PHP2Shell Hits Government Network with AI Post-Exploit Tools

A government entity has been confirmed compromised through PHP2Shell exploitation, and the attackers used agentic AI platforms for post-exploitation activity. The Hacker News reported October 25 that global scanning for the vulnerabilities continues, alongside confirmed breaches.

The underlying flaws are CVE-2026-109618 and CVE-2026-109619, both CVSS 9.8 critical, both unauthenticated RCE in PHP core, both patched as of October 21. Our October 22 coverage tracked the first exploitation attempts hitting sensors within hours of that patch release.

The AI-assisted post-exploitation angle

Using agentic AI for post-breach activity, recon, and lateral movement is a pattern showing up across recent incidents. It reduces the manual overhead between initial access and deeper compromise. The Hacker News cites active global scanning alongside these confirmed breaches, which means servers still running PHP versions before the October 21 patches are being found and targeted.

CyberXero used AI tooling in a breach that exfiltrated 628k records earlier this month. The PHP2Shell case adds a different initial access vector to the same post-exploitation pattern.

Patch priority

PHP 8.3.36, 8.4.27, and 8.5.12 fix both CVEs. PHP 8.2.35 also carries fixes for both. PHP 8.1 and older are end of life with no PHP-project patch available: those installs need a version upgrade, not just an update command.

The trigger is an unauthenticated HTTP request before any application code runs. WAFs, input validation, and application-layer security controls do not protect here. The fix lives at the PHP runtime layer.

If you have internet-exposed PHP servers not yet at a patched version, treat this as a current active exploitation event. A confirmed government entity compromise is in the public record, four days after patches shipped.

Related: BlackX UEFI bootkit coverage from earlier this week covers a different threat class but illustrates the same pattern of sophisticated post-exploitation tooling in confirmed government-targeting campaigns.