Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)

Summary

PHP2Shell, the collective label used for CVE-2026-109618 and CVE-2026-109619, is reported as being exploited in the wild. The Hacker News attributes to Unit 42 a European government intrusion in which attackers accessed password hashes and multi-factor authentication secrets within two hours of initial exploitation. The attackers also established an NTLM-relay tunnel into Active Directory and attempted Domain Admin privilege escalation; successful Domain Admin access was not reported.^[0]

The reported post-exploitation activity included authentication-database reconnaissance with stolen credentials, anonymous LDAP queries using curl, and enumeration of the compromised host and its domain relationships. Section-header delimiters around command output were interpreted as signs of agentic AI assistance. These are behavioral indications, not conclusive proof that an autonomous AI system conducted the intrusion.^[0]

A separate CYFIRMA account describes deliberate, low-volume scanning from 21 compromised nodes against 216 unpatched or partially mitigated hosts across multiple countries and sectors. CYFIRMA assessed a Lazarus-ecosystem affiliation with moderate confidence, but described exploitation as the operators' next step. That attribution should not be transferred to the unknown attacker in the government intrusion, nor should the scanning target count be treated as a confirmed victim count.^[0]

The immediate defensive priorities supported by the reporting are host-level PHP updating, correlation of exploitation-related error sequences, and investigation of credential access and Active Directory activity after suspected exploitation. The article references emergency PHP2Shell patches without identifying release numbers. It also describes a separate, configuration-dependent RCE issue, CVE-2026-115560, whose fix was expected in the regular release cycle.^[0]

Evidence confidence is constrained by source availability: the substantive incident, technical, attribution, and mitigation details are supplied through The Hacker News account. The captured Unit 42 page contains a matching threat-brief title but no substantive incident text. The linked reports therefore should not be treated as independently reviewed corroboration.^[0][9]

Attack chain

1. Initial exploitation: The account attributed to Unit 42 describes an unknown attacker exploiting PHP2Shell against a government entity in Europe. The supplied evidence does not identify which of the two CVEs was used in that intrusion or provide the initial exploit request.^[0]
2. Post-exploitation reconnaissance, credential access, and attempted domain escalation: Following exploitation, the attacker enumerated the endpoint, examined the authentication database with stolen credentials, and conducted host and Active Directory reconnaissance, including curl-based anonymous LDAP queries. Password hashes and MFA secrets were accessed within two hours of initial exploitation. The attacker also established an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation. The report does not establish the internal ordering of all these post-exploitation actions or confirm successful Domain Admin access.^[0]

Disclosure timeline

Actor profile

Lazarus Group ecosystem

Suspected affiliation applies only to the separate scanning activity reported by CYFIRMA. As relayed by The Hacker News, CYFIRMA assessed with moderate confidence that a Korean-speaking operator was affiliated with the Lazarus ecosystem, citing closed-I2P-channel coordination, North Korean linguistic features, previously observed operator handles, infrastructure reuse, and targeting patterns. The operators were reportedly prioritizing targets and deciding which public exploits to adapt. The supplied evidence does not connect this activity to the European government intrusion or establish successful exploitation by these operators.^[0]

How it works

The article characterizes CVE-2026-109618 and CVE-2026-109619 as critical vulnerabilities capable of remote code execution in default PHP configurations. Its technical explanation is presented for PHP2Shell collectively; the supplied text does not distinguish the individual root causes or exploit paths for the two identifiers.^[0]

In the explanation attributed to Datadog, PHP makes multiple copies while parsing a form-field name. An attacker needs a field name that fits within the accepted request body but is large enough that copying its key exceeds memory_limit. The resulting allocation failure must occur while PHP copies the name into a hash table. Reliable exploitation additionally requires defeating ASLR to obtain usable memory addresses.^[0]

The ReliaQuest lab observations connect exploitation testing to memory exhaustion, heap corruption, and an Apache worker crash following a POST request that returns HTTP 500. This is a reported detection sequence from controlled testing of CVE-2026-109618, not proof that every such crash represents successful code execution.^[0]

CVE-2026-115560 is a distinct follow-on issue with narrower prerequisites: an application must configure session.serialize_handler as php_binary or php_serialize, change it to php at runtime using ini_set(), and then call session_start(), while session upload progress remains enabled. The PHP Foundation statement quoted in the article says applications that never change the serialization handler at runtime can keep upload progress enabled.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The reported operational impact extends beyond web-server execution: credential material and MFA secrets were accessed rapidly, and the attacker attempted to expand into Active Directory.^[0]
• Keep confirmed exploitation, vulnerability probing, and suspected actor affiliation separate. The government intrusion, Lazarus-linked scanning assessment, and GlobalProtect honeypot probes are not established as one campaign.^[0]
• Internet exposure is not the same as verified vulnerability. Bitsight's nearly 37 million PHP or PHP-related internet-facing systems should not be presented as 37 million confirmed vulnerable hosts.^[0]
• The most concrete detection guidance is a correlated request/error/crash sequence. The most concrete remediation guidance is host-level PHP updating; the supplied evidence does not support an exact version-based upgrade prescription.^[0]
• The intelligence remains substantively single-source within the supplied record. A linked original report and a matching page title do not independently corroborate incident details when the captured original lacks its substantive body.^[0][9]

Defensive actions

• Prioritize updating the PHP runtime on exposed hosts using the available PHP2Shell security fixes; the supplied evidence does not identify exact fixed release numbers.: The article reports active exploitation and identifies a runtime flaw that application-code changes, plugin updates, or a WAF do not remove.^[0]
• Correlate POST requests returning HTTP 500 with PHP memory-exhaustion or heap-corruption errors and crashes of the Apache worker handling the request.: ReliaQuest reported this sequence during controlled reproduction of CVE-2026-109618. Correlation across PHP, Apache access, Apache error, and system logs is more faithful to the reported finding than treating an isolated 500 response as evidence of exploitation.^[0]
• Hunt request telemetry for 204.76.203.7 and the p2s-rider upload-progress marker, including dummy uploads without payloads.: These were reported in live honeypot probing. Matching requests warrant exposure review and investigation, but the observed pattern alone does not demonstrate successful RCE.^[0]
• After suspected PHP2Shell exploitation, investigate authentication-database access, exposure of password hashes and MFA secrets, anonymous LDAP queries, NTLM-relay activity, and attempted Domain Admin escalation.: The government-intrusion account describes credential and MFA-secret access within two hours, alongside Active Directory reconnaissance and relay activity. Investigation limited to the web process would omit the reported post-exploitation scope.^[0]
• Review command telemetry for the reported reconnaissance behaviors and output delimiters such as ==SHELLUSER== and ==PASSWD==, while treating the delimiters as contextual clues rather than definitive AI attribution.: Unit 42 reportedly observed these machine-parseable output structures during endpoint enumeration. The article presents them as suggestive behavioral markers, not conclusive identification of an agentic attacker.^[0]
• Do not rely solely on high-volume scanning thresholds when reviewing PHP2Shell reconnaissance against the sectors and regions described by CYFIRMA.: The separately reported scanning was deliberately paced, used rotating compromised nodes, and abandoned nodes after blocking or rate-limiting, limiting the usefulness of volume-only alerting.^[0]
• Assess CVE-2026-115560 separately by reviewing session.serialize_handler configuration, runtime ini_set() changes before session_start(), and whether session upload progress is enabled.: The reported follow-on issue requires that specific combination. The quoted Foundation guidance explicitly distinguishes applications that never change the handler at runtime, which can retain upload progress.^[0]