Unit 42 flagged an attack packaged for an AI

Within two hours of exploiting a government network in Europe through PHP2Shell, the attackers had pulled password hashes and multi-factor authentication secrets, built an NTLM-relay tunnel into Active Directory, and tried to escalate to Domain Admin. Palo Alto Networks Unit 42, which reported the sequence, flagged something in how the post-exploitation commands were structured: each batch was wrapped in section-header delimiters like ==SHELLUSER== and ==PASSWD==. Those delimiters do nothing for a human operator. They produce machine-parseable output for an AI model to read.

The commands themselves are ordinary post-exploitation work: enumerate the authentication database with the stolen credentials to pull password hashes and 2FA secrets, run curl-based anonymous LDAP queries against the domain controller to find the administrator account, and map DNS/AD integration, internal hosts, privileged groups, and interactive users. The agentic marker is the packaging. Output structured so a model can parse one step’s result and take the next is the kind of packaging Unit 42 read as the mark of an agentic attacker.

The bug is in how PHP handles the session upload-progress feature. Datadog described the exploit primitive. When PHP parses a form-field name it makes several copies along the way, so the attacker picks a field name small enough to fit inside an accepted request body but large enough that copying its key exceeds memory_limit. That forces an allocation failure at a controlled point while PHP copies the name into a hash table. The two constraints left are the familiar heap-corruption ones: size the request so the allocation fails at the right instant, and defeat ASLR to locate valid memory addresses.

ReliaQuest reproduced CVE-2026-109618 in a controlled lab on October 22 and gave defenders something to grep for. The sequence is a POST that returns a 500, PHP logging memory exhaustion and heap corruption, and the Apache worker handling the request crashing, with artifacts landing across PHP error, Apache access, Apache error, and system logs. ReliaQuest tells defenders to watch the whole sequence rather than any one artifact.

Cloudflare counted millions of exploitation attempts after public disclosure. Bitsight’s internet-wide scans put nearly 37 million internet-facing systems running PHP or PHP-related software, concentrated in the US, Germany, France, the Netherlands, and Japan. This is a flaw in the PHP runtime itself. A WAF rule will not close it, a plugin update will not close it, and changing application code will not either. Only updating PHP on the host does.

Not all the scanning is blind. Defused Cyber reported PHP2Shell probes hitting its Palo Alto GlobalProtect honeypots on October 25, coming from 204.76.203.7, a known mass-exploit address. The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker (p2s-rider) and a dummy file upload with no payload, which reads as someone fingerprinting the vulnerable upload-progress behavior and building a target list of Palo Alto devices before exploiting anything.

CYFIRMA reported a more deliberate effort, attributed with moderate confidence to a Korean-speaking operator in the Lazarus Group ecosystem. The campaign runs PHP2Shell probes from 21 compromised nodes against a filtered set of 216 unpatched or partially mitigated hosts across the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia, and the EU. The sectors are government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.

The scanning is built to evade threshold-based detection. “Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it,” CYFIRMA’s Kumar Ritesh said. If your detection for this leans on request-count thresholds from a single source, a campaign designed to stay under them will pass through.

The attribution rests on coordination over a closed I2P channel where two handles, Jeon Chang-hyuk 2 and Choi A-rin, have previously been observed running covert operations for the threat actors. CYFIRMA says the captured conversation uses North Korean (Munhwaŏ) vocabulary and spelling rather than the South Korean standard. The other links are C2 infrastructure Lazarus has used before against web assets, the group’s documented habit of compromising PHP and WordPress servers for web shells as in the SyncHole watering-hole campaign, and target selection matching its record of breaching financial institutions for financial and cryptocurrency theft. Per the captured tasking, the operators planned to shortlist the most promising targets the same day and choose public exploits to adapt.

There is a third flaw. The PHP Foundation warned of CVE-2026-115560, another remote code execution bug, but one that triggers only under an unusual combination of configuration and application code: the application has to set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime with ini_set() before calling session_start(), with session upload progress still enabled. Applications that never change the serialize handler at runtime can leave the feature on. The fix is slated for the regular release cycle rather than an emergency patch.

Xint has published a scanner to check exposure and notes the remote code execution is reachable in any PHP script where decoding occurs, such as through session_start() or unserialize(), independent of the application running on top. Patch the runtime, then read your PHP, Apache, and system logs for the 500, memory-exhaustion, worker-crash sequence.