Risk & Threat Index

⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0). In one European government case, within ~2 hours of initial exploitation attackers: • Accessed password hashes and MFA secrets • Stood up an NTLM-relay tunnel into Active Directory • Attempted Domain Admin privilege escalation Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable. Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity. unit42.paloaltonetworks.com/… #DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability