Have you ever wondered what would happen if an attacker didn't need weeks to probe for vulnerabilities, but only hours to seize control of an entire government agency's system? Not through a noisy attack, but via a series of quiet actions directed by a non-human "accomplice."
That is no longer a fictional scenario. That is what is happening right now with the PHP2Shell exploit on a global scale. And what makes me, with 20 years of tracking cyber warfare, break out in a cold sweat is not the speed of the attack. It is how it is being executed: agentic AI is becoming hackers' right-hand helper, and the boundary between human and machine in intrusions is blurring fast.
What is PHP2Shell and Why is it Every Administrator's Nightmare?
To understand why this story matters, we first need to understand what PHP2Shell is. This is not a single isolated vulnerability. It is a collective term for a group of severe flaws in the PHP engine—the programming language powering the vast majority of the modern internet, from content management systems and online stores to internal enterprise and government agency tools.
Two vulnerabilities tracked under CVE-2026-109618 and CVE-2026-109619 are both critical flaws allowing Remote Code Execution (RCE) right out of the default PHP configuration. In other words, attackers do not need to install any special libraries, nor do they need to wait for administrators to make mistakes. With just a cleverly crafted HTTP request, they can run malicious code on the server—and from there, take full control of the system.
The scary part lies in the numbers: nearly 37 million systems are running PHP or PHP-related software worldwide, according to wide-scale scans by cybersecurity organizations. Most of them are concentrated in the US, Germany, France, the Netherlands, and Japan. But Vietnam is not out of danger either, as thousands of websites, applications, and internal systems in our country use PHP every day.
The European Government Attack: Two Hours to Lose Everything
Let's put aside the dry numbers for a moment and look at a specific incident. In an attack targeting a European government agency, attackers leveraged the PHP2Shell exploit to break in. And this is the part that made me stop and read multiple times: within just two hours of successful exploitation, they gained access to password hashes and multi-factor authentication (MFA) secrets.
Two hours. You might be drinking a cup of coffee, attending a short meeting, or checking morning emails. And in that timeframe, a government agency had information exposed that should have been protected by multiple layers of defense.
Yet the attack didn't stop there. The attacker also established an NTLM relay tunnel into Active Directory—the backbone system managing identity and access for almost all large organizations. From there, they attempted to escalate privileges to Domain Admin, granting the highest permissions across the entire network domain. If successful, they could create new accounts, change security policies, and maintain nearly unlimited access.
It is worth noting that investigators later had to retract their initial conclusion that this incident was directly linked to the two PHP2Shell vulnerabilities. They determined that what was observed was an attack targeting a vulnerable PHP application, but could not confirm whether the initial compromise tied directly to those two specific CVEs. This is a crucial detail because it shows the technical picture is still evolving, and defenders need to monitor closely rather than jump to conclusions.
Agentic AI: When Hackers Have a "Self-Thinking" Accomplice
Yet there is a detail even more concerning than the speed. During the investigation, experts discovered distinct behavioral signs of an autonomous AI agent (agentic attacker).
Specifically, commands executed on the compromised system were grouped into batches and surrounded by delimiters like ==SHELLUSER== and ==PASSWD==. These delimiters were not random. They generated output that could be automatically analyzed by an AI model—meaning the attacker was using AI to read reconnaissance results, make subsequent decisions, and execute actions without manual human intervention at every single step.
Imagine the difference. Previously, a typical intrusion required a technician sitting in front of a monitor, typing every command, reading every result, and weighing each step. Now, AI can take over that role: it scouts authentication databases, finds password hashes and 2FA secrets, runs anonymous LDAP queries against domain controllers to find administrative accounts, and scans servers to discover DNS/AD integrations, internal servers, privileged groups, and interacting users.
All these actions happen at a speed humans can hardly keep up with. And more importantly, they happen without a human sitting behind a keyboard. That is what makes agentic AI a turning point in how cyberattacks are conducted.
North Korean Suspicions: A Global Scanning Campaign with 21 Compromised Nodes
Alongside isolated exploits, a more organized campaign is being monitored by researchers with a high level of suspicion. This campaign uses the PHP2Shell exploit to probe PHP infrastructure globally, originating from 21 compromised nodes.
What makes this campaign hard to detect lies in how it operates. According to observers, the scanning is executed with low volume and a deliberate tempo. Compromised nodes are rotated and abandoned as soon as there are signs of blocking or rate limiting. This means threshold-based alerting systems—designed to catch massive flood scans—are virtually blind to it.
The target list includes 216 unpatched or partially patched servers scattered across the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the European Union. The targeted sectors are far from random: government agencies, financial institutions, logistics, airports and aviation, manufacturing, and online trading platforms.
These are high-value targets. And according to researchers' assessments, organizations in these sectors and regions should assume they are in the crosshairs rather than wait for concrete proof.
Lazarus Traces: Language, Infrastructure, and Familiar Targets
This scanning campaign is assessed with medium confidence to be operated by a Korean-speaking threat actor tied to the Lazarus Group ecosystem—a targeted attack group known for financial intrusions and cryptocurrency theft.
Many signs reinforce this assessment. Activity was coordinated via a closed I2P channel—an anonymous network similar to Tor but less common, often used by politically motivated threat groups. Two operator accounts in this channel were previously recorded carrying out covert campaigns for similar attack groups. Most notably, the collected conversations used vocabulary and spelling characteristic of North Korean speech (Munhwaŏ), differing from South Korean standards.
Command and Control (C2) infrastructure also matched what Lazarus previously used to exploit web assets. This group has a history of compromising PHP and WordPress servers to deploy C2 and web shells, prioritizing government agencies and banks—especially online trading platforms. All these puzzle pieces paint a troubling picture: the PHP2Shell exploit is not just an issue for lone hackers, but potentially part of an organized strategy by a state-sponsored threat group.
Not Just One Group: Honeypots and Continuous Probing
While the large-scale scanning campaign unfolds, smaller probes continue to pop up elsewhere. Honeypots—dummy systems set up to lure attackers—have recorded suspicious requests targeting major organizations' security devices.
These requests carry the signature PHP_SESSION_UPLOAD_PROGRESS with the string "p2s-rider" and a fake file upload containing no malicious payload. This is a sign someone is testing whether the system is vulnerable to upload progress handling flaws—a reconnaissance step before unleashing the actual exploit. The origin of these requests traces back to an IP address known for mass exploitation activities.
This reveals a reality: the PHP2Shell exploit is not a single event. It is an ongoing process with multiple groups participating at different stages—from reconnaissance and probing to exploitation and takeover.
Why is This Vulnerability Hard to Patch and Detect?
There is a technical reason why CVE-2026-109618 and CVE-2026-109619 are particularly dangerous: they do not depend on application code bugs. They reside in the PHP engine itself—the core layer shared by every application.
The exploitation mechanism is quite sophisticated. Attackers must calculate request sizes to corrupt heap memory at precisely the right moment while bypassing ASLR (Address Space Layout Randomization) to find valid addresses. Specifically, they use a form field name small enough to fit within accepted request bodies, but large enough that when PHP copies that key into a hash table, it overflows memory limits. As PHP parses the field name, it creates multiple copies; attackers leverage that redundant memory to force an allocation failure.
The consequence? A flaw in the PHP engine cannot be fixed by altering application code. Updating plugins, changing themes, or adding a Web Application Firewall (WAF) will not eliminate the root of the problem. The only way to patch is to update PHP itself on the server.
And that is the fatal weakness. Many organizations, especially government agencies and small-to-medium businesses, often delay PHP upgrades for fear of breaking legacy applications. They choose to live with the risk. But when a vulnerability allows remote code execution in default configurations, living with risk means leaving the door wide open for anyone who wants to walk in.
Detection and Prevention: Concrete Steps
Facing such a dangerous vulnerability, anxiety is understandable. But instead of panicking, turn it into action. Here are immediate steps to take.
1. Check PHP Versions and Update Immediately
This is the most critical step. Identify the PHP version running on all your servers and update to the latest patch. Do not wait. Do not assume your system "nobody knows about." Attackers are scanning globally, and obscurity is not a defense.
2. Monitor Characteristic Error Chains
Lab testing has identified signature chains that help detect exploitation: a POST request returning a 500 error, followed by PHP reporting memory exhaustion and heap corruption, causing the Apache process handling the request to crash. If you spot this sequence in your logs, treat it as an emergency signal.
3. Audit Logs and Look for Reconnaissance Signs
Search access logs for unusual requests, especially those with parameters linked to PHP_SESSION_UPLOAD_PROGRESS or suspicious strings like "p2s-rider". Simultaneously, check for unusual anonymous LDAP queries from web servers to domain controllers.
4. Don't Rely on WAFs as a Silver Bullet
Web application firewalls can help mitigate risk, but they cannot patch PHP engine vulnerabilities. If you rely solely on a WAF without updating PHP, you are holding a paper umbrella in a real storm.
5. Prepare for a Third Vulnerability
Besides the two known flaws, a third remote code execution vulnerability—CVE-2026-115560—has also been flagged. This flaw only occurs under specific configuration and application code combinations, but it proves that PHP flaws continue to emerge. Never become complacent thinking "patching once means being safe forever."
Lessons for Vietnamese Businesses and Agencies
Vietnam is not off the attack map. With thousands of systems running PHP—from corporate websites and portals to internal applications—the risk is real and can strike at any time.
The first lesson is never delay updates. If your organization runs an outdated PHP version because "applications aren't compatible," treat it as technical debt that must be resolved immediately, not an issue to be shelved.
The second lesson is having detection capabilities. If you lack log monitoring systems or alerts for abnormal error sequences, you won't even know when you've been breached. And in cybersecurity, blindness equals failure.
The third lesson is do not fight agentic AI with past-generation tools. When attackers use AI for high-speed reconnaissance and decision-making, slow manual defense processes cannot keep up. Detection and response must be automated, acknowledging that adversaries are no longer mere humans.
When the Attacker's Speed Outpaces the Defender's Speed
I have witnessed the cybersecurity industry change drastically over the past two decades. From email-propagating worms to sophisticated targeted campaigns. Yet I have never seen the gap between attack speed and defense speed narrow so frighteningly as now.
The PHP2Shell exploit is not just a vulnerability to patch. It is a reminder that the game has changed. Attackers no longer need weeks to probe. They have AI for reconnaissance, infrastructure for rotation, and pre-prepared target lists. Meanwhile, many organizations still struggle with delayed patches and defense processes designed for a bygone era.
Yet I still believe understanding is the first step of defense. And if you are reading these lines, you have begun to understand. The question is: what will you do with that understanding?
When attackers can use AI to gain system access to a government agency in just two hours, what do you think is the biggest flaw in how organizations in Vietnam protect their data—outdated technology, a shortage of human resources, or the mindset of "it won't happen to us"? And if you had to audit a running PHP system today, where would you start to figure out if you're in the crosshairs?
0 Comment
Add your comment to this article