As reported by The Hacker News, Palo Alto Networks Unit 42 has retracted its earlier assessment that post-compromise activity against a European government agency specifically involved exploitation of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. While the attack occurred in the context of a vulnerable PHP application, Unit 42 now states it cannot confirm the initial access vector was tied to those specific CVEs.
This retraction is important for attribution accuracy — but it should not be misread as a reason for defenders to stand down. The original incident details and the parallel campaign uncovered by CYFIRMA both point to an escalating threat landscape where PHP applications are being actively probed, and AI-assisted tooling is dramatically compressing the time-to-objective for attackers.
What We Know
| Field | Detail |
|---|---|
| CVEs | CVE-2026-109618, CVE-2026-109619 (PHP2Shell) |
| Affected Software | PHP applications running vulnerable configurations |
| Severity | High — enables remote code execution / web shell deployment |
| Patch Status | Refer to vendor advisories; many hosts remain unpatched or partially mitigated |
| Active Exploitation | Yes — global scanning observed from 21 compromised nodes targeting 216 hosts across 13+ countries |
| Suspected Actor | North Korea-linked campaign (per CYFIRMA); original European incident actor unconfirmed |
Why This Matters Beyond Attribution
The most significant detail in this story isn't the CVE number — it's the agentic AI post-exploitation. Within two hours of initial access, the attacker had retrieved password hashes, exfiltrated MFA secrets, established an NTLM relay tunnel into Active Directory, and attempted Domain Admin escalation. The command structure used delimiters like ==SHELLUSER== and ==PASSWD==, producing machine-parseable output designed for an AI model to consume and act upon.
This represents a meaningful shift: attackers are no longer just using AI to write phishing emails or generate malware. They're deploying AI agents that can autonomously enumerate, credential-harvest, and move laterally — at speeds that outpace most human incident response workflows.
The DPRK Scanning Campaign
CYFIRMA's disclosure of a suspected North Korean campaign adds another layer. The operational discipline — low-volume scanning, node rotation, abandonment at the first sign of rate-limiting — is specifically designed to evade threshold-based detections. Traditional SIEM rules looking for volume spikes will miss this entirely.
The 216 targeted hosts span government, critical infrastructure, and enterprise across the U.S., Japan, South Korea, Southeast Asia, the Middle East, and the EU. If you run PHP externally, assume you're being probed.
Immediate Actions
Shield53 Recommendations
- Treat any externally accessible PHP application as a priority attack surface — apply WAF rules, restrict execution paths, and implement file integrity monitoring for web shell artifacts.
- Develop and rehearse AI-accelerated incident response playbooks — if attackers are using AI to compress dwell time from hours to minutes, your IR process must match that tempo.
- Engage threat hunting focused on low-and-slow reconnaissance patterns against LDAP, AD, and authentication infrastructure — the CYFIRMA campaign specifically evades volume-based alerts.
- For government and critical infrastructure organizations in the listed target regions: assume active probing is occurring and validate that detection coverage extends to the specific TTPs described.
The retraction by Unit 42 is a reminder that attribution is hard and should be precise. But the defensive takeaway is unchanged: PHP applications are under active targeting, AI-assisted attackers are compressing exploitation timelines, and traditional detection approaches may not catch the next stage of these campaigns.
