PHP2Shell Exploitation Reaches European Government Network
Attackers exploiting the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 compromised a government entity in Europe and, within two hours, accessed password hashes and multi-factor authentication secrets. Palo Alto Networks Unit 42 said the intruders also established an NTLM-relay tunnel into Active Directory and attempted to escalate privileges to Domain Admin.
The two flaws are critical remote code execution issues affecting default PHP configurations. Their exploitation has drawn widespread scanning: Cloudflare reported millions of attempts after the vulnerabilities were publicly disclosed. The incident illustrates how an internet-facing PHP weakness can quickly become an identity and directory-services problem once an attacker gains a foothold.
Post-exploitation activity shows automation markers
Unit 42 observed the attacker enumerating the compromised endpoint and carrying out reconnaissance against authentication data, Active Directory and the host environment. The commands sought password hashes and two-factor authentication secrets using stolen credentials, queried a domain controller anonymously through curl-based LDAP requests, and looked for DNS and AD integration, internal hosts, privileged groups and interactive users.
Command batches were enclosed with section headers such as ==SHELLUSER== and ==PASSWD==. Unit 42 said these delimiters create machine-parseable output for an AI model, while the commands and behavioural markers suggested an agentic attacker. This observation concerns post-exploitation activity; it does not change the underlying requirement to remove the vulnerable PHP condition from exposed systems.
Low-volume campaign targets a filtered global set
CYFIRMA separately identified a suspected North Korea-linked campaign using PHP2Shell to probe global PHP infrastructure through 21 compromised nodes. It counted 216 unpatched or partially mitigated hosts across the United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the European Union.
The identified targets include government bodies, financial institutions, logistics organizations, airports and aviation, manufacturing, and online transaction platforms. CYFIRMA described the activity as low-volume and paced: nodes are rotated and abandoned when blocking or rate limiting appears, reducing the chance that threshold-based alerting will identify the probing.
The company attributed the operation with moderate confidence to a Korean-speaking operator linked to the Lazarus Group ecosystem. Its assessment cited a closed I2P channel, Korean-language indicators, infrastructure previously used against web assets, and a focus on government agencies, banks and online transaction platforms. CYFIRMA said the operators were moving from reconnaissance toward selecting promising targets and adapting public exploits.
Detection signals and remediation scope
Defused Cyber also observed PHP2Shell probes against Palo Alto Networks GlobalProtect honeypots. The requests contained a PHP_SESSION_UPLOAD_PROGRESS marker, p2s-rider, and a payload-free dummy upload, which it assessed as checks for vulnerable upload-progress behaviour and possible target-list building.
ReliaQuest reproduced CVE-2026-109618 in a controlled lab and identified a useful log sequence: a POST request returns a 500 error, PHP logs memory exhaustion and heap corruption, and the relevant Apache worker crashes. Teams can use that sequence across PHP, Apache access, Apache error and system logs to investigate suspected exploitation, alongside unexpected LDAP queries, NTLM-relay activity and access to credential or MFA-related material.
The PHP Foundation has also warned of CVE-2026-115560, a third remote code execution issue requiring an unusual combination of configuration and application behaviour. Xint released a scanner for PHP2Shell exposure, while Bitsight estimated that nearly 37 million internet-facing systems run PHP or PHP-related software. Bitsight stressed that application-code changes, web application firewalls and plugin updates do not close a runtime flaw: businesses should update PHP on affected hosts, validate exposure, and monitor the defined error and directory-reconnaissance signals as a practical response.