PHP2Shell Exploitation Hits European Government Entity With AI-Assisted Attack

· Cybersecurity · European Union

Threat actors exploited the PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, against a government entity in Europe, according to The Hacker News. In one case, attackers reached their target within two hours of the initial intrusion. The report also said attackers used agentic artificial intelligence platforms for post-exploitation activity, a technique that shortens the time between initial access and follow-on actions. Global scanning for the two flaws is ongoing. The incident shows how quickly automated tooling can turn a software flaw into a full intrusion at an organization that handles public-sector data. Administrators running affected PHP software face pressure to patch and to monitor for post-compromise behavior, not just the initial exploit attempt.

Why it matters：It shows agentic AI compressing attack timelines against public-sector targets, raising the bar for detection and patch response across government IT.

Key points

  • Two PHP2Shell flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
  • Attackers used agentic AI platforms for post-exploitation work.
  • The European government entity was reached within two hours of initial access.

Sources (original reporting)

More stories from this day