# Unit 42 reports PHP2Shell breach at European government entity

_Published Sunday, October 25, 2026 at 4:06 PM EDT · Security · Latest · Tier 2 — Notable_

![Unit 42 reports PHP2Shell breach at European government entity — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzK2qokKedMIUzd876s0EWaLDb7qw-DMzlFWKvmfgCzMKZ2KVvdpZ-298SoEm1_PP6aoEBc6q1LAydnANGur1FbFNmXmhlo6zHtRFvgRcbx-LOoDoM_-JI-_7XkkM4r5q3LQH1SdfirarXTGeiu16d5YMDSeYs8tfJn5ITfRQ4DThbqkq66b4WdDQcOJqf/s1700-nu-rw-lo-l85-e365/php2shell-exploit.jpg)

Attackers exploiting PHP2Shell vulnerabilities accessed password hashes and multi-factor authentication secrets at a European government entity within two hours of initial exploitation, Palo Alto Networks Unit 42 said. They also established a tunnel to relay authentication into Active Directory and attempted to gain Domain Admin privileges.

Unit 42 said command patterns suggested an AI agent assisted the activity after the breach, including delimiters that organize output for a model to read. That assessment does not establish the attacker's identity.

The report adds a successful compromise to earlier accounts of widespread scanning. The vulnerabilities can enable remote code execution in default PHP configurations; updating PHP itself is required to close the gap.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html)

---
Canonical: https://techandbusiness.org/newswire/46Le_3gY5cSmEO5CuUPMLx
Published: 2026-10-25T20:06:21.038Z
Story chronology: 2026-10-25T17:19:46.000Z
Retrieved: 2026-10-25T22:57:32.083Z
Publisher: Tech & Business (techandbusiness.org)