Agentic AI attackers steal European government password hashes within two hours of PHP2Shell exploit

For most of the internet's public-facing history, PHP has been the plumbing nobody looks at: the runtime behind blogs, storefronts, forums, hospital portals and government service pages. That anonymity ended in the third week of October 2026, when the PHP project pushed emergency releases for two remote code execution flaws that let an attacker run commands on a web server without any credentials at all. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and the security community quickly gave them a collective nickname: PHP2Shell.

The flaws were not new discoveries in the ordinary sense. TechCrunch reported on October 24, 2026 that the issues were first found in 2024 during an audit but were not judged exploitable at the time. What changed was proof. Calif produced a working exploit, and OpenAI and Wiz verified proof-of-concept code under the Hack the Planet coordinated disclosure effort. From that point the question stopped being whether the bugs could be weaponized and became how fast defenders could patch a runtime embedded in an estimated 70 percent of the web-facing internet.

The answer, on the evidence so far, is not fast enough. Banks, retailers, gaming sites, hospitals and government agencies pulled services offline to patch, according to TechCrunch. Amazon said it had detected exploitation roughly a week before the patches existed and told defenders to look back to October 17; the first hit arrived from a commercial anonymization network. The PHP Foundation, meanwhile, blamed one company for pushing patches live hours before the embargo ended, a detail that matters because early patching narrows the window in which defenders can be caught unprepared but widens the window for attackers who reverse-engineer the fix.

Against that backdrop, Palo Alto Networks Unit 42 reported on October 23, 2026 that the post-exploitation phase of the PHP2Shell attacks was being driven by agentic AI attack platforms, and that in at least one case the machine speed of that phase turned a routine compromise into a full credential breach in under two hours.

Key Facts

Unit 42's threat brief rates the two vulnerabilities at 9.2 under CVSS 4.0. CVE-2026-109618 is described as a remote code execution flaw that arises from out-of-memory handling through longjmp(): an OOM event can interrupt PHP while internal request data is only partially initialized, and cleanup code can then treat invalid data as valid. CVE-2026-109619 is a stale global state bug, in which request-owned internal state survives after its backing memory is freed and can be read or branched on by a later request handled by the same worker.

The firm's most striking finding concerns a government entity in Europe. Unit 42 reported on October 23, 2026 that attackers using agentic AI attack platforms had, within two hours of the initial exploitation, accessed password hashes and multi-factor authentication secrets. They also established an NTLM relay tunnel into Active Directory and attempted to escalate to Domain Admin.

The mechanics of the AI layer were visible in the attackers' command traffic. Unit 42 said command batches were wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, producing machine-parseable output for an AI model, with short, serially spaced tasks and quick pivots after failures. That is a workflow built for a parser rather than a human operator reading a terminal.

Exposure numbers are large. Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to the two CVEs. Express Computer reported on October 24, 2026 that Unit 42's figure is a measure of exposure rather than confirmed compromise and should not be read as 22.6 million compromised systems.

Check Point Research said in an update on October 22, 2026 that 10 percent of organizations in its global telemetry had been affected, defined as exploitation attempts rather than confirmed successful attacks. Europe recorded 14 percent, while North America, Latin America and Asia-Pacific each recorded 6 percent, and India recorded 14 percent. Cloudflare said it deployed WAF protections about nine hours before public disclosure and that its rules could block denial of service, remote code execution and data exposure attempts.

Analysis

What this really means is that the patch window and the exploitation window have stopped being measured on the same clock. Historically, defenders assumed a gap of hours to days between the appearance of a working exploit and the moment an intruder held usable credentials, which gave incident response teams time to isolate hosts and rotate secrets. Unit 42's two-hour timeline compresses that into a single automated sequence, and it does so on the post-exploitation side, after the patch decision has already been lost.

PHP's own security advisory, published October 21, 2026, makes clear why the first move has to be a version upgrade. All PHP installations serving web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with risk rated highest for mod_php, where a demonstrated exploit can trigger before any application code runs. The project states that there are no complete mitigations and that updating is the only safe choice. Interim measures, such as setting memory_limit=-1, lowering post_max_size, disabling session.upload_progress and setting fatal_error_backtraces=0 on PHP 8.5, block only specific attack paths.

The AI angle deserves precision rather than panic. Unit 42 described agentic platforms used for post-exploitation, not for discovering the vulnerabilities, and Check Point's 10 percent figure counts exploitation attempts, not confirmed breaches. The defensible judgement is that AI did not create the PHP2Shell crisis, but it removed the friction that used to slow an intruder down once inside, which is where many real incidents are actually lost.

Vendors quoted by Express Computer made a related point that is easy to miss: updating a CMS or a plug-in does not fix the runtime, and WAF or IPS rules are not a substitute for updating PHP itself. Cloudflare's nine-hour head start on disclosure is a genuine mitigation, but it is a filter in front of a vulnerable binary, not a repair.

Why It Matters

Roughly 70 percent of the web-facing internet relies on PHP, including WordPress, Drupal, Joomla and MediaWiki, which powers Wikipedia. A flaw class that allows unauthenticated remote code execution therefore reaches far beyond any single vendor's customer list, and it lands on exactly the organizations least able to absorb an outage: hospitals, retailers and government agencies that took services offline to patch.

The European government case shows what the tail of that distribution looks like. Password hashes and MFA secrets are the material an attacker needs to keep operating after the initial hole is closed. An NTLM relay tunnel into Active Directory and an attempt at Domain Admin escalation turn a web server compromise into a directory-wide problem, and the two-hour clock means the response team may learn about the intrusion from the same logs the attacker has already mined.

There is also a measurement problem. Engineers now have to separate 22.6 million potentially vulnerable exposed instances from confirmed compromises, and separate 10 percent exploitation attempts from successful attacks. Conflating them produces either complacency or panic, and both lead to bad decisions in the first 48 hours.

Next Up

Researchers quoted by TechCrunch warned that many systems remain unpatched and the incident is not over. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life, minimal source backports were provided for PHP 7.4, 8.0 and 8.1, and the remirepo repository would not carry updates that day, which leaves a long tail of hosts that cannot simply be upgraded.

Unit 42 also noted that at least one European government took its website offline as a precaution. Expect the next phase to focus on credential rotation in directories touched by relay activity, on hunting for the delimiter patterns in command logs, and on the harder question of how incident response keeps pace when the other side runs on an AI platform that does not get tired.