PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Threat actors have been observed using agentic artificial intelligence platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In one case, attackers targeted a government entity in Europe and within two hours of initial exploitation had successfully accessed password hashes and multi-factor authentication data.