CERT24PHP2Shell exploitation hits a government entity amid global scanning and signs of AI-assisted hackingLoading data…
CERT24Threat Observatory
Period

PHP2Shell exploitation hits a government entity amid global scanning and signs of AI-assisted hacking

Attackers used the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 against a government entity in Europe. Within two hours, they accessed password hashes and multi-factor authentication secrets, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation. Global low-volume PHP2Shell scanning was also observed; CYFIRMA attributed one campaign with moderate confidence to the Lazarus Group ecosystem.

← Back to intelligence

PHP2Shell exploitation hits a government entity amid global scanning and signs of AI-assisted hacking

Attackers used the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 against a government entity in Europe. Within two hours, they accessed password hashes and multi-factor authentication secrets, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation. Global low-volume PHP2Shell scanning was also observed; CYFIRMA attributed one campaign with moderate confidence to the Lazarus Group ecosystem.