Unit 42 reports agentic AI post-exploitation in a PHP2Shell intrusion at a European government entity

Palo Alto Networks' Unit 42 has added a new and unusually specific finding to its threat brief on CVE-2026-109618 and CVE-2026-109619, the pair of critical PHP remote code execution flaws tracked under the name PHP2Shell. In an update stamped October 23, 2026 at 12:30 p.m. Pacific time, the team reported that it had observed attackers using agentic AI attack platforms for post-exploitation activity against a government entity in Europe, and that within two hours of initial exploitation the intruders had reached password hashes and multi-factor authentication secrets.

The same day, the PHP project published an informational advisory about a third, separate remote code execution vector, CVE-2026-115560, which is not fixed by the emergency releases of October 21. The PHP security team describes it as reachable only under an unusual combination of configuration and application code, and it is handling the fix in the regular release cycle rather than through another emergency update.

Taken together, the two updates change the picture of PHP2Shell in a meaningful way. The original disclosure was about memory-safety bugs in the PHP runtime and a race to patch an enormous installed base. The October 23 material adds evidence that at least one intrusion was carried forward by an attacker whose behaviour Unit 42 associates with an autonomous AI agent, and it narrows the margin for organizations that treated the October 21 patches as the end of the story.

··········

TWO CRITICAL FLAWS IN PHP REQUEST HANDLING.

The PHP security team gave advance notice of the release on October 20 and shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Both vulnerabilities carry a CVSS v4.0 score of 9.2, and both can allow unauthenticated remote code execution. According to the PHP advisory, every PHP installation that serves web requests is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project singles out mod_php as the highest-risk configuration because a demonstrated exploit allows an unauthenticated request to trigger the attack before any application code runs.

The two bugs share a theme: PHP's error and resource-exhaustion paths leave internal state in a condition that later code trusts. In the first case, out-of-memory handling can interrupt the runtime while request data is only partially initialized, and request cleanup may then treat that invalid data as valid. In the second, request-owned internal state can survive after its backing memory has been freed, so a later request handled by the same worker can use stale state before normal initialization resets it. Unit 42's description points to the same mechanism from a lower level, attributing both issues to control-flow mismanagement around `longjmp()`, which leaves request memory uninitialized in one case and global pointers aimed at freed regions in the other.

........

CVE	Advisory	Root cause (per PHP)	CVSS v4.0
CVE-2026-109618	GHSA-w8hw-w9fx-j79w	OOM interrupts partially initialized request data	9.2
CVE-2026-109619	GHSA-6wmf-4rv5-p3rp	Stale request state survives after memory is freed	9.2
CVE-2026-115560	Full advisory pending	Session upload progress with runtime serializer switch	Not yet published

........

Unit 42 states that it has seen proof-of-concept code for the October 21 flaws, that at least one European government took its website offline as a precaution, and that Cortex Xpanse identified more than 22.6 million exposed instances that were potentially vulnerable at the time of publication. That figure is an internet-exposure count from Palo Alto Networks' own scanning platform rather than a count of confirmed vulnerable or compromised servers, and the brief gives no regional breakdown.

··········

WHAT UNIT 42 OBSERVED AFTER INITIAL ACCESS.

The new section of the brief describes a single intrusion in detail. After initial exploitation, the attacker enumerated the compromised endpoint through a web shell. The commands captured in Cortex XDR covered reconnaissance of SQL database structures, attempts to locate password storage, reads of LDAP configuration files, and searches for domain controllers and administrator accounts. Within two hours the attacker had accessed password hashes and multi-factor authentication secrets, set up an NTLM-relay tunnel into Active Directory, and attempted to escalate to Domain Admin.

That sequence follows the familiar arc of a web-to-domain compromise: land on a public-facing server, harvest whatever credentials and directory configuration live there, then use relay techniques to move from the web tier into the identity infrastructure. What sets the account apart is the speed and the shape of the activity rather than the techniques themselves. Two hours from a web shell to MFA secrets and a Domain Admin attempt is a compressed timeline for an operation that typically involves a human operator reading output, deciding what matters, and composing the next command.

Unit 42 does not name the agentic platform involved, does not attribute the intrusion to a known group, and does not say whether the European government entity in this case is the same one that took its website offline. The brief also does not state outright which PHP2Shell CVE provided initial access, although the account appears within the threat brief dedicated to the two flaws and is framed as post-exploitation activity following them.

··········

THE BEHAVIOURAL MARKERS BEHIND THE AGENTIC AI ASSESSMENT.

The central question is how Unit 42 concluded that an AI agent, rather than a human operator or a conventional script, was driving the intrusion. The brief points to three behavioural markers and describes them as strong indicators of an agentic attacker. It does not present them as proof, and it does not describe a formal attribution process.

........

Marker	What Unit 42 observed	Why it suggests an agent
Delimited command batches	Output sections wrapped in headers such as ==SHELLUSER== and ==PASSWD==	Produces machine-parseable output for a model to read
Short serial tasks	Small, discrete tasks run one after another	Matches an agent loop that acts, reads and acts again
Fast pivots after failure	Rapid change of approach when a step did not work	Consistent with automated replanning

........

The first marker is the most distinctive. A human operator working through a web shell has little reason to wrap the output of each command in labelled section headers. An agent that sends a batch of commands and then has to parse the combined result has every reason to do so, because the delimiters let a language model split the output reliably and attribute each block to the command that produced it. The other two markers are weaker on their own, since experienced operators and well-built scripts also move quickly, but in combination with the delimiters they describe the observe-decide-act cycle that agent frameworks are built around.

It is worth separating what the evidence supports from what it does not. The markers support the conclusion that the attacker's tooling was designed to feed command output to a model and act on the model's decisions. They do not establish how much of the operation was autonomous, which model was used, or whether a human was supervising the agent and approving its steps. Unit 42's own wording stops at "strong indicators", and any stronger claim would go beyond what the brief publishes.

··········

DETECTION LOGIC PUBLISHED WITH THE UPDATE.

Alongside the agentic AI findings, the October 23 update added Managed Threat Hunting queries. The first is an XQL query for Cortex XDR that looks for post-exploitation command execution spawned by PHP web server or worker processes. It scores a set of signals that includes reconnaissance commands, file downloads, staging through `chmod`, execution from writable directories, reverse shells, pipe-to-shell patterns, encoded execution, persistence, inline interpreters and credential access. The query fires on a standalone high-signal event, on three or more distinct reconnaissance tools, or on reconnaissance combined with a follow-on signal, and it excludes known monitoring and control-panel workloads.

Unit 42 is explicit that this query is not specific to the PHP2Shell CVEs and may produce false positives, and it asks defenders to validate hits against expected application behaviour. That caveat matters because the query is effectively a behavioural detector for any web shell activity under PHP, which is also why it is relevant to agentic intrusions: it does not depend on a payload signature, only on what the attacker does after landing.

The second query targets Palo Alto Networks NGFW threat logs. It looks for inbound vulnerability events from public IP addresses to non-untrusted zones, matching threat ID 543004 or threat names containing strings such as php, multipart, upload.progress, longjmp or the two CVE identifiers, and aggregates hits by threat, destination, port and zone. According to the brief, Advanced Threat Prevention Plus has offered virtual patching for the flaws since 10:21 p.m. Pacific time on October 20, 2026 under threat ID 543004, and standard Advanced Threat Prevention signatures followed on October 21 under IDs 543004 and 97622 through 97625. Those are vendor product protections and are relevant mainly to existing Palo Alto Networks customers.

··········

A THIRD RCE VECTOR AND THE MITIGATIONS THAT STILL APPLY.

The PHP project's October 23 advisory concerns CVE-2026-115560, a remote code execution issue tied to session upload progress. The project describes the conditions precisely. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration, then switch it to `php` at runtime with `ini_set()` before calling `session_start()`, while session upload progress remains enabled. Applications that never change the serialize handler at runtime are not exposed and can keep the feature on. Because the project considers this setup unlikely in practice, it will publish the full advisory and fix with the next regular release and has not named a fixed version.

The interim mitigation is the same setting that already appeared in the October 21 advisory for CVE-2026-109619: disable session upload progress and restart workers. The PHP project notes that administrators who applied it then and kept it in place need to do nothing further.

; php.ini / FPM pool / server config (applied before request parsing)
session.upload_progress.enabled = 0
post_max_size = 8M          ; 32M if uploads are required
upload_max_filesize = 8M    ; must stay below post_max_size
; memory_limit = -1         ; see the caveats above; set via php_admin_value in FPM
; fatal_error_backtraces = 0 ; PHP 8.5 only

This configuration block is taken from the PHP project's October 21 advisory, which presents these settings as exposure reduction for systems that cannot update immediately and stresses that they do not make an installation safe. The project adds several operational caveats: the setting must be applied in `php.ini`, an FPM pool or server configuration rather than through `ini_set()` or FPM `.user.ini`; `memory_limit=-1` must not be overridden by any pool, directory or application setting; and `RLIMIT_AS` or `RLIMIT_DATA` should not be used as a memory boundary, because they can trigger the very allocation failure that leads to the vulnerable path.

........

Branch	Fixed release	Notes from PHP
8.5	8.5.12	Also set fatal_error_backtraces=0 if not updated
8.4	8.4.27	Fixes CVE-2026-109618 and CVE-2026-109619
8.3	8.3.36	Fixes CVE-2026-109618 and CVE-2026-109619
8.2	8.2.35	Branch reaches end of life on December 31, 2026
8.1 and older	No project update	Minimal source backports for 7.4, 8.0 and 8.1

........

PHP 8.6.0 RC4 also contains the fixes, although the project advises against using a release candidate in production. For CVE-2026-115560 specifically, none of the releases in this table is described as a fix, so the session upload progress setting remains the relevant control until the next regular release.

··········

WHAT THE OCTOBER 23 UPDATES ESTABLISH AND WHAT REMAINS OPEN.

The verified facts are clear. Two critical PHP remote code execution flaws, both rated 9.2 under CVSS v4.0, were patched on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with mod_php identified by the PHP project as the highest-risk deployment. Unit 42 reports proof-of-concept code, more than 22.6 million potentially vulnerable exposed instances by its own scanning, and one intrusion at a European government entity in which the attacker reached password hashes and MFA secrets within two hours and attempted Domain Admin escalation through an NTLM-relay tunnel. The PHP project separately confirmed CVE-2026-115560, an unpatched but narrowly scoped RCE vector that the existing upload progress mitigation already blocks.

The agentic AI element is a vendor assessment based on behaviour: labelled output delimiters, short serial tasks and rapid replanning after failure. It is a credible reading of those markers, and it is notable because it describes AI-assisted operation inside a real post-exploitation chain rather than in a laboratory exercise. It is not yet independently corroborated, the platform and operator remain unidentified, and the degree of autonomy is not described. Canada's Canadian Centre for Cyber Security stated in its alert, updated on October 23, that it had not identified active exploitation while noting that this could change quickly, which places considerable weight on Unit 42's single observed case.

For defenders, the practical consequence is that the window between initial access and identity compromise may be shorter than incident response plans assume when the attacker's tooling can read and act on command output without waiting for a human. Patching PHP and disabling session upload progress addresses the known entry points, while behavioural detection of command execution under PHP worker processes and close monitoring of NTLM relay and directory activity address what happens if an attacker is already inside.

··········

FOLLOW US FOR MORE.

·····

DATA STUDIOS

·····

datastudios.org