PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Summary
Threat actors are exploiting PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with the assistance of agentic AI platforms for post-exploitation activities. A government entity in Europe was targeted, with attackers quickly accessing password hashes and MFA data.
IFF Assessment
FOE
The use of AI-assisted exploitation and the successful compromise of a government entity represent a significant threat to defenders.
Severity
9.8
Critical
Defender Context
This incident highlights the growing threat of AI-assisted attacks, which can accelerate exploitation and post-exploitation phases. Defenders should be particularly vigilant about vulnerabilities like PHP2Shell and prepare for more sophisticated, AI-driven attack methodologies.