Unit 42 reports PHP2Shell breach at European government entity

Attackers exploiting PHP2Shell vulnerabilities accessed password hashes and multi-factor authentication secrets at a European government entity within two hours of initial exploitation, Palo Alto Networks Unit 42 said. They also established a tunnel to relay authentication into Active Directory and attempted to gain Domain Admin privileges. Unit 42 said command patterns suggested an AI agent assisted the activity after the breach, including delimiters that organize output for a model to read. That assessment does not establish the attacker's identity. The report adds a successful compromise to earlier accounts of widespread scanning. The vulnerabilities can enable remote code execution in default PHP configurations; updating PHP itself is required to close the gap.