Lazarus Group Targets PHP2Shell Flaw in Global Campaign

"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said.

Unit 42: rapid escalation after PHP2Shell exploitation

Palo Alto Networks Unit 42 reported that following abuse of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) attackers moved quickly from initial web exploitation to deep credential theft and directory-level activity. Within two hours of compromise, Unit 42 observed the intruders obtain password hashes and multi-factor authentication (MFA) secrets, establish an NT LAN Manager (NTLM)-relay tunnel into Active Directory, and attempt Domain Admin privilege escalation.

Unit 42 also described endpoint enumeration activity and a pattern of commands and behaviors it characterized as consistent with an "agentic" attacker — an automated or semi-automated post-exploitation workflow rather than a purely manual operator.

Agentic AI signals: machine-parseable output and scripted reconnaissance

Unit 42 noted several operational details that point toward AI-assisted or agentic post-exploitation tooling. Command batches were wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, which "produce machine-parseable output for an AI model to read." The observed reconnaissance included:

• Authentication database probing with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets.
• Active Directory reconnaissance via curl-based anonymous LDAP queries to the domain controller to look for the administrator account.
• Host reconnaissance to hunt for DNS/AD integration, internal hosts, privileged groups, and interactive users.

Those structured outputs and repeatable command batches are the behaviors Unit 42 flagged as consistent with an agentic attacker pipeline performing scripted discovery and prioritization.

CYFIRMA: low-and-slow global scanning tied to Lazarus-linked operators

Threat intelligence firm CYFIRMA reported a suspected North Korea-linked campaign using PHP2Shell to probe global PHP infrastructure from 21 compromised nodes. The scanning approach is "deliberately low-volume and paced," according to CYFIRMA's CEO Kumar Ritesh, with nodes rotated and abandoned at the first sign of blocking or rate-limiting, a tactic that "threshold-based alerting is unlikely to catch."

CYFIRMA identified a prioritized set of 216 unpatched or partially mitigated hosts across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. Targeted sectors include government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.

The activity, coordinated via a closed I2P channel, was attributed with moderate confidence to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem. CYFIRMA cited prior use of the same C2 infrastructure, a history of compromising PHP and WordPress servers for C2 and web shells, and target selection consistent with the group's documented focus on government agencies and financial institutions.

Exploit mechanics, detection artifacts, and mitigation signals

Both CVE-2026-109618 and CVE-2026-109619 are critical remote-code-execution vulnerabilities in default PHP configurations. Cloudflare reported detecting millions of exploitation attempts after the public disclosure. Datadog described two principal constraints for a working exploit: sizing a request to fail allocation at the right moment and defeating address space layout randomization (ASLR) to locate valid memory addresses.

Datadog explained the core technique: when PHP parses a form-field name it makes several copies along the way. An attacker can force an allocation failure by making one field name small enough to fit accepted limits but large enough that copying its key exceeds memory_limit, creating conditions for heap corruption.

ReliaQuest reproduced CVE-2026-109618 in a controlled lab and identified a repeatable sequence defenders can watch for: a POST request returning a 500 error, PHP reporting memory exhaustion and heap corruption, and the Apache worker handling the request crashing. The PHP Foundation also warned of a third RCE (CVE-2026-115560) that can occur under a specific configuration pattern involving session.serialize_handler changes and session upload progress being enabled.

Tools and telemetry: Xint released a scanner to test PHP2Shell exposure; Defused Cyber observed probes targeting Palo Alto Networks GlobalProtect honeypots from 204.76.203[.]7 using a PHP_SESSION_UPLOAD_PROGRESS marker ('p2s-rider') and dummy uploads to check for vulnerable upload-progress behavior. Bitsight's internet-wide scans show nearly 37 million internet-facing systems running PHP or related software, with most exposures in the U.S., Germany, France, the Netherlands, and Japan.

What this means for government agencies, security teams, and online transaction platforms

• Government agencies: The Unit 42 case demonstrates rapid credential and MFA secret theft after PHP2Shell exploitation; agencies should assume web-facing PHP runtime flaws can lead directly to directory compromise unless hosts are updated.
• Security teams: CYFIRMA warns that low-and-slow scanning and node rotation will evade threshold alerts; ReliaQuest provides a concrete detection sequence (POST → 500 → PHP memory exhaustion/heap corruption → Apache crash) defenders can instrument for. Xint's scanner and the PHP Foundation guidance are actionable signals referenced by multiple researchers in the reporting.
• Online transaction platforms and financial institutions: CYFIRMA included these sectors in a prioritized target list of 216 hosts and noted operators would "shortlist the most promising targets the same day and then choose which public exploits to adapt," underscoring a need to consider PHP runtime patching as a primary mitigation.

The facts are stark: exploitation has moved from widespread scanning into active credential theft and automated post-exploitation workflows, and defenders have a narrow set of observable artifacts and a single definitive fix noted in the reporting — update the PHP runtime on affected hosts. Will defenders prioritize those updates quickly enough to blunt the pace of compromise and the new, agentic techniques that parse and act on machine-readable outputs? The public thread of indicators, scanners, and vendor advisories suggests that detecting and closing these gaps will determine which targets remain in the attackers' shortlist.

Source: The Hacker News — PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking