PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers

• •PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 are actively exploited.
• •AI tools are being used for both exploitation and post-exploitation activities.
• •A suspected North Korean campaign is targeting 216 unpatched hosts globally.

Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing password hashes and multi-factor authentication secrets. A suspected North Korean campaign has been linked to this exploitation, with low-volume scanning of 216 unpatched hosts across various sectors globally. The vulnerabilities were publicly disclosed on October 21, 2026, and a proof-of-concept exploit was available shortly after. The exploitation is confirmed to be active, with CISA adding the vulnerabilities to its KEV catalog on October 26, 2026. Organizations in affected sectors are advised to assume they are potential targets.