Palo Alto Networks’ Unit 42 has documented attackers using agentic AI attack platforms for post-exploitation of the PHP2Shell vulnerabilities. According to the threat brief updated on October 23, one attack targeted a government entity in Europe: within two hours of the initial exploitation, the attackers had accessed password hashes and multi-factor authentication secrets, established an NTLM-relay tunnel into Active Directory, and attempted to escalate to Domain Admin. The attack’s commands were wrapped in machine-readable delimiters such as ==SHELLUSER== and ==PASSWD== — output formatted for an AI model to process, not a human. Cortex Xpanse telemetry identified 22.6 million exposed instances potentially vulnerable to the two flaws, which carry a CVSS score of 9.2.
How the Agentic Attack Worked
PHP2Shell — CVE-2026-109618 and CVE-2026-109619 — are remote code execution flaws in PHP itself. The first lets attackers achieve RCE when PHP mishandles out-of-memory errors via longjmp(), leaving request memory uninitialized. The second leaves global memory pointing to freed regions that later requests can read or branch on, enabling arbitrary code execution.
Unit 42 says attackers have moved past proof-of-concept exploits into AI-driven post-exploitation. In the European government case, the timeline was compressed to hours: password hashes and MFA secrets within two hours of the initial breach, then the NTLM relay into Active Directory and an attempted Domain Admin escalation. At least one European government has taken its website offline as a precaution.
The Tell-Tale Signs of an AI Attacker
What convinced Unit 42’s researchers they were watching an agent, not a person, was the structure of the attack itself. Each command batch was wrapped in section-header delimiters — ==SHELLUSER==, ==PASSWD== and similar — that produce machine-parseable output for an AI model to read. The commands came in short, serially spaced tasks, with quick pivots after failures.
The pattern is systematic rather than skilled: enumeration, credential theft, lateral movement, privilege escalation, each step formatted so an AI can evaluate the output and plan the next move. Unit 42 describes the markers as strong indicators of an agentic attacker — the same automation that makes agents useful for defenders is now doing the intruder’s tradecraft.
The Scale of Exposure
The 22.6 million figure from Cortex Xpanse telemetry counts exposed instances potentially vulnerable to the two CVEs — it is a measure of attack surface, not of confirmed compromises. But it explains the urgency: PHP runs behind a large share of the web’s servers and content management systems, and every exposed instance is a candidate for the same automated pipeline.
The brief’s publication has also become part of the response. Unit 42 ships the detection logic with it: a hunting query for post-exploitation command execution under PHP web workers, plus product protections across Cortex XDR, XSIAM, Cortex Cloud and Advanced Threat Prevention.
Why It Matters
This is the moment the warnings about AI-discovered vulnerabilities started coming true in the open. The flaws themselves were found with AI assistance — the two flaws that AI models helped uncover earlier this week — and now the exploitation is AI-assisted too. The full loop, from discovery to automated intrusion, ran inside a single week.
It also validates the Reuters piece warning that AI-discovered bugs could trigger fresh disruptions: the experts quoted there worried about exactly this acceleration, and Unit 42 has now documented it against a real government target. Defenders are no longer racing human operators working at human speed; they are racing agents that enumerate, pivot and escalate in hours. The exposure count — 22.6 million potentially vulnerable instances — is the denominator of that race.
Background
PHP2Shell broke on October 21, when patches landed for the two critical flaws and the mass exploitation wave that followed pushed governments and companies into a patching rush — Japan is now planning AI cyberattack simulations in response. Unit 42’s October 23 update is the first detailed account of how the attackers are actually operating inside compromised servers, and it shows the exploitation has already evolved from manual probes to agentic campaigns.
Source: Palo Alto Networks Unit 42 — Threat Brief: Critical Vulnerabilities in PHP; Express Computer — PHP2Shell: Security vendors race to contain a critical vulnerability
0 Comments