The critical PHP vulnerabilities known as PHP2Shell are no longer just a matter of scanning and proof of concept code. Unit 42, the research team at Palo Alto Networks, has described a case where attackers used them to break into a European government body and, within two hours of the initial exploitation, obtained password hashes and multi-factor authentication (MFA) secrets. If PHP runs on your servers and you have not deployed the 21 October update yet, treat it as work for today.

What happened

PHP is the programming language behind a large share of websites and content management systems. The two flaws CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, let an attacker run their own code on the server without authentication. Both are rated 9.2 under CVSS 4.0. PHP released the fix on 21 October 2026 and we covered it the same day on our blog.

What is new is the post-exploitation activity. In its threat brief of 23 October, Unit 42 states that at one European government body the attackers first went after password hashes and MFA secrets from the authentication database, established an NTLM relay tunnel into Active Directory and attempted to escalate to Domain Admin. According to Unit 42, two hours passed between the initial exploitation and the theft of credentials.

Unit 42 also describes markers of an attacker driven by agentic AI, that is a model planning its own next steps. Command batches were wrapped in delimiters such as ==SHELLUSER== and ==PASSWD== to make the output machine readable, tasks followed each other in short bursts and failures were followed by quick pivots. The practical consequence is a single one, but it matters: the gap between the break-in and the theft of credentials may be minutes rather than hours.

The second report is about targeting. On 25 October the company CYFIRMA described a campaign that uses 21 compromised nodes to probe 216 unpatched or only partly mitigated servers slowly and at low volume. The targets reportedly include government bodies, financial institutions, logistics, airports, manufacturing and payment platforms, the European Union among the regions affected. The operators abandon nodes at the first sign of blocking, so alerting based on the number of attempts will not catch the campaign. CYFIRMA attributes it with moderate confidence to the wider North Korean Lazarus ecosystem, so treat the attribution as a vendor assessment rather than an established fact.

On the scale of exposure, Unit 42 reports that Cortex Xpanse telemetry sees more than 22.6 million exposed instances that may be vulnerable. That is a vendor figure and it describes exposure, not the number of confirmed vulnerable or compromised organisations.

Does this affect you?

It affects every server where PHP serves web traffic, whether it is a public website, an internal application or an administration console. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches that are out of support will not receive the fix and need to be moved to a supported version.

Two things are missed most often. The first is that updating a content management system, a plugin or an application does not replace a vulnerable PHP interpreter. You need to find the runtime that actually serves web traffic (php-fpm, mod_php, php-cgi, FrankenPHP or lsphp with LiteSpeed), update that one and restart the workers. The second is that PHP is often bundled inside enterprise products and management consoles that you do not maintain yourself. We summarised the vendor status for firewalls and consoles on our blog on 22 October.

What to do now

How to tell whether you have been compromised

Unit 42 published hunting queries (XQL for Cortex XDR) that look for processes started in the context of a web server or a PHP worker, meaning children of processes such as apache2, httpd, php-fpm, php-cgi, frankenphp or lsphp. You can apply the same logic in another tool: a shell or a system command started from a web worker is suspicious in almost every case. Unit 42 notes that the query is not specific to these two flaws and may report legitimate activity, so findings need to be compared with what your applications normally do.

In the case described, the activity consisted of reconnaissance of the authentication database with the stolen credentials, anonymous LDAP queries to the domain controller via curl while looking for the administrator account, and then the NTLM relay. The delimiters wrapping the output are another thing worth searching for in logs.

No time to keep track of this?

If you run security alongside other work, it helps to have someone who follows this for you and tells you what actually concerns your organisation. At CypherOn we work as part of the customer team and we stand behind our recommendations until they are really in place. If you are dealing with an incident right now, reach us through the incident response page. If you want to know where you stand, start with a security assessment or write to us on the contact page. The initial consultation is free of charge.

Sources: Unit 42, PHP2Shell threat brief and intrusion details · CERT-EU, advisory 2026-018 on critical PHP vulnerabilities · NVD, CVE-2026-109618 · The Hacker News, campaign and scanning reported by CYFIRMA