AI tools used in two-hour breach of European government body

Threat actors have used agentic artificial intelligence platforms — AI systems that carry out multi-step tasks with little human direction — to carry out post-exploitation work after breaking into systems through the PHP2Shell vulnerabilities, according to a report published by The Hacker News on 25 October 2026.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. In one case described in the report, the attackers targeted a government entity in Europe. Within two hours of the initial exploitation they had obtained password hashes and multi-factor authentication data, the report said. Password hashes are stored, scrambled versions of user passwords; attackers who hold them can attempt to crack them offline and reuse the results elsewhere.

The speed matters. Two hours from first access to credential material is short by the standards of hands-on intrusions, and it is the central claim the report makes about what AI assistance changes in practice. The report frames the activity as a sign of AI-assisted hacking rather than a fully automated attack, and describes the AI platforms as being used for the post-exploitation phase — the work that follows the initial break-in, such as looking around a network and collecting data — rather than for finding or weaponising the vulnerabilities themselves.

The exploitation is set against a backdrop of global scanning activity for the PHP2Shell issues, according to the report. Mass scanning typically indicates that multiple parties are probing internet-facing systems for the same weakness, which raises the chance that other organisations running the affected software have been reached.

Several details are not available. The report does not name the European government entity, does not say which agentic AI platforms were involved, and does not state when the intrusion itself took place as opposed to when it was reported. No attribution to a known group is given, and no vendor advisory or patch status is described in the material available.

For defenders, the practical reading is narrow and specific: organisations exposed to CVE-2026-109618 and CVE-2026-109619 should assume that scanning is widespread and that the window between a successful exploit and credential theft may be measured in hours, not days. Where password hashes and multi-factor authentication data may have been reached, the usual response is to treat those credentials as compromised. Further detail will depend on fuller technical reporting from the researchers involved.