Security researchers have uncovered a high-stakes breach targeting a European government organization, exploiting PHP2Shell vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. Attackers gained access to password hashes, multi-factor authentication (MFA) secrets, and even launched NTLM relay tunnels into Active Directory, aiming for domain admin privileges—within just two hours of initial compromise, they had already begun deep lateral movements. Automation and AI observers note that the post-exploitation behavior suggests use of agentic AI systems to streamline credential harvesting and privilege escalation.
Global Scanning Campaign Tied to North Korea’s Lazarus Group
CYFIRMA has traced a coordinated scanning effort to what it assesses as a Korean-speaking actor likely affiliated with the Lazarus Group. The campaign has probed over 200 unpatched or partially mitigated PHP hosts spread across the U.S., Europe, Japan, Southeast Asia, and the Middle East—targeting sectors such as government, finance, manufacturing, logistics, aviation, and online transactions. Scanning activity has been deliberately paced and dispersed, with rotating nodes to avoid detection, often stopping network probes when encountering rate-limiting or blocking measures.
The Lazarus link is reinforced by use of a covert I2P channel with operators previously observed in DPRK-aligned covert operations. Shared infrastructure, exploit tactics, and publicly known past campaigns—such as watering-hole attacks and PHP/WordPress web shells—mirror the group’s known modus operandi. Especially worrying is that the actors are already exhausting reconnaissance in order to select targets for exploitation and weaponization.
Detection, Exploitation Mechanics, and Mitigation Advice
Defused Cyber and Palo Alto Networks have both flagged early scanning efforts. In one case, requests bearing a PHP_SESSION_UPLOAD_PROGRESS marker indicate spoofed file uploads and checks for vulnerable upload behaviors. Millions of exploit attempts across PHP infrastructure have been observed since the flaws went public. Successful exploitation depends on crafting request payloads to fail allocations just right, bypassing ASLR protections, and abusing form-field name handling to trigger memory corruption.
Defenders have been offered signs to spot: a POST request that returns a 500-internal error; log entries reflecting memory exhaustion and heap corruption; an Apache worker crash following the request. Panic-button patches from the PHP Foundation address both critical vulnerabilities, but there is also a third flaw looming (CVE-2026-115560). While it requires specific configurations—such as session.serialize_handler changes and session upload progress settings—it’s another vector to monitor and patch.
Tools are being released: Xint’s phpguard.io offers scanning to flag exposure, and Bitsight shows nearly 37 million internet-facing hosts running PHP software—with many in the U.S., Germany, France, Netherlands, and Japan—making comprehensive patching essential. Web application firewalls or plugin updates won’t fully stop these risks; the fix lies in updating PHP at the host level.
This breach is part of a rising trend where nation-state actors increasingly leverage AI-assisted workflows to speed up post-exploitation cycles. The speed and automation observed in stealing credentials, mapping Active Directory, and establishing privilege escalation pathways suggest malicious use of agentic AI. For defenders, that raises the stakes: detection windows are shrinking and attack patterns are intensifying. Going forward, keeping systems patched, applying defense in depth around authentication and access controls, monitoring for anomalous AD behavior, and prioritizing infrastructure resilience against memory-corruption exploits are no longer optional—they’re essential.
