Trusence Every claim has a source
Last updated 25 October 2026 Search Türkçe
Security

PHP2Shell flaws used in fast attack on European government, with wider scanning under way

Organisations running unpatched PHP servers face active exploitation, and defenders are being told to watch for a specific pattern of errors in their logs.

25 October 2026 1 min read

Palo Alto Networks Unit 42 reports that attackers exploiting the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) used agentic AI tooling after breaching a European government entity, obtaining password hashes and MFA secrets within two hours and setting up an NTLM relay into Active Directory while trying to escalate to Domain Admin. CYFIRMA separately links a low-volume scanning campaign across 216 unpatched hosts in government, finance, logistics, aviation and other sectors to a suspected Lazarus-affiliated operator, with exploitation expected to follow. Cloudflare has seen millions of exploitation attempts since disclosure, and both flaws can yield remote code execution under default PHP settings. Defenders are advised to watch for a sequence of PHP memory-exhaustion errors followed by Apache worker crashes in their logs.

Why it matters

The attack on the European government entity shows that a remote code execution flaw in default PHP settings can move quickly from a foothold to credential theft and an attempt to reach domain administrator rights within a single intrusion. Because the flaws are reachable with default PHP configurations, many unpatched servers are exposed beyond the government sector, and the scanning across 216 hosts in several countries suggests the pool of targets is wide. For readers following security, the key shift is that the same exposure is now being used both for quick, opportunistic breaches and for patient reconnaissance that may precede further exploitation.

Series Critical PHP flaws

  1. 25 Oct PHP2Shell flaws used in fast attack on European government, with wider scanning under way
  2. 25 Oct PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack
  3. 25 Oct AI Tools Speed Up Exploits of Long-Known PHP Flaws
  4. 23 Oct PHP publishes interim mitigation for unpatched remote code execution flaw
  5. 23 Oct IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
  6. 23 Oct Early leak of two critical PHP flaws forces disclosure to move up a day
The whole series · 13 stories →

Sources · 1

Checked against its sources before publishing · 25 October at 22:08