PHP2Shell exploits confirmed in the wild, attackers may use agentic AI for post-exploitation
AravSrinivas · x · 2026-10-27
The Hacker News reports PHP2Shell vulnerabilities (CVE-2026-109618/109619) are being exploited in the wild: Perplexity researcher Adel Karimi confirmed successful shell command execution on honeypot servers (log screenshot attached). Palo Alto Networks Unit 42 also observed suspected agentic-AI-driven post-exploitation: after breaching a European government agency, attackers accessed password hashes and MFA secrets within two hours, set up an NTLM-relay tunnel into Active Directory, and attempted Domain Admin escalation. Note: Unit 42 retracted its earlier assessment linking that incident to PHP2Shell CVEs. Activity is also tied to suspected North Korean global scanning.
More from AGI Musings
- Interpretability researchers call for a 'Human Genome Project for AI'; author joins Goodfire — ninamiolane · 2026-10-27
- Article proposes a Human Genome Project for AI interpretability — ninamiolane · 2026-10-27
- A synthetic-cortisol multi-agent architecture: AI that panics, retreats, and learns from an air-gapped sage — Jammer521 · 2026-10-27
- Researchers call for a Human Genome Project for AI to fully understand neural networks — mathildepapillo · 2026-10-27
- Ajeya Cotra: beliefs are forged in the haggling with your audience — NathanpmYoung · 2026-10-27
- After Microsoft's 60K layoffs, pundit predicts 50-60% headcount cuts at big companies — krishnan · 2026-10-27