PHP flaws dubbed 'PHP2Shell' hit a European government, with AI doing the dirty work
Two critical bugs in PHP let attackers run their own code on web servers. In one break-in, criminals used an AI assistant to grab password hashes within two hours.
Key points
- Attackers used an agentic AI assistant, software that can plan and run its own commands, to pull password hashes from a European government server within two hours of breaking in, according to Palo Alto Networks' Unit 42.
- The two flaws, CVE-2026-109618 and CVE-2026-109619, both carry a severity score of 9.2 out of 10 and were published on 21 October 2026.
- Both bugs sit in PHP itself, the software that powers a large share of the world's websites, so the blast radius is wide.
- Threat Vectr's own leak-site tracking has not seen a ransomware crew claim victims from this campaign yet, but post-exploitation activity is already live in the wild.
- The pair has been nicknamed PHP2Shell because each one, on its own, can hand an attacker a working shell on the server.
Two serious holes in PHP, the programming language that runs much of the web, are being used to break into live servers. Researchers at Palo Alto Networks' Unit 42 say one of the victims is a government body in Europe.
What makes this one worth your attention is not the bugs themselves. It is what the attackers did after they got in.
What actually happened?
The attackers broke into a European government web server and, within two hours, walked out with password hashes and multi-factor authentication data. They did it with help from an agentic AI tool, meaning an AI assistant that can decide its own next step and run commands without a human typing each one.
Unit 42, which published the technical writeup on 21 October 2026, says the AI handled the post-break-in work: looking around the server, finding useful files, pulling credentials. The humans pointed it at the target. The machine did the rummaging.
That is the part worth sitting with. The grunt work of a network intrusion, the bit that used to take a skilled operator a shift or two, is now something a chatbot wrapper can grind through in under 120 minutes.
What are the two bugs?
Both sit inside PHP's own memory handling. In plain terms, PHP sometimes fails to clean up after itself when a request runs out of memory, and the leftovers can be steered by an attacker into running their own code on the server. The Hacker News, which also covered the campaign, refers to the pair as PHP2Shell.
Here is how they line up.
| CVE | Severity | Published | Root cause |
|---|---|---|---|
| CVE-2026-109618 | 9.2 critical | 21 Oct 2026 | Request memory left uninitialised after an out-of-memory exit, leading to remote code execution |
| CVE-2026-109619 | 9.2 critical | 21 Oct 2026 | Global state still pointing at freed request memory, leading to remote code execution |
Remote code execution, or RCE, means the attacker gets to run programs of their choice on your server. For a web host, that is as bad as it gets.
Who is at risk?
Anyone running a PHP web server that has not applied the fix. That is a very large pool. PHP sits behind WordPress sites, government portals, small shop checkouts, internal company tools, and plenty more. If your site runs on PHP and faces the internet, treat this as urgent.
Unit 42 also notes it is seeing broad internet scanning for vulnerable servers, which is the usual pattern: a few targeted hits first, then mass sweeps once exploit code circulates.
What should affected users do?
If you run the server, patch to the latest PHP release now and restart the web service so the new binary is actually in use. Check your logs for odd child processes launched by the PHP worker, which is what Unit 42's hunting query looks for.
If you are a regular user of a service that may be affected, you cannot patch anything yourself. Watch for a forced password reset notice from any site you use that handles sensitive data, and turn on multi-factor authentication wherever it is offered. If a site you rely on tells you credentials were taken, change that password everywhere you reused it. Reuse is still how most follow-on fraud happens.
My read: the AI-assisted post-exploitation story will get the headlines, but the quieter lesson is that two 9.2-rated bugs in core PHP are being hit in the wild inside a day of disclosure. Patch windows are closing fast.
