The report
The PHP2Shell response now includes a confirmed post-exploitation account rather than only proofs of concept and scanner activity. In an October 23 threat brief, Unit 42 describes a European government intrusion in which attackers obtained password hashes and multifactor-authentication secrets within two hours and established an NTLM relay tunnel into Active Directory. The researchers observed an attempt to escalate to Domain Admin, not a verified successful takeover of that role.
The command stream contained parser-friendly headers and tightly spaced reconnaissance steps, leading Unit 42 to characterize the tooling as agentic. Neither the underlying model nor the degree of human supervision is identified. That evidence is materially different from claims that an AI agent independently discovered and compromised a site.
Earlier PHP2Shell reporting established two October 21 patched engine vulnerabilities and separate exploit research. These observations must be kept on their own dates: research discovery and proof, public patch release, observed attempts, and the October 23 production incident report. A potential-exposure telemetry estimate exceeding 22.6 million cannot be reported as either confirmed vulnerable versions or completed compromises.
See the separate original PHP2Shell research record, reported intrusion record, and Unit 42 primary account.
What the telemetry can and cannot count
Unit 42 reports parser-friendly command headers such as ==SHELLUSER== and ==PASSWD==, short sequential tasks and quick pivots after failed operations as indicators of an agentic attacker. Those are observable command properties, not model logs or proof of fully unattended operation. The report’s exposure metric of over 22.6 million potentially exposed instances also has a different denominator from the single described European government incident. Investigators should preserve the separation between an independently patched PHP vulnerability, an observed organizational compromise, and attribution to a particular autonomous system. Observed commands and October 23 update.
Three dates, three different facts
The underlying PHP fixes were publicly released on October 21. Unit 42's October 23 report adds a separate government incident with specific post-exploitation artifacts: credential material reached in a two-hour window and an NTLM relay tunnel, followed by an attempted privilege escalation. Parsing headers and rapid task changes are meaningful workflow indicators, although they do not name the operator's model or prove unattended operation. The case should be counted as a reported organizational intrusion, not as 22.6 million exposed deployments or as an additional vulnerability discovered on October 23. Unit 42's observation.