The October 21 PHP security release preceded evidence that the exploit surface was reaching real organizational systems. Unit 42 reports a European-government intrusion associated with PHP2Shell. Within two hours of the initial compromise, attackers obtained password hashes and multifactor-authentication secrets, opened an NTLM relay tunnel into Active…
Inspect the ClaimsCase · DiggingBeagle record
PHP2Shell attackers reached European government credentials with agentic workflow indicators
Unit 42 observed post-exploitation at a European government after PHP2Shell exploitation: password hashes and MFA secrets were accessed, and an NTLM relay tunnel was established. Command structure suggested an agentic attacker, without identifying a model or proving autonomous control.
Scope
Observed production post-exploitation following the October 2026 PHP engine vulnerabilities CVE-2026-109618 and CVE-2026-109619. Single described European-government intrusion is not a worldwide compromise census. Attribution to a specific AI model is unverified.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- BY AI
Basis and provenance
Primary incident-response account reports confirmed execution and credential access. Agentic attribution rests on workflow markers; no named autonomous model or complete external victim denominator is established.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-PHP-GOV-ACCESS · CLM-PHP-GOV-RELAY · CLM-PHP-GOV-AGENT-SIGNS · CLM-PHP-GOV-EXPOSURE-DENOM · Unit 42: PHP2Shell exploitation and AI-like post-exploitation at European government
At a glance
This is measured post-exploitation after a genuine intrusion, with observed credential access and attempted domain escalation. The AI-specific portion is an inference from command structure and task cadence, not independent proof of a named autonomous model. The vendor’s 22.6 million potentially exposed instances are not 22.6 million verified vulnerable or…
Read the implicationsThe identity of the specific model or agent framework used by the attacker is unknown. Unit 42 does not establish a successful Domain Admin compromise. The total number of unrelated organizations successfully exploited by this actor is not established.
Limits and uncertaintyFull account
The October 21 PHP security release preceded evidence that the exploit surface was reaching real organizational systems. Unit 42 reports a European-government intrusion associated with PHP2Shell. Within two hours of the initial compromise, attackers obtained password hashes and multifactor-authentication secrets, opened an NTLM relay tunnel into Active Directory, and attempted to reach Domain Admin. The attempt should not be mistaken for proof that Domain Admin was obtained.
Unit 42 interpreted the post-exploitation activity as agentic because command batches carried machine-readable delimiters such as ==SHELLUSER== and ==PASSWD==, tasks arrived in short sequences, and the workflow rapidly shifted after errors. Those details provide evidence of scripted, model-oriented orchestration, not a trace identifying which model generated the commands or whether each decision was autonomous.
This case extends rather than replaces the existing Digging Beagle PHP2Shell research Case, which describes the AI-assisted discovery, engine failure and patch. A reported 22.6 million externally exposed, potentially vulnerable instances is a product-telemetry estimate, not a count of installations confirmed unpatched and certainly not a count of victims. Earlier scans, precautionary public-site shutdowns and later confirmed credentials access belong to separate evidence categories.
Primary investigation: https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
Unit 42 identifies a genuine post-exploitation timeline: after entering the government environment, the attacker reached password hashes and MFA-related secrets within two hours, established an NTLM-relay tunnel, then attempted higher privilege. The investigation also observed machine-readable command headers and short serial pivots, which support an agentic-workflow indicator, not a reliable identification of the model or proof that every action ran without human involvement. This case's denominator is one described government intrusion; the separate estimate of 22.6 million potentially exposed instances cannot be used as a victim count. Original telemetry.
Mechanism and trust boundary
- 01
Gain an execution foothold via PHP2Shell
The incident is associated with CVE-2026-109618 and 109619 exploitation against a European government environment.
Boundary: Exposed PHP interpreter / compromised web-server execution
- 02
Enumerate host and credential material
Within two hours the attacker accessed password hashes and multifactor-authentication secrets according to Unit 42.
Boundary: Web-server privileges / identity secrets
- 03
Relay authentication and attempt privilege escalation
The attacker established an NTLM relay tunnel toward Active Directory and attempted Domain Admin escalation.
Boundary: Compromised host network / domain administrative authority
- 04
Assess actual agentic-control evidence
Machine-parseable command delimiters and quick task pivots indicated agent tooling to Unit 42; they did not expose the model identity or show a fully autonomous attack.
Boundary: Observed commands / inferred attacker architecture
Timeline
- Oct 21, 2026Event type unspecified
PHP security fixes disclosed
The two engine vulnerabilities were patched by the PHP maintainers; service exposure depends on installed versions and application pathways.
- Oct 23, 2026Event type unspecified
Observed government compromise reported
Unit 42 added technical details of credential access, NTLM relay and agentic indicators.
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-PHP-GOV-RELAYIn the same observed intrusion, attackers established an NTLM relay tunnel into Active Directory and attempted Domain Admin privilege escalation. A successful Domain Admin takeover is not established.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Executive Summary: NTLM relay tunnel and attempted Domain Admin escalation
CLM-PHP-GOV-ACCESSUnit 42 reports that attackers exploited a PHP2Shell-affected European government organization and within two hours accessed password hashes and multifactor-authentication secrets.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Executive Summary: government exploitation and first two hours of post-exploitation
CLM-PHP-GOV-AGENT-SIGNSUnit 42 interprets short, serially spaced commands, parser-friendly ==SHELLUSER== and ==PASSWD== headers, and rapid pivots after errors as strong indicators of an agentic attack platform; the specific model, controller and degree of human supervision are not identified.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Executive Summary: agentic platform indicators and Figure 1 web shell recon
CLM-PHP2-ENRICH-CONFIRMEDUnit 42 reports a European government intrusion in which attackers reached password hashes and MFA secrets within two hours, set up an NTLM relay tunnel and attempted Domain Admin escalation.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Executive Summary; October 23 agentic post-exploitation update
CLM-PHP-GOV-EXPOSURE-DENOMUnit 42 counted over 22.6 million exposed potentially vulnerable instances in exposure telemetry; the count does not establish 22.6 million vulnerable versions or compromised victims.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Executive Summary: Cortex Xpanse identified over 22.6 million exposed instances potentially vulnerable
CLM-PHP2-ENRICH-ATTRIBUTIONUnit 42 inferred agentic operation from machine-parseable command delimiters and rapid retries; its public evidence does not identify an autonomous model instance or prove that AI selected all actions.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Command delimiters and Cortex XDR trace description
CLM-PHP2-ENRICH-DENOMINATORThe vendor reported over 22.6 million potentially exposed instances in telemetry; that number is not a count of confirmed exploited or verified vulnerable endpoints.supported
Basis: reported finding
- supportsUnit 42: PHP2Shell exploitation and AI-like post-exploitation at European governmentprimary disclosure
Cortex Xpanse exposed instances metric
Implications
This is measured post-exploitation after a genuine intrusion, with observed credential access and attempted domain escalation. The AI-specific portion is an inference from command structure and task cadence, not independent proof of a named autonomous model. The vendor’s 22.6 million potentially exposed instances are not 22.6 million verified vulnerable or compromised systems.
Controls and mitigations
- Patch affected PHP runtimes and audit reachable applications. If compromise occurred, treat credential hashes and MFA recovery material as exposed, invalidate credentials where applicable, inspect lateral movement and re-establish trust beyond the patched web server.
Unknowns and contradictions
- The identity of the specific model or agent framework used by the attacker is unknown.
- Unit 42 does not establish a successful Domain Admin compromise.
- The total number of unrelated organizations successfully exploited by this actor is not established.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188