--- id: "2026-10-23-unit42-agentic-ai-attack-php2shell-european-government" url: "https://postcutoff.com/e/2026-10-23-unit42-agentic-ai-attack-php2shell-european-government/" as_of: "2026-10-25T23:49:00+01:00" date: "2026-10-23" date_precision: day category: policy-safety importance: 3 confidence: medium status: [Partly confirmed] sources: 2 editor: human editor human_review: null version: "2026-10-25" --- As of: 2026-10-25 23:49 CET. Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/ Canonical page: https://postcutoff.com/e/2026-10-23-unit42-agentic-ai-attack-php2shell-european-government/ # Unit 42: attackers used an agentic AI attack platform after PHP2Shell exploitation, reaching a European government entity's password hashes and MFA secrets within two hours On Oct 23, 2026 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief to report that attackers used "agentic AI attack platforms" for post-exploitation. In one case, against an unnamed government entity in Europe, they obtained password hashes and multi-factor authentication secrets within two hours of exploiting the PHP flaw, then tunnelled into Active Directory and attempted Domain Admin escalation. The assessment rests on command patterns, comes from a single vendor, and names no actor. ## Key facts - Source: Unit 42 'Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619', updated Oct 23, 2026 (12:30 p.m. PT) with the agentic AI details and Managed Threat Hunting queries - Victim: a government entity in Europe, not named; Unit 42 does not say whether the Domain Admin escalation succeeded - Stages described: exploitation of PHP2Shell and commands through a web shell; enumeration of the host; credential access (password hashes and MFA secrets) 'within two hours of the initial exploitation'; an NTLM-relay tunnel into Active Directory; attempted Domain Admin escalation - Why Unit 42 calls it agentic: commands wrapped output in machine-parseable section-header delimiters, apparently so a model could read it, plus short serially spaced tasks and quick pivots after failures. Unit 42: 'The commands and behavioral markers used in the attack are strong indicators of an agentic attacker.' - Attribution: none; the assessment is based on the structure and timing of commands, not on a named group (secondary write-ups stress it describes one observed case, not every PHP2Shell intrusion) - Scale context: Unit 42 counted over 22.6M exposed instances potentially vulnerable to the two CVEs (Cortex Xpanse); PHP2Shell itself was found with frontier AI (see [2026-10-21-php2shell-ai-found-php-rce](https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/index.md)) ## What happened Two days after PHP shipped fixes for PHP2Shell, Unit 42 added a section to its threat brief on what attackers did after getting in. It says they used agentic AI attack platforms for post-exploitation, and gives one case in detail: a European government entity where, within two hours of the first exploit, the intruders held password hashes and MFA secrets, had built an NTLM-relay tunnel into Active Directory and were trying to become Domain Admin. The evidence is behavioural. Unit 42 points to command output wrapped in section headers that a model can parse, and to the rhythm of the session: short tasks in sequence and fast changes of approach after failures. It does not name the attacker, the AI system used or the victim, and we found no second source (government CERT or press) confirming the case independently as of Oct 25. ## Why it matters It is a reported case of the scenario defenders warned about when AI-found PHP2Shell was disclosed: a fresh, internet-wide flaw turned within hours into an identity-infrastructure compromise of a government body, with an AI agent doing the follow-up work. It also shows the compressed timeline: two hours from web-server foothold to credential material. Treat the agentic attribution as a vendor assessment, not a confirmed fact. ## Your AI and this story - GPT-6 Astra (training cutoff April 2026): 176 days after its cutoff - Claude Opus 5.5 (training cutoff June 2026): 115 days after its cutoff - Gemini 4 Argon (training cutoff March 2026): 206 days after its cutoff - Grok 4.7 (training cutoff May 2026): 145 days after its cutoff ## Sources 1. [Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (updated Oct 23)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) (unit42.paloaltonetworks.com, official) 2. [CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, revised Oct 23)](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) (cisa.gov, official) ## Changes - 2026-10-25 (filed): Created from Unit 42's Oct 23 update (item cited by Gemini; verified on the Unit 42 page; single-source, confidence medium) ## Related - 2026-10-21: [PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide](https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/index.md) - 2026-10-21: [Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants](https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/index.md) - 2026-10-21: [Symantec: offensive agent hijacks LLMs in 'Skynet mode'](https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/index.md)