PHP2Shell Attacks Hit a Government Network in Under Two Hours

Michael Miller · 2026-10-25

Attackers didn't just break in. They broke in, grabbed the keys, and were gone before anyone noticed. That's the short version of what happened when threat actors abused the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. What makes this case worth your attention isn't the breach itself. It's the speed, and the fact that AI appears to be doing part of the heavy lifting. ### Two Hours From Break-In to Full Access In one documented case, the attackers targeted a government entity in Europe. Within roughly two hours of the initial exploitation, they had already accessed password hashes and multi-factor authentication data. Think about that timeline. Two hours is a lunch break. It's a meeting that ran long. For most security teams, that's not nearly enough time to detect an intrusion, escalate it, and respond. The attackers weren't moving at human speed. According to the findings, they were leaning on agentic AI platforms to handle post-exploitation work, the tedious, multi-step tasks that normally slow an intruder down. ### What "Agentic AI" Actually Means Here Agentic AI isn't just a chatbot answering questions. It's software that can plan and carry out a sequence of actions on its own, with limited human babysitting. In a post-exploitation scenario, that could mean: - Mapping out what's reachable on the network after the first foothold - Pulling credentials and session data automatically - Adapting when a step fails instead of stalling out - Running many small tasks in parallel that a human would do one at a time That's the scary part. The bottleneck used to be human attention. When you remove that bottleneck, a single operator can do the work of a small team. ### The Scanning Wave Behind It The government breach didn't happen in a vacuum. Researchers have tied it to widespread scanning activity, with automated tools probing for vulnerable PHP2Shell instances around the globe. It's the classic setup: find the soft targets at scale, then send in the smarter tooling to finish the job. > "Within two hours of the initial exploitation, they had successfully accessed password hashes and multi-factor authentication data." If your systems touch PHP at all, this is the moment to check your patch status. Not next quarter. Now. ### Why This Matters Beyond One Breach The uncomfortable takeaway is that offense is getting faster and more automated, and defense has to keep up. A lot of organizations still rely on manual triage and slow escalation paths. That gap is exactly what AI-assisted attackers are built to exploit. A few practical moves worth considering: - Patch known PHP2Shell exposures and verify the fix actually took - Rotate password hashes and MFA secrets if there's any chance of exposure - Shorten your detection-to-response window, because two hours is now a realistic attack clock - Watch for unusual automated behavior, not just known malware signatures None of this is glamorous work. But the attackers here clearly didn't wait around, and defenders can't afford to either.