Artificial Intelligence · Cybersecurity
PHP2Shell hits government entity amid wider scanning
Palo Alto Networks Unit 42 said attackers used PHP2Shell against a European government entity, while other security firms reported broader scanning, exploit attempts and related detection guidance.
- Palo Alto Networks Unit 42 said attackers used the PHP2Shell flaws against a government entity in Europe and obtained password hashes and multi-factor authentication secrets within two hours.
- Unit 42 said the attackers set up an NTLM relay tunnel into Active Directory and tried to escalate to Domain Admin.
- CYFIRMA said it found a suspected North Korea-linked campaign probing PHP infrastructure from 21 compromised nodes and listed 216 unpatched or partly mitigated hosts.
- Defused Cyber said it saw probes against its Palo Alto Networks GlobalProtect honeypots from 204.76.203[.]7, and Cloudflare said it had seen millions of exploitation attempts after disclosure.
Palo Alto Networks Unit 42 said attackers used the PHP2Shell flaws against a government entity in Europe. It said they gained password hashes and multi-factor authentication secrets within two hours, then set up an NTLM relay tunnel into Active Directory and tried to reach Domain Admin rights.
CYFIRMA said it had seen a separate campaign probing PHP systems from 21 compromised nodes. It said 216 unpatched or partly mitigated hosts were in scope across sectors including government, finance, logistics, airports, aviation, manufacturing and online payments.
Kumar Ritesh said the scanning was kept low and spread across rotating nodes so rate-limiting would be less likely to trigger alerts. CYFIRMA said the operation used a closed I2P channel and linked it with moderate confidence to a Korean-speaking operator and the Lazarus Group ecosystem.
Defused Cyber said it had seen PHP2Shell probes against its GlobalProtect honeypots from 204.76.203[.]7, with requests carrying a PHP session upload progress marker and a dummy upload. Cloudflare said it had recorded millions of exploitation attempts after disclosure, and ReliaQuest said it reproduced CVE-2026-109618 in a lab and found a log sequence that could help defenders spot exploitation.
The PHP Foundation warned about CVE-2026-115560, which it said needed a particular configuration and runtime change to arise. Xint released a scanner, and Bitsight said it had counted nearly 37 million internet-facing systems running PHP or related software.
Named in this story
People
- Kumar Ritesh
- said the scanning was low-volume and node-rotated
Companies
- CYFIRMA
- said it found a suspected North Korea-linked PHP2Shell campaign
- Defused Cyber
- said it saw PHP2Shell probes against its honeypots
- Cloudflare
- said it detected millions of exploitation attempts after disclosure
- Datadog
- explained how the PHP exploit worked
- ReliaQuest
- said it reproduced CVE-2026-109618 in a lab
- Xint
- released a scanner for PHP2Shell exposure
- Bitsight
- said nearly 37 million systems ran PHP or related software
Organisations
- Palo Alto Networks Unit 42
- said attackers reached a European government entity and traced post-exploitation activity
- Lazarus Group
- was the cluster CYFIRMA linked the activity to with moderate confidence
- The PHP Foundation
- warned about CVE-2026-115560
Products and systems
- PHP2Shell
- was the vulnerability family being exploited
- CVE-2026-109618
- was one of the critical PHP vulnerabilities
- CVE-2026-109619
- was the other critical PHP vulnerability
- CVE-2026-115560
- was the third PHP remote code execution flaw
- Active Directory
- was the directory service the attackers probed
- I2P
- was the channel CYFIRMA said coordinated the campaign
- GlobalProtect
- was the honeypot target Defused Cyber monitored
How the source tells it
The article was mostly a straightforward security report, with vendor-supplied attribution and cautionary language but no sustained emotive framing.
No emotive framing was found in the original.