls it agentic: commands wrapped output in machine-parseable section-header delimiters, apparently so a model could read it, plus short serially spaced tasks and quick pivots after failures. Unit 42: 'The commands and behavioral markers used in the attack are strong indicators of an agentic attacker.'","Attribution: none; the assessment is based on the structure and timing of commands, not on a named group (secondary write-ups stress it describes one observed case, not every PHP2Shell intrusion)","Scale context: Unit 42 counted over 22.6M exposed instances potentially vulnerable to the two CVEs (Cortex Xpanse); PHP2Shell itself was found with frontier AI (see 2026-10-21-php2shell-ai-found-php-rce)"],"key_numbers":[],"tags":["cybersecurity","php2shell","agentic-attack","ai-misuse","government","threat-intelligence"],"science":null,"body_md":"## What happened\n\nTwo days after PHP shipped fixes for PHP2Shell, Unit 42 added a section to its threat brief on what attackers did after getting in.\nIt says they used agentic AI attack platforms for post-exploitation, and gives one case in detail: a European government entity\nwhere, within two hours of the first exploit, the intruders held password hashes and MFA secrets, had built an NTLM-relay tunnel\ninto Active Directory and were trying to become Domain Admin.\n\nThe evidence is behavioural. Unit 42 points to command output wrapped in section headers that a model can parse, and to the rhythm\nof the session: short tasks in sequence and fast changes of approach after failures. It does not name the attacker, the AI system\nused or the victim, and we found no second source (government CERT or press) confirming the case independently as of Oct 25.\n\n## Why it matters\n\nIt is a reported case of the scenario defenders warned about when AI-found PHP2Shell was disclosed: a fresh, internet-wide flaw\nturned within hours into an identity-infrastructure compromise of a government body, with an AI agent doing the follow-up work.\nIt also shows the compressed timeline: two hours from web-server foothold to credential material. Treat the agentic attribution as\na vendor assessment, not a confirmed fact.","disputed":[],"related":[{"id":"2026-10-21-php2shell-ai-found-php-rce","url":"https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/","date":"2026-10-21","date_precision":"day","short_title":"PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide","deck":null,"takeaway":"The bugs were found with frontier AI: by Calif with GPT-5.6 Sol under OpenAI's Patch the Planet programme, and by Google's Wiz with Gemini 4 Argon, GPT-5.6 Sol and its Wiz Atlas agent.","category":"policy-safety","category_label":"Policy & safety","importance":5,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":13,"official":10,"filed":"2026-10-22","updated":"2026-10-25","orgs":["OpenAI","Wiz","Google","PHP"]},{"id":"2026-10-21-microsoft-storm-0940-artex-connectwise","url":"https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/","date":"2026-10-21","date_precision":"day","short_title":"Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants","deck":null,"takeaway":"Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Microsoft","ConnectWise"]},{"id":"2026-10-21-symantec-skynet-mode-llmjacking-agent","url":"https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/","date":"2026-10-21","date_precision":"day","short_title":"Symantec: offensive agent hijacks LLMs in 'Skynet mode'","deck":null,"takeaway":"It is a concrete look at how criminals are packaging agentic attacks: not a frontier lab's model behind safeguards, but someone else's exposed endpoint doing the thinking, with the victim paying for inference.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":2,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Symantec"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-25","type":"filed","text":"Created from Unit 42's Oct 23 update (item cited by Gemini; verified on the Unit 42 page; single-source, confidence medium)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-25","run":null,"sources_read":"Unit 42's Oct 23 update (item cited by Gemini; verified on the Unit 42 page; single-source, confidence medium)","updated":"2026-10-25","human_review":null,"version":{"date":"2026-10-25"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":176,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":115,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":206,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":145,"in_training_data":false}],"short_url":null}