PHP2Shell breach: attackers reached MFA secrets at a European government entity within two hours

What happened

PHP2Shell now has a publicly described breach, not just exploit attempts.

On October 23 (update posted 19:30 UTC), Palo Alto Networks Unit 42 added a case to its threat brief on CVE-2026-109618 and CVE-2026-109619. Attackers targeted a government entity in Europe. Within two hours of initial exploitation, Unit 42 says, they had accessed password hashes and multi-factor authentication (MFA) secrets.

The attackers also set up an NTLM-relay tunnel into Active Directory and attempted to escalate to Domain Admin. Unit 42 says it was attempted. It does not say it worked.

PHP fixed both flaws on October 21. Our PHP2Shell explainer covers fixed versions and interim settings.

The two hours, step by step

Unit 42 shows the commands it saw in Cortex XDR. They ran through a web shell, as child processes of the Apache web server. We describe them at a high level only.

• Database first. The attackers logged into the application's database with stolen credentials. They counted and sampled user rows holding password hashes and stored 2FA secrets.
• Active Directory next. They sent anonymous LDAP queries to a domain controller, looking for the administrator account.
• Host and network recon. They read DNS and directory settings, the hosts file, privileged groups and local users. Unit 42 labels the AD step living-off-the-land recon.

MFA secrets matter more than passwords here. A stolen 2FA seed can let an attacker generate valid one-time codes. Any account whose seed was in that table should be treated as exposed until it is re-enrolled.

Why Unit 42 thinks an AI agent ran it

Unit 42 calls the activity "strong indicators of an agentic attacker". Its reasons are behavioral:

• Each batch of commands was wrapped in section headers, such as ==SHELLUSER== and ==PASSWD==. Unit 42 says these make the output easy for an AI model to parse.
• Tasks were short and serially spaced.
• The attacker pivoted quickly after failures.

This is Unit 42's reading of the evidence. It does not name an AI platform or tool, and it does not attribute the intrusion to any group. Humans and ordinary scripts can produce similar patterns. Still, the speed fits a wider trend of machine-paced post-exploitation.

A separate thread: a suspected North Korea-linked crew

On October 22 to 24, threat intelligence firm CYFIRMA published three versions of an early-warning advisory about PHP2Shell. It says it monitored a closed, Korean-language channel on the I2P anonymity network.

According to CYFIRMA:

• On October 24, the channel's operators said they had built a list of 216 hosts that still looked unpatched or only partly mitigated.
• The list covers government, finance, logistics, aviation, manufacturing and online transaction platforms. Named regions include the US, Japan, South Korea, Southeast Asia, Australia, India, the Gulf states and the EU.
• The operators said they were scanning from 21 compromised nodes, slowly and quietly. CYFIRMA says it saw the same addresses sending PHP web-shell and upload-progress probing traffic.
• The operators said they used local AI to rank public exploit code. They had not named a launch date.

On attribution, read the confidence level. CYFIRMA has high confidence that the campaign activity is real. It has only moderate confidence that the operators belong to the Lazarus ecosystem. That rests on language, targeting and past web-shell tradecraft. CYFIRMA says there is no confirmed infrastructure or malware overlap with a named Lazarus cluster. It lists a Korean-speaking criminal crew as an alternative.

The 216 figure is what the operators said in their own channel, as reported by CYFIRMA. The target list itself has not been seen, and no victim is named. CYFIRMA reports no confirmed compromise by this group.

CYFIRMA's advisory carries a TLP:AMBER marking, although it is posted on its public site. ThreatWire summarizes only its top-line findings and does not republish its indicators or channel details.

Nothing links the two stories. Unit 42 does not attribute the European intrusion. CYFIRMA does not mention it. Do not read the breach as a North Korean operation.

Who is affected

Any internet-facing server running a PHP build older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 should be treated as exposed. That includes vendor and distro builds that have not shipped the backport.

PHP says every installation serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for Apache mod_php, where PHP validated full remote code execution with default limits. In the Unit 42 case, the commands ran under an Apache process. PHP 8.1 and older are end of life, with only minimal source backports.

Unit 42 counts more than 22.6 million exposed instances that may be vulnerable, based on its Cortex Xpanse telemetry. It also says at least one European government took its website offline as a precaution. That is a separate statement from the breach.

What is confirmed

• A real intrusion. Unit 42 describes post-exploitation at a European government entity. Hashes and MFA secrets were accessed within two hours.
• AD relay and a Domain Admin attempt, per Unit 42.
• Exploitation in the wild since before the patch. Amazon logged a first attempt on October 17 and calls exploitation broad. See our MadPot story.
• Fixes since October 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Not in CISA KEV. Neither CVE is listed (catalog 2026.10.23, checked October 25).

What is not confirmed

• The victim. Unit 42 does not name the entity, its country or its sector beyond "government".
• Dates and entry point. Unit 42 does not say when the intrusion happened or which of the two CVEs was used.
• Whether Domain Admin was reached. Unit 42 says it was attempted.
• The AI tool. "Agentic" is Unit 42's inference from the command pattern, not proof of a specific platform.
• North Korean involvement. Moderate confidence only, from one vendor, with no infrastructure overlap.
• Any victims of the 216-host campaign. None are named or confirmed.

ThreatWire has not run any PHP2Shell exploit code. Many public "PoC" repositories are unverified, and some carry malware.

What to do

1. Patch and restart every PHP worker. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a verified vendor build. A reload that keeps old workers alive is not enough.
2. Preserve evidence first on suspect hosts. CYFIRMA warns that a restart destroys the in-memory state tied to CVE-2026-109619. Capture what you can, then patch.
3. Hunt back to October 17. Look for PHP or web-server processes starting shells, download tools or LDAP queries. Look for new PHP files in web roots. Unit 42's brief includes hunting queries for Cortex XDR users.
4. Assume database secrets are gone if a PHP host was hit. Rotate the database credentials it held. Reset passwords and re-enroll MFA for accounts whose hashes or 2FA seeds were stored there.
5. Check Active Directory. Review anonymous LDAP access to domain controllers, NTLM relay protections (SMB and LDAP signing, channel binding) and recent changes to privileged groups.
6. Watch slow, low-volume probing. CYFIRMA says rate-based alerts will miss the scanning it describes.
7. If you cannot patch today, apply PHP's interim settings from our explainer. Treat them as a bridge, not a fix. Note the separate, unpatched CVE-2026-115560.

Related coverage

Records: CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state).

Earlier PHP2Shell stories: the October 21 fixes, the attempt four days before disclosure and the unpatched session upload progress flaw.

Sources: Palo Alto Networks Unit 42, CYFIRMA, PHP's php-src advisories, the PHP Foundation, Amazon Threat Intelligence and CISA. Links are in the references list.