Summary
- Unit 42 attributes agent-like post-exploitation behaviour to attackers targeting an unnamed European government entity.
- Researchers report access to password hashes and MFA material and an attempted Active Directory privilege escalation.
- The claimed use of an AI attack platform is an assessment of behaviour, not independent proof of a named model or operator.
Researchers at Palo Alto Networks Unit 42 have reported activity consistent with the use of agentic AI tools following exploitation of PHP vulnerabilities at an unnamed European government organisation. The account adds a post-compromise dimension to the emergency response surrounding PHP2Shell, although the researcher’s attribution of particular behaviour to an AI-powered platform remains an assessment rather than independent proof of the technology used.
In a 23 October update to its PHP2Shell threat brief, Unit 42 described activity progressing rapidly after initial access. According to the research, attackers reached password hashes and multifactor authentication material within approximately two hours, established a tunnel designed for NTLM relay into an Active Directory environment, and attempted to elevate their access to domain administrator level.
The researchers have not named the government organisation, disclosed the attacker’s identity or reported that the attempt to obtain domain administrator privileges succeeded. The public account also does not establish that all European government systems exposed to the PHP flaws were compromised. These distinctions are important because early reporting on PHP2Shell mixed evidence of scanning, proof-of-concept exploitation and precautionary service shutdowns with claims of actual intrusions.
Unit 42’s interpretation of agentic behaviour rests on the structure and pace of commands observed during post-exploitation. Unit 42 identified machine-readable command-output delimiters, including section labels, alongside short task sequences and rapid changes after unsuccessful actions. Those characteristics can be consistent with an automated tool directing further actions, although they are not a unique fingerprint of a particular model or product.
The initial vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect the handling of memory and control flow in PHP. Their emergency fixes were released on 21 October. Once an exposed web service is compromised, attackers may be able to move beyond the original application and seek credentials used elsewhere within the organisation. That transition from a web-server weakness to identity infrastructure is the reported sequence in Unit 42’s government case.
Administrative access to Active Directory is attractive because it can provide a route to wider account and system control. Password hashes can sometimes support authentication attacks, while multifactor authentication secrets, if genuinely usable, may undermine the assurances provided by a second factor. Neither kind of access necessarily means the attacker successfully impersonated every user or gained control of the entire directory.
The report arrives while vulnerability researchers and vendors continue to disagree over how reliably public exploit examples work against ordinary PHP deployments. Some have documented attempted attacks without successful compromise; Unit 42’s incident account should therefore be read as a reported case rather than a measure of widespread successful exploitation.
Defensive decisions also need to distinguish code execution on a vulnerable server from subsequent access to internal systems. A successful application-layer intrusion can create separate workstreams for rebuilding the original host, reviewing exposed credentials, investigating identity-provider activity and checking for unauthorised changes in connected infrastructure. Merely installing a fixed PHP release on the initial host does not, by itself, establish that follow-on access has ended.
Unit 42 has cited a large global population of externally visible PHP instances as potentially exposed, but internet visibility is not proof of vulnerability, much less compromise. The technology used to carry out the observed intrusion also remains less certain than the technical actions described by the research team.
Unit 42’s classification also leaves open whether the suspected automated system selected targets independently or merely helped an operator sequence familiar commands. Those modes of use have different implications for attribution and technical assessment. Structured console output can be produced by scripted tooling without a large language model, so a careful incident account must separate evidence of fast, machine-friendly execution from direct observation of an AI service. Neither the model provider nor the operator has been independently identified.
The targeted authority has not been publicly named. Unit 42 reports that attackers obtained credential material and attempted, rather than demonstrably completed, domain administrator escalation; its agentic-tooling conclusion is based on observed behaviour and has not been independently confirmed.
