Unit 42: AI agents drove PHP breach to domain-admin push in 2 hours

Summary

• Unit 42 says attackers used agentic AI platforms for post-exploitation of two critical PHP flaws.
• A European government body was hit; credentials and MFA secrets fell within two hours.
• Cortex Xpanse counts over 22.6 million exposed instances potentially vulnerable to both bugs.

The latest

Attackers running agentic AI attack platforms moved from initial exploitation to an attempted domain-admin takeover of a European government network in roughly two hours, Unit 42 said in a threat brief update. The Palo Alto Networks research unit tied the intrusion to two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS 4.0.

Details

• The flaws: Unit 42 is tracking CVE-2026-109618 and CVE-2026-109619, known collectively as PHP2Shell, each scored 9.2 on CVSS 4.0. The brief does not list affected or patched version numbers, instead pointing readers to the PHP Group advisory for remediation detail.
• The update: The brief was refreshed on 23 October 2026 at 12:30 p.m. Pacific time, adding material on post-exploitation activity involving AI agents along with managed threat-hunting queries. Its change log begins on 21 October 2026, and the page is dated as published 23 October 2026.
• The agentic signal: Unit 42 said the observed activity carried "strong indicators of an agentic attacker." The command batches were wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, producing output structured for machine parsing by an AI model rather than for a human operator reading a terminal.
• The behavioral tells: Investigators also pointed to short, sequential tasks spaced out in time, and rapid pivots immediately after a failed attempt. Taken together with the delimiter formatting, Unit 42 treated the pattern as consistent with automation driving decisions between steps rather than a hands-on-keyboard intruder.
• The intrusion: The target was a government entity in Europe. Within two hours of initial exploitation the attackers reached password hashes and multi-factor authentication secrets, Unit 42 said. No further timestamps for the intrusion were provided in the brief.
• The escalation: In the same two-hour window the attackers established an NTLM relay tunnel into Active Directory, then attempted to escalate privileges to Domain Admin — the account tier that would hand them control of the directory and, with it, the organization's identity infrastructure.
• The exposure: Cortex Xpanse identified more than 22.6 million exposed instances potentially vulnerable to both CVEs, based on its measurements at the time of publication. Unit 42 did not attach a specific date to that count.
• The response: Unit 42 said it has seen proof-of-concept code in circulation, and that at least one European government took its website offline as a precaution. Firewall protections referenced in the brief are dated 20–21 October 2026, ahead of the agentic activity disclosure.
• Not named: Unit 42 did not identify the targeted government entity, did not name the agentic platform the attackers used, and did not attribute the intrusion to any actor or group.

Between the lines

The patch-window math is what changes here. Defenders have historically budgeted days between a public proof-of-concept and credential theft at scale; a two-hour path from exploitation to an attempted Domain Admin escalation compresses that to a single shift. With 22.6 million instances exposed by Cortex Xpanse's count and PHP2Shell code already circulating, the constraint on attacker throughput shifts from operator availability to target discovery.

What's next

Watch the PHP Group advisory for the patched version numbers Unit 42's brief omits, further revisions to the Unit 42 change log, and whether additional governments take sites offline or disclose intrusions tied to the two CVEs.

Source: Unit 42 (Palo Alto Networks)