Palo Alto Networks Unit 42 has pulled back its own claim, so this breach is not confirmed as a PHP2Shell case. On October 23, Unit 42 added a case to its PHP2Shell threat brief. It said attackers who exploited CVE-2026-109618 and CVE-2026-109619 at an unnamed European government entity reached password hashes and MFA secrets within two hours. On October 25, Unit 42 retracted that update. It now says it "is unable to confirm that initial access is associated with the specific PHP2Shell CVEs." Unit 42 still says it saw post-compromise activity against a European government agency running a vulnerable PHP application. The specific link to PHP2Shell, which early coverage such as ThreatWire's reported as established, no longer has primary-source support. The PHP flaws themselves are real, critical (CVSS 4.0 score of 9.2) and widely exposed. Estimates of exposure range from 22.6 million potentially vulnerable instances (Unit 42's Cortex Xpanse telemetry) to about 30 million websites (Prof Alan Woodward, quoted by the BBC).
What Happened
The timeline, pieced together from the sources:
- Mid-August: According to CNBC, researchers at AI firm Calif and at Google's Wiz found the flaws using AI models and agents, including OpenAI's GPT-5.6 Sol, Wiz Atlas and Gemini 4 Argon. The BBC also reports that AI first discovered the flaws. The UK NCSC told The Register that OpenAI briefed it on the vulnerability the week before disclosure.
- Saturday before disclosure: Amazon told the BBC that its threat intelligence systems saw it being targeted, followed by more "exploitation attempts" once the embargo lifted.
- October 20 to 21: GovInfoSecurity reports that details of the bugs leaked before patches were out and that attackers were exploiting them as zero-days. PHP's developers warned users and promised a fix.
- October 21: The PHP security team released fixes at 13:40 UTC, according to the ENISA joint statement (CNBC reported "around 1345 GMT"). The European Commission, ENISA, CERT-EU, Europol EC3 and the EU CSIRTs Network issued a joint call for immediate patching. Government sites in the Netherlands, Finland, Germany, France and Belgium went offline as a precaution, as did the Dutch NCSC's own site and the site of Australia's cyber agency.
- October 22: A UK minister told the House of Lords that 32 UK government services were unavailable and four partly unavailable, "largely" because of precautionary measures. No compromise was confirmed (The Register).
- October 23: Unit 42 published the European government breach update.
- October 25: Unit 42 retracted it.
Accounts differ, and the primary source now outranks the secondary reporting. ThreatWire's account describes the breach as PHP2Shell exploitation. Unit 42, the only primary source for the incident, no longer stands behind that link.
What Was Taken
According to the retracted October 23 update, as relayed by ThreatWire, the attackers:
- logged into the application's database with stolen credentials, then counted and sampled user records holding password hashes and stored 2FA/MFA secrets
- sent anonymous LDAP queries to a domain controller to find the administrator account
- set up an NTLM-relay tunnel into Active Directory and attempted to escalate to Domain Admin
ThreatWire notes that Unit 42 said the Domain Admin escalation was attempted, not achieved. No record counts, victim identity or exfiltration volumes have been published. Because Unit 42 withdrew the update, treat these details as reported but unverified. Unit 42 has not said whether it retracted the attribution only or the whole activity description. Its October 25 wording suggests the intrusion itself happened and only the entry vector is in doubt.
ThreatWire also reports that Unit 42 read the command pattern as the work of an AI agent. Separately, ThreatWire says CYFIRMA saw a suspected North Korea-linked crew scanning a list of 216 target hosts, with moderate confidence in a Lazarus link. ThreatWire, an OTHER-tier source, is the only one reporting either claim. Neither is confirmed.
Why It Matters
- The exposure is huge either way. The CNBC explainer says PHP runs just under 70% of websites whose server-side language is known. Huntress and Wordfence warn that PHP sits under WordPress, Drupal, Joomla, Magento, hosting control panels and products that don't advertise it. ENISA points to the NCSC-NL GitHub list of affected third-party software for this reason.
- Attack windows are shrinking. Matt Suiche of Tolmo told CNBC that the urgency is "very new" because both attackers and defenders now have AI-augmented capabilities. If the AI-agent reading of the European intrusion holds up, moving from a web shell to MFA secrets in two hours fits that trend.
- Retractions cut both ways. The retraction does not mean the agency was safe. Unit 42 still saw an intrusion through a vulnerable PHP application. A defender who stops hunting because "it wasn't PHP2Shell" is drawing the wrong lesson.
- Stolen MFA secrets are worse than stolen passwords. Stored TOTP seeds let an attacker generate valid second factors until the seeds are reissued. Resetting passwords alone does not fix that.
The Attack Technique
Both CVEs are unauthenticated remote code execution flaws in how PHP handles fatal errors with longjmp() (Unit 42):
- CVE-2026-109618: Handling out-of-memory errors via longjmp() leaves request memory uninitialized. Attackers can reliably trigger out-of-memory conditions to get code execution.
- CVE-2026-109619: longjmp() fatal-error handling leaves global pointers aimed at freed memory, which later requests can read or branch on.
In the European case, ThreatWire relays that Unit 42's Cortex XDR saw commands run through a web shell as child processes of Apache. Unit 42 now says it cannot confirm whether that shell was planted through PHP2Shell or another weakness in the vulnerable application. ThreatWire also reports that the CVEs are not in CISA's Known Exploited Vulnerabilities (KEV) catalog. Even so, multiple outlets report active exploitation (GovInfoSecurity, CNBC, quoting Cloudflare's CTO).
What Organizations Should Do
- Patch PHP now, internet-facing systems first. Apply the October 21 fixes. Note Wordfence's warning that WordPress auto-updates do not update PHP itself, so find out who owns the runtime on each host.
- Find hidden PHP. Inventory appliances, control panels, IoT web interfaces and vendor products using the NCSC-NL php2shell repository. Where you can't patch, isolate the system or take it offline, as ENISA and the UK NCSC advise.
- Hunt for web shells, not just exploit attempts. Look for shells, LDAP enumeration tools or tunnelling binaries spawned by Apache, PHP-FPM or nginx. ThreatWire recommends hunting back to October 17. Amazon's report of targeting the Saturday before disclosure supports going back at least that far.
- Watch Active Directory. Alert on anonymous LDAP binds, NTLM relay activity, and new or changed privileged group membership coming from web-tier hosts.
- Rotate secrets if an application server was exposed. Reset database credentials stored in app configs. Reissue TOTP/MFA seeds, and don't stop at password resets.
- Treat WAF rules as a stopgap. Cloudflare's CTO stressed that its rules are "a STOPGAP only." Paid Cloudflare customers should confirm the WAF isn't disabled or set to log-only.
Sources: PHP2Shell breach: MFA secrets stolen at EU government entity in 2 h... | Joint statement on critical PHP vulnerabilities ENISA | Threat Brief: Critical Vulnerabilities in PHP: CVE-2026- ... | Government websites go dark as software flaw sparks security scramble | UK working to identify exposure after global cyber-security warning | PHP2Shell puts dozens of UK government services out of service | Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP | 'PHP2Shell' vulnerability: What is it, and is your data at risk?