Agentic AI used in PHP2Shell attacks to reach MFA secrets within 2 hours, Unit 42 says
cyb3rops · x · 2026-10-24
Palo Alto Networks Unit 42 updated its threat brief on two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619, dubbed PHP2Shell, CVSS 4.0 score 9.2), reporting an attack where agentic AI platforms were used for rapid post-exploitation and access to MFA secrets within 2 hours.
- CVE-2026-109618: improper control flow when handling OOM errors via longjmp() leaves request memory uninitialized, enabling reliable RCE via OOM triggers.
- CVE-2026-109619: longjmp() fatal-error handling leaves global memory pointing to freed regions, readable or branchable in later requests.
PoCs exist and at least one European government took its website offline as a precaution. Unit 42 urges immediate patching and publishes hunting queries.
More from Safety
- AI finds dormant critical software bugs, but defenders hold the edge — ShakeelHashim · 2026-10-24
- UK announces £600m+ AI package spanning biosecurity, AISI funding, chip design — HaydnBelfield · 2026-10-24
- Google Chrome team slams eMudhra over CA key fiasco, calls out delays — basedjensen · 2026-10-24
- Developer finds Samsung TV sluggishness culprit: on-device vision models processing screenshots and audio — basedjensen · 2026-10-24
- AI Agents Breached 100+ Company Websites at $50 per Break-in — alex_verem · 2026-10-24
- Samsung TVs found running facial recognition code that returns face bounding boxes — basedjensen · 2026-10-24