Unit 42: AI Agents Drive PHP2Shell Attacks

Attackers exploiting the critical PHP2Shell flaws in PHP are using agentic AI attack platforms to run their post-exploitation work, Palo Alto Networks' Unit 42 threat intelligence team said in a threat brief updated through Oct. 23, 2026. In one intrusion at a European government entity, the attackers had password hashes and multi-factor authentication secrets within two hours of breaking in.

• Unit 42 says AI agents, not just human operators, are driving follow-on activity after PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is exploited.
• The telltale signs: command batches wrapped in machine-readable delimiters such as "==SHELLUSER==" and "==PASSWD==", short serial tasks and fast pivots after failures.
• Palo Alto Networks' Cortex Xpanse counted "over 22.6 million exposed instances potentially vulnerable," and patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 remains the fix.

How Unit 42 spotted AI agents in PHP2Shell attacks

According to the Unit 42 threat brief, the clue was in the shape of the commands. Attackers sent batches of shell commands separated by section headers like "==SHELLUSER==" and "==PASSWD==," a format that produces output a language model can parse easily.

Unit 42 also saw short tasks issued one after another and quick changes of direction when a step failed. That rhythm, the team said, points to agentic AI attack platforms handling the post-exploitation phase rather than a person typing at a keyboard.

Two hours from break-in to Active Directory

In the case Unit 42 described, attackers targeted a European government entity. Within two hours of the initial exploit, they had collected password hashes and MFA secrets, set up an NTLM-relay tunnel into Active Directory and tried to escalate to Domain Admin.

Unit 42 also reported that "at least one European government has taken its website offline as a precaution." The brief did not name the government or say whether the escalation attempt succeeded.

What PHP2Shell is

Both flaws carry a CVSS 4.0 score of 9.2. CVE-2026-109618 involves how PHP handles out-of-memory errors through longjmp(), which can leave request memory uninitialized. CVE-2026-109619 leaves global memory pointing at freed regions after a fatal error, which later requests can read or branch on. Either can lead to remote code execution.

The PHP project shipped fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to Tenable's FAQ, PHP 7.4 through 8.1 received only minimal source backports, and versions 5.4 through 7.3 get no fix at all.

Exploitation began before the patch

Unit 42's findings add to a fast-moving picture. Amazon said it saw the first exploit attempt against a honeypot on Oct. 17, four days before disclosure, and later stated that "PHP2Shell is now being broadly exploited in the wild," SecurityWeek reported. Details leaked online on Oct. 20.

Security firm watchTowr said its honeypots observed exploitation of both CVEs in the wild on Oct. 21. Censys counted about 1.57 million unpatched hosts among roughly 1.58 million that reported an identifiable PHP version that day, according to SecurityWeek. As of Oct. 23, Tenable noted, the flaws were not yet in CISA's Known Exploited Vulnerabilities catalog.

Why AI-driven post-exploitation matters

The PHP2Shell bugs were themselves found with help from AI models, according to the researchers at Wiz and Calif who reported them. Unit 42's brief suggests attackers are now using similar tools on the other side, compressing the time between a first foothold and a domain-wide compromise.

For defenders, that shrinks the window to spot an intrusion. Unit 42 recommends patching immediately, reviewing web server and PHP worker processes for post-exploitation signs, and searching firewall logs for inbound exploit attempts.

What's next

Watch for whether CISA adds the two CVEs to its KEV catalog, which would set patch deadlines for U.S. federal agencies. Unit 42 has updated its brief several times since Oct. 21, and more incident details may follow.

FAQ

Is PHP2Shell being exploited right now?
Yes. Amazon, watchTowr and Unit 42 have all reported exploitation or attempts in the wild, and Unit 42 described at least one intrusion at a European government entity.

How do I know if attackers used AI in my environment?
Unit 42 flagged command batches split by delimiters such as "==SHELLUSER==" and "==PASSWD==," plus rapid, serial tasks with quick pivots after failures. It published hunting queries for its Cortex XDR and firewall products.

Which PHP versions fix the flaws?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches need source backports or distribution packages, or an upgrade.

References

• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 — Unit 42, Palo Alto Networks (Oct. 23, 2026)
• PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619) — watchTowr (Oct. 21, 2026)
• php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ — Tenable (updated Oct. 23, 2026)
• PHP2Shell Exploitation Started Days Before Patches — SecurityWeek (Oct. 22, 2026)