PHP2Shell Exploitation Spikes via Agentic AI Tactics and Lazarus Probing

Widespread exploitation of the PHP2Shell vulnerability (tracked as CVE-2026-109618 and CVE-2026-109619) has rapidly escalated into a full-scale threat to web infrastructure worldwide. Security teams are observing two distinct operational trends abusing these flaws: automated post-exploitation driven by agentic artificial intelligence (AI) platforms, and low-and-slow target harvesting orchestrated by North Korean state-sponsored threat actors.

With an Exploit Prediction Scoring System (EPSS) rating exceeding 99%—placing it in the top 0.1% of all scored vulnerabilities—and a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CVE-2026-109618 represents an unauthenticated remote execution vector requiring zero privileges or user interaction. Internet-wide scans from Bitsight reveal nearly 37 million internet-facing systems running PHP or PHP-related software, primarily concentrated in the U.S., Germany, France, the Netherlands, and Japan. The realistic blast radius spans everything from content management systems and e-commerce platforms to enterprise web security gateways.

Active PHP2Shell Vulnerability Exploitation and Agentic AI Tactics

Incident analysis by Palo Alto Networks Unit 42 shows that threat actors are deploying agentic AI platforms to automate post-exploitation tasks following initial PHP2Shell compromise. In one documented incident against a European government entity, attackers established initial remote code execution and successfully extracted password hashes and multi-factor authentication (MFA) secrets within just two hours.

The attackers established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation. Commands executed during host enumeration exhibited structural markers distinctive to automated AI agents. Specifically, command batches issued to the compromise host were wrapped in machine-parseable section-header delimiters, such as ==SHELLUSER== and ==PASSWD==.

This structured formatting allows an underlying large language model (LLM) to ingest raw shell outputs directly, evaluate the operating environment, and dynamically decide the next execution step. Observed automated actions included executing anonymous LDAP queries via curl directly against the domain controller to hunt for Administrator accounts, as well as interrogating host DNS/AD integration, privileged user groups, and active sessions.

DPRK Probing and Infrastructure Targeting

In parallel, threat intelligence from CYFIRMA has uncovered a campaign attributed with moderate confidence to operators within the Lazarus Group ecosystem. Operating through a closed I2P anonymous network channel, Korean-speaking actors using the handles Jeon Chang-hyuk 2 (전창혁 2) and Choi A-rin (최아린) have been coordinating target lists, exploit-hosting nodes, and task prioritization. Channel communications utilized vocabulary and spelling specific to the North Korean Munhwaŏ dialect.

The Lazarus-linked campaign uses a rotating network of 21 compromised nodes to perform deliberately low-volume, throttled scans against a filtered target list of 216 hosts. Scans immediately abandon nodes if rate-limiting or blocking is detected, bypassing standard threshold-based SIEM alerts. Target sectors across 12 countries—including the U.S., Japan, South Korea, India, Saudi Arabia, Singapore, and the EU—encompass government agencies, aviation, logistics, defense manufacturing, and online financial transaction platforms.

In addition, threat intelligence firm Defused Cyber observed mass exploit probes targeting Palo Alto Networks GlobalProtect honeypots originating from IP address 204.76.203[.]7. The requests carried a PHP_SESSION_UPLOAD_PROGRESS marker (p2s-rider) and dummy file uploads, designed to check for vulnerable upload-progress handling on underlying PAN-OS devices.

Technical Vulnerability Mechanics

The primary flaw, CVE-2026-109618, involves heap memory management issues during multipart form-data upload processing. When PHP parses form-field names during session upload tracking, it makes multiple internal memory allocations. An attacker sends a specifically sized HTTP POST request where a field name is small enough to pass initial request body length limits, but large enough that internal string copying exceeds PHP’s memory_limit.

When the allocation fails during hash table insertion, PHP triggers a memory exhaustion error (CWE-755). However, improper error handling leaves dangling pointers and heap corruption (CWE-416, CWE-824, CWE-1325). Attackers who can defeat ASLR exploit this corrupted heap state to achieve arbitrary code execution in the web server process context.

A third related flaw, CVE-2026-115560, was separately disclosed by the PHP Foundation. This flaw requires a configuration where session.serialize_handler is set to php_binary or php_serialize in configuration files and then switched to php at runtime via ini_set() prior to invoking session_start() while upload progress is enabled.

Remediation and Detection Strategies

Because PHP2Shell exists within the core PHP runtime binary rather than application-level code, Web Application Firewall (WAF) rules and CMS application patches cannot completely mitigate the flaw. Organizations must update the host PHP engine directly.

Patched Binary Versions:

• PHP 7.3.x through 8.2.x: Update to 8.2.35 or higher.
• PHP 8.3.x: Update to 8.3.36 or higher.
• PHP 8.4.x: Update to 8.4.27 or higher.
• PHP 8.5.x: Update to 8.5.12 or higher.
• Palo Alto PAN-OS: Apply vendor patches for instances in the 10.2.x track running vulnerable PHP components (versions strictly before 10.2.8).

Detection and Threat Hunting: Defenders can detect potential exploitation attempts by monitoring server log telemetry for a specific sequence of error states: an HTTP POST request yielding an HTTP 500 status code, PHP logs recording Allowed memory size exhausted alongside heap corruption errors, followed immediately by the termination or crash of the associated Apache worker process. Security teams should also hunt for unexpected outbound HTTP or LDAP traffic originating from web server service accounts, as well as terminal output streams containing machine-parsing delimiters like ==SHELLUSER==.