In one notable incident, attackers targeted a government entity in Europe. Within two hours of the initial exploitation, they had successfully accessed password hashes and multi-factor authentication data, according to reporting on the campaign. The use of AI-assisted tooling in the post-exploitation phase marks a concerning shift, as it appears to accelerate the speed at which attackers move from initial access to credential theft.

Key points from the reporting:

• Exploitation centers on the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619
• A European government entity was compromised, with password hashes and MFA-related data accessed within two hours of exploitation
• Global scanning for vulnerable systems is underway
• Threat actors have been observed using agentic AI platforms for post-exploitation activity

Organizations running affected PHP-based systems should prioritize patching and review authentication logs for signs of compromise, particularly unusual access to credential stores or MFA configurations.

Source: info@thehackernews.com (The Hacker News)

Has your organization scanned for exposure to these PHP2Shell vulnerabilities yet, and if so, what did you find?