FBI Orders Immediate PHP Patching as AI-Assisted Hackers Launch Millions of PHP2Shell Exploit Attempts

AI-Assisted Hackers Breach Government Entity Within Two Hours

Threat actors exploiting the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have demonstrated unprecedented speed in post-exploitation activities, with Palo Alto Networks Unit 42 documenting a breach of a European government entity that occurred within two hours of initial exploitation1

1

. The attackers successfully accessed password hashes and multi-factor authentication secrets, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation1

1

.

The attack revealed clear markers of AI-assisted hacking, with commands wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD== to produce machine-parseable output for AI models1

1

. These agentic artificial intelligence platforms facilitated reconnaissance of authentication databases, Active Directory reconnaissance via curl-based anonymous LDAP queries, and systematic hunting for DNS/AD integration and privileged groups1

1

.

FBI and Federal Agencies Issue Urgent Patching Directive

The FBI issued a public service announcement Friday stating that security updates are available and should be applied immediately2

2

. The NSA, FBI, and CISA jointly urged organizations Wednesday to patch immediately and take systems offline if patching was not possible2

2

. The NSA specifically warned that these critical PHP vulnerabilities "often provide a direct path to the server's file system or database"2

2

.

PHP released fixes on October 21 for versions 8.2 through 8.5, affecting infrastructure that powers as much as 70% of websites globally2

2

. The severity of the situation prompted some cybersecurity professionals to label this period "Black October"2

2

.

Millions of Exploit Attempts Within Hours of Disclosure

Cloudflare detected tens of thousands of exploit attempts within 45 minutes of the public announcement and eventually recorded millions of attempts2

2

. The rapid escalation followed an accidental early disclosure when information about the flaws spread two days before the planned patch date, forcing PHP maintainers to release the fix one day early2

2

. Hours after the public announcement, a video demonstrating the exploit was mistakenly posted, accelerating the exploit attempts surge2

2

.

Defused Cyber reported seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots from 204.76.203[.]7, a known mass-exploit IP address1

1

. The requests carried a PHP_SESSION_UPLOAD_PROGRESS marker and dummy file uploads, indicating attackers were building target lists of vulnerable Palo Alto devices1

1

.

Suspected Lazarus Group Campaign Targets Global Infrastructure

CYFIRMA uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes1

1

. The scanning targets 216 unpatched or partially mitigated hosts across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U., spanning government entities, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms1

1

.

Kumar Ritesh, CEO of CYFIRMA, explained that "the scanning is deliberately low-volume and paced" with nodes rotated and abandoned at the first sign of blocking, making threshold-based alerting unlikely to catch it1

1

. The activity, coordinated via a closed I2P channel, has been attributed with moderate confidence to Korean-speaking operators affiliated with the Lazarus Group ecosystem1

1

.

AI in Cybersecurity: Discovery Through Machine Learning

In August, Sagi Tzadik, a researcher at Google-owned Wiz, asked an AI agent to adapt a WordPress exploit for Drupal2

2

. While the agent failed at that task, it uncovered a PHP flaw that had gone unnoticed for more than a decade2

2

. Separately, Calif working with OpenAI found a related bug, with about 15 people collaborating to develop a fix2

2

.

The PHP Foundation acknowledged the issue had been known since at least 2024 and described the delay in addressing it as "a structural failure"2

2

. This revelation raises questions about vulnerability management practices and the role AI in cybersecurity can play in both discovering and exploiting flaws.

Global Response and Ongoing Vulnerability Management Challenges

Government websites in Britain, Finland, and Japan experienced outages or limited service during immediate PHP patching work2

2

. Broome County, New York, took its website offline Friday "out of an abundance of caution," with County Executive Jason Garnar not specifying when service would return2

2

.

Dan Guido of Trail of Bits emphasized that most remediation work falls to companies operating websites, noting "You can't patch your hospital's website"2

2

. Former CISA Director Chris Krebs urged smaller companies to scan for vulnerabilities "constantly" and apply patches as quickly as possible, stating "This is a significant week or two in cybersecurity"2

2

. Experts recommend enabling automatic updates for phones, computers, and home routers, using multi-factor authentication, and maintaining unique passwords for every website as essential post-exploitation defenses2

2

.