Unit 42 Says Attackers Using an Agentic AI Platform Reached a European Government's Password Hashes and MFA Secrets Within Two Hours of a PHP2Shell Exploit, Leaving Machine-Readable Markers in Every Command Batch

LONDON - Attackers who broke into a European government system through the PHP flaws known as PHP2Shell handed the rest of the job to an AI agent, and within two hours it had reached password hashes and multi-factor authentication secrets, according to an update Palo Alto Networks' Unit 42 published on Friday.

"Unit 42 researchers also observed attackers using agentic AI attack platforms for post-exploitation activity," the researchers wrote in the Oct. 23 revision of their threat brief on CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws in PHP that are each rated 9.2 under CVSS 4.0. In the case they describe, the intruders also "established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation."

How the agent gave itself away

What marked the activity as machine-driven was its formatting. "Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==," Unit 42 wrote. "These delimiters produce machine-parseable output for an AI model to read." The researchers also pointed to short, serially spaced tasks and quick pivots after failures.

Figure 1 in the brief, captured in Cortex XDR, shows apache2 starting a series of sh processes. One batch logged into a MySQL database with stolen credentials and counted, then sampled, user rows with password hashes and stored 2FA secrets. Another used curl to send anonymous LDAP queries to a domain controller, ending with a search for the account named administrator. A third read nsswitch.conf, resolv.conf, the hosts file, privileged groups and /etc/passwd. Unit 42's annotations describe the LDAP step as living-off-the-land Active Directory reconnaissance.

The update arrives as exposure remains wide. Unit 42 says Cortex Xpanse has identified more than 22.6 million exposed instances potentially vulnerable to the two flaws, and that at least one European government has taken its website offline as a precaution.

The hunting query

Unit 42's managed threat hunting team published two Cortex XDR queries with the update. The first anchors on processes started by PHP web workers or their launchers, including apache2, httpd, php-fpm, php-cgi, frankenphp, lsphp and litespeed, on cmd.exe, powershell.exe or pwsh.exe under the IIS worker w3wp.exe, and on web service accounts such as www-data, apache, nginx, wwwrun and iusr running commands outside an interactive login. It filters out known monitoring plugins and hosting control panels.

The query then tags each event with signals: host and network reconnaissance, file downloads, chmod in temporary directories, execution from writable or memory-backed paths, reverse shells, content piped into an interpreter, encoded commands, persistence, inline interpreter one-liners and access to cloud or container credentials. It groups activity per host, PHP worker and account in one-hour buckets and fires on any reverse shell, pipe-to-shell or writable-path execution, on three or more distinct recon tools, or on recon plus a follow-on signal.

The second query looks at Palo Alto Networks firewall threat logs for inbound attempts from public addresses, matching threat ID 543004 or threat names that reference PHP, multipart, upload progress, longjmp or the two CVEs.

Unit 42 cautions that the process query "is not specific to CVE-2026-109618 and CVE-2026-109619" and "may also produce false positive findings depending on the specific web applications running."

What defenders can do

• Patch PHP following the PHP Group's guidance, starting with internet-facing servers and vendor products that bundle PHP.
• Port the process logic to your own EDR or SIEM: a PHP worker, IIS worker or web service account starting shells, recon tools, downloaders or interpreters is the core signal, whatever the exploit.
• Search web server command lines for echoed section headers wrapped in double equals signs, such as ==SHELLUSER== or ==PASSWD==, and for bursts of short recon commands from the web user.
• Watch domain controllers for anonymous LDAP queries and NTLM authentication sourced from web servers, and check for Domain Admin group changes.
• If a web host is confirmed compromised, treat the database credentials it held and any MFA secrets stored in its application database as exposed, and rotate them.
• Validate hits against expected application behavior before blocking, as Unit 42 recommends.