> TritonInfoSec News
Home / Oct 26, 2026 / Story
1
#1 The Hacker News general October 25, 2026 at 17:19 UTC

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

By [email protected] (The Hacker News)

AI Summary

CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are being actively exploited in targeted attacks, with threat actors using agentic AI platforms for post-exploitation. In one documented case, attackers hit a European government entity and extracted password hashes and MFA data within two hours of initial exploitation — underscoring the urgency of patching PHP installations running versions 8.2–8.5.

Read full article → https://thehackernews.com/2026/10/php2shell-exploi…

Relevance score: 82.0/100

# More from October 26

  1. 2
    PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer
  2. 3
    PHP2Shell Exploitation Moves From Probes to Working Shells SecurityWeek
  3. 4
    Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs The Hacker News
  4. 5
    Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages SecurityWeek
  5. 6
    Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Hacker News
  6. 7
    Industrial Vendors Check Products for PHP2Shell Vulnerabilities SecurityWeek
  7. 8
    Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento The Hacker News
  8. 9
    Popular AI tool LiteLLM says unrevoked key allowed hackers to target users The Record
  9. 10
    uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts The Hacker News