Top Highlights
-
AI-assisted attacks escalated fast: After exploiting PHP2Shell, attackers reportedly stole password hashes and MFA secrets within two hours and attempted Active Directory privilege escalation.
-
Suspected Lazarus-linked targeting: A low-and-slow campaign probed 216 vulnerable or partly mitigated hosts across 12 countries, focusing on government, finance, logistics, and other sectors.
-
PHP2Shell is a widespread critical risk: The flaws can enable remote code execution in default PHP configurations, and scanning attempts have surged globally.
- Patch PHP and watch for clues: Update PHP on affected hosts; defenders can look for suspicious POST requests followed by memory-exhaustion errors and Apache worker crashes.
AI Signals Emerge in Government Breach
Attackers exploited two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, to breach a European government entity, according to security investigators. Within two hours, they accessed password hashes and multi-factor authentication secrets. They also tried to move toward administrator-level access.
Investigators found commands that gathered information about users, passwords, and internal systems. The commands used clear labels to organize results for an AI model. That pattern suggests AI-assisted work, but it does not prove that an AI system carried out the attack on its own.
Scanning Raises Wider Risk
Meanwhile, a separate campaign scanned 216 vulnerable or partly protected systems across several regions and industries. Investigators linked the activity to North Korea with moderate confidence. They say attackers used 21 compromised systems and kept scanning slow, which can make simple alerts less effective.
The flaws can let attackers run code on affected servers. Because PHP supports many websites and online services, the risk reaches beyond large institutions to everyday tools people use to shop, read, and manage accounts. Organizations should update PHP itself, then review server and system logs for unusual errors or crashes. Security teams should also watch for quiet, repeated probes—not only sudden bursts of traffic.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
CyberAttacks-V1
