Threat actors exploited PHP2Shell vulnerabilities (CVE-2026-109618/109619) and used agentic AI platforms for post-exploitation, compromising a European government entity and obtaining password hashes and multi-factor authentication data within two hours.
Disclosed 25 October 2026 · Record updated 25 October 2026
Attackers gained access to password hashes and multi-factor authentication data at a European government entity within two hours of initial exploitation, using agentic AI tools to accelerate post-exploitation activity amid broader global scanning for the vulnerability.
IncidentsAttackers exploited two PHP2Shell flaws and then turned to agentic AI platforms to move fast after the initial break-in, according to a report published on 25 October 2026.
25 Oct 2026
