Unit 42 traced agentic AI platforms driving post-exploitation at a European government agency

Palo Alto Networks' Unit 42 confirmed that the PHP2Shell remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0, are being actively exploited against internet-exposed PAN-OS management interfaces, with Dream Research reporting a campaign that chained PHP2Shell with a Linux kernel privilege-escalation flaw to gain root access on 25 servers. Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to the two flaws, though Palo Alto Networks said only about 0.02% of its global installed base had internet-facing management interfaces and was impacted, and that each affected customer was contacted individually. The company urged customers to remove public internet access to management interfaces, restrict management access to trusted internal IP addresses, and apply available PAN-OS fixes, which it said interrupt the observed exploit chain.

Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, referred to as PHP2Shell. Both are remote code execution RCE vulnerabilities rated as 9.2 CVSS 4.0 . We encourage reviewing the PHP Group’s security advisory and patching guidance https://www.php.net/index.php . PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately. Palo Alto Networks has evaluated our product portfolio regarding this issue. Refer to our security advisory https://security.paloaltonetworks.com/CVE-2026-109618 for the most up to date details. - CVE-2026-109618 https://nvd.nist.gov/vuln/detail/cve-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory OOM triggers. - CVE-2026-109619 https://nvd.nist.gov/vuln/detail/cve-2026-109619 describes a remote code execution vulnerability where longjmp fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code. At the time of publication, Palo Alto Networks Cortex Xpanse https://docs-cortex.paloaltonetworks.com/p/XPANSE has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry. Update October 29, 2026 As disclosed in our security advisory https://security.paloaltonetworks.com/CVE-2026-109618 , the PHP2Shell vulnerabilities are being actively exploited against PAN-OS management interfaces that are exposed to the internet. Dream Research https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results. By default the management interface is not exposed to the internet per security best practices https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices ; customers should immediately remove public internet access to management interfaces if it is enabled. Customers should also restrict management access to trusted internal IP addresses, and apply available PAN-OS fixes addressing PHP2Shell. Customers who have applied the available patches are not affected. These fixes interrupt the observed exploit chain. Our security advisory provides affected versions, patch availability and mitigation requirements. The Workarounds and Mitigations section of our security advisory https://security.paloaltonetworks.com/CVE-2026-109618 also provides details of how Advanced Threat Prevention signatures provide coverage against this vulnerability. Only a small fraction of a percent approximately .02% of our global installed base has internet-facing management interfaces configured and were impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available. Palo Alto Networks customers receive protections from and mitigations for CVE-2026-109618 and CVE-2026-109619 in the following ways: Palo Alto Networks also recommends assessing your exposure to these vulnerabilities and patching immediately. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services https://www.paloaltonetworks.com/unit42/threat-intelligence and our Deep and Dark Web Service https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service . The Unit 42 Incident Response team https://start.paloaltonetworks.com/contact-unit42.html can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. | Vulnerabilities Discussed | CVE-2026-109618 https://unit42.paloaltonetworks.com/tag/CVE-2026-109618/ , CVE-2026-109619 https://unit42.paloaltonetworks.com/tag/CVE-2026-109619/ , PHP2Shell https://unit42.paloaltonetworks.com/tag/PHP2Shell | Unit 42 Managed Threat Hunting Queries The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit these CVEs across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation. | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 | // Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case sensitive = false \| dataset = xdr data \| filter event type = ENUM.PROCESS and event sub type = ENUM.PROCESS START and action process image name = null \| fields time, agent hostname, agent id, event id, actor effective username, actor process image name, actor process command line, action process image name, action process image path, action process image command line, causality actor process image name, causality actor process command line // Lowercase fields once \| alter actor effective username = lowercase actor effective username , actor process image name = lowercase actor process image name , actor process command line = lowercase actor process command line , action process image name = lowercase action process image name , action process image path = lowercase action process image path , action process image command line = lowercase action process image command line , causality actor process image name = lowercase causality actor process image name // Anchor: PHP web worker or the launcher that started it as causality, PHP worker as direct parent, // a shell directly under an IIS worker, or the web service account outside an interactive login session \| filter causality actor process image name ~= "^ ?:apache2\|httpd\|apachectl\|php-fpm 0-9. \|php-cgi 0-9. ?:\.cagefs ?\|php-fcgi\|sw-engine ?:-fpm ?\|frankenphp\|lsphp 0-9 \|lshttpd\|litespeed\|xampp-control\|wampmanager\|laragon\|de\.appsolute\.mampprohelper ?:\.exe ?$" or actor process image name ~= "^ ?:apache2\|httpd\|php-fpm 0-9. \|php-cgi 0-9. ?:\.cagefs ?\|php-fcgi\|sw-engine ?:-fpm ?\|frankenphp\|lsphp 0-9 \|lshttpd\|litespeed ?:\.exe ?$" or causality actor process image name = "w3wp.exe" and actor process image name in "cmd.exe", "powershell.exe", "pwsh.exe" or actor effective username ~= " ?:^\| ^a-z0-9 - ?:www-data\|apache\|nginx\|wwwrun\|iusr $" and coalesce causality actor process image name, "" ~= "^ ?:sshd ?:-session ?\|screen\|tmux\|login\|mosh-server\|dropbear $" or actor effective username contains "iis apppool" // Known-benign workloads monitoring plugins, hosting control panels and commands launched directly by CDK Drive DMS scripts \| filter action process image command line ~= " ?:\/usr\/lib ?:64 ?\/nagios\/plugins\/\|\/usr\/local\/cpanel\/\|\/usr\/local\/psa\/\|\/opt\/psa\/\|\/usr\/local\/directadmin\/\|\/usr\/local\/ispconfig\/\|\/usr\/local\/virtualizor\/\|richdocumentscode\|phpsysinfo\|librenms\|zabbix " and coalesce actor process command line, "" ~= "^ ?:\S+\s+ ? ?:\/adp\/ ?:bin\|3party\|etc \/\|\/local\/bin\/uminfo " // Phusion Passenger app spawns run id/uname/env from their spawn helpers \| filter coalesce action process image command line, "" ~= "^ ?:\/usr\/bin\/ ? ?:id ?:\s+- a-z + ?\|uname ?:\s+- a-z + ?\|hostname\|env $\|passenger-config\s+system-metrics" or lowercase coalesce actor process command line, "" ~= "passengeragent\s+spawn-\|spawn ?:preparer\|envsetupper shell\|\/helper-scripts\/rack-preloader\.rb\|passenger ruby wrapper\|phusion passenger" // RHEL-family /etc/profile runs these in every bash login shell \| filter coalesce action process image command line, "" ~= "^\/usr\/bin\/ ?:id\s+- ug n\|hostname $" or lowercase coalesce actor process command line, "" ~= "^ ?:\S \/ ?bash\s+- a-z l\|^-bash$" // parsed lookup: the tool is the first command of its parent "sh -c" and its output is piped into a text filter scripted lookup \| alter tool = replace action process image name, ".exe", "" , shell first cmd = arrayindex regextract coalesce actor process command line, "" , "^-? ?:\S \/ ? ?:ba\|da\|k ?sh\s+-c\s+ \S+ " , 0 \| alter parsed lookup = if arrayindex regextract coalesce shell first cmd, "" , " ^\/ + $" , 0 = tool and actor process command line ~= "^-? ?:\S \/ ? ?:ba\|da\|k ?sh\s+-c\s+ ^;&\| +\\|\s ?:e?grep\|awk\|cut\|sed\|wc\|head\|tail\|sort\|tr \b", 1, 0 // Signals - one event can carry several \| alter signals = concat // SCORED - host/user/network/container recon, excluding scripted lookups distinct tools are counted later if parsed lookup = 0 and tool in "whoami", "hostname", "hostnamectl", "ifconfig", "netstat", "ss", "arp", "route", "w", "who", "last", "lastlog", "getent", "lsb release", "lscpu", "printenv", "env", "getcap", "capsh", "systeminfo", "ipconfig", "nltest", "tasklist", "quser", "qwinsta" or tool = "uname" and action process image command line ~= "\buname\s+ ?:- a-z arv \|--all\|--kernel- " or tool = "id" and action process image command line ~= "\bid\s+- ugnrz +\b" or tool = "ip" and action process image command line ~= "\bip\s+ ?:- a-z0-9 +\s+ ?:a\|addr\|address\|r\|route\|n\|neigh\|link \b" or tool = "ps" and action process image command line ~= "\bps\s+ ?:-?aux\|-ef\|-e\b\|axjf\|-auxf " or tool in "net", "net1" and action process image command line ~= "\bnet1? ?:\.exe ?\s+ ?:user\|group\|localgroup\|accounts\|view\|share \b" or tool = "cat" and action process image command line ~= "\/etc\/ ?:passwd\|shadow\|group\|issue\|os-release\|hosts\|hostname\|resolv\.conf\|crontab\|sudoers \|\/proc\/ ?:version\|net\/\| ?:self\| 0-9 + \/ ?:cgroup\|mountinfo \|\/\.dockerenv" or tool = "find" and action process image command line ~= "-perm\s+ ?:-4000\|-u=s\|\/4000\|-2000 " or tool = "sudo" and action process image command line ~= "\bsudo\s+-l\b" , "recon,", "" , // SCORED - payload transfer to a file curl with an output file, wget not to stdout , excluding /dev/null and localhost if tool = "curl" and action process image command line ~= "\s ?:- a-z o\b\|--output\b\|--remote-name \| \s \S" or tool = "wget" and action process image command line ~= "\s- a-z o\s - ?:\s\|$ \|--output-document=-\|--spider" or tool in "tftp", "fetch" and action process image command line ~= " ?:https?\|ftp\|tftp :\/\/\|\s- a-z o ?:\s\|-\|$ " or tool = "certutil" and action process image command line ~= "urlcache\|verifyctl" or tool = "bitsadmin" and action process image command line contains "/transfer" or tool in "powershell", "pwsh" and action process image command line ~= "downloadstring\|downloadfile\|invoke-webrequest\|\biwr\b\|net\.webclient\|start-bitstransfer" and action process image command line ~= "-o\s \/dev\/null\|--output-document=\/dev\/null\|:\/\/ ?:localhost\|127\.0\.0\.1\|\ ::1\ ? :\/ ", "download,", "" , // SCORED - chmod making a file in a tmp-class directory executable if tool = "chmod" and action process image command line ~= "\bchmod\s+ ?:- a-z +\s+ ?: 0-7 ? ?: 1357 0-7 {2}\| 0-7 1357 0-7 \| 0-7 {2} 1357 \| ugoa,+=rwst- += rwst x ugoa,+=rwxst- \s" and action process image command line ~= "\s\/ ?:tmp\|var\/tmp\|dev\/shm\|run\/shm \/", "staging,", "" , // STANDALONE - binary executed from a writable/memory-backed dir, or from a deleted/memfd image if action process image path ~= "^\/ ?:tmp\|var\/tmp\|dev\/shm\|run\/shm\|run\/user \/\|^\/proc\/ ?:self\| 0-9 + \/fd\/\|^\/memfd:\|$deleted$\s $", "writable exec,", "" , // STANDALONE - reverse/bind shell constructs if action process image command line ~= "\/dev\/ ?:tcp\|udp \/\| ?:^\| \s;&\| \/ ?:nc\|ncat\|netcat ?:\. a-z + ?\s+ ?:\S+\s+ {0,6}? ?:- a-z {0,3} ec \|--exec\|--sh-exec \s+\S ?:sh\|bash\|cmd\|python 0-9. \|perl \b\|\bsocat\b ^;&\| {0,80}exec:\|\bmkfifo\b\|\b ?:ba\|da\|z\|a ?sh\s+-i\b\|socket\.socket\ \|fsockopen\ \|\bpty\.spawn\ ", "revshell,", "" , // STANDALONE - remote content piped straight into an interpreter if action process image command line ~= " ?:curl\|wget\|fetch \b ^\| \\|\s ?:\/\S \/ ? ?: ?:ba\|da\|z\|a ?sh\|python 23 ?\|perl\|php \b", "pipe to shell,", "" , // SCORED - encoded/obfuscated execution if action process image command line ~= "base64\s+ ?:-d\|--decode \|frombase64string\|-e ?:nc\|ncodedcommand ?\s+ a-z0-9+\/ {40,}\|echo\s+ a-z0-9+\/ {40,}\|\bopenssl\s+ ?:enc\b ^\|; \s-d\b\|base64\s+-d\b \|\bxxd\s+ ?:- a-z +\s+ - a-z r", "encoded,", "" , // SCORED - persistence / backgrounding crontab edits, authorized keys writes, new users, nohup/setsid of tmp-class binaries or shells, // scheduled tasks, Run keys, systemd units, chattr +i if tool = "crontab" and action process image command line ~= "\bcrontab\s+-l\s $" or action process image command line ~= " ?: ?\s \|\btee\s+ ?:-a\s+ ?\|\b ?:cp\|mv\|install\|ln \s+ ?:-\S+\s+ \S+\s+ \S authorized keys" and action process image command line ~= "\bcp\s+\S \/\.ssh\/id a-z0-9 +\.pub\s+\S \/\.ssh\/authorized keys" or action process image command line ~= "\b ?:useradd\|adduser \b\|\b ?:nohup\|setsid \s+ ?:-\S+\s+ ?:\.\/\|\/ ?:tmp\|var\/tmp\|dev\/shm\|run\/shm \/\| ?:ba\|da\|z ?sh\s+- ci \b \|schtasks\s+\/create\|currentversion.run\b\|\bsystemctl\s+ ?:--user\s+ ?enable\b\|\.config\/systemd\/user\/\|\/etc\/systemd\/system\/\|\bchattr\s+\+ a-z i", "persistence,", "" , // SCORED - inline interpreter one-liners, excluding PHP version/feature probes and Ruby gem-path probes if action process image command line ~= " ?:^\| ^a-z0-9. - ?:python 23 ? ?:\. 0-9 + ?\s+-c\|perl\s+-e\|ruby\s+-e\|node ?:js ?\s+-e\|lua\s+-e\|php 0-9. \s+-r \b" and action process image command line ~= "phpversion$\|php version\|date\ 't'$\|function exists\ \|extension loaded\ \|gem\.path", "interpreter,", "" , // SCORED - cloud/container credential and secret access credential files, env-var names, instance metadata service, .env reads if action process image command line ~= "\.aws\/ ?:credentials\|config \|aws secret access key\|aws session token\|\/\.azure\/\|azure client secret\|identity endpoint\|\/\.config\/gcloud\/\|application default credentials\.json\|\/secrets\/kubernetes\.io\/serviceaccount\|\/run\/secrets\/\|\/\.docker\/config\.json\|169\.254\.169\.254\|metadata\.google\.internal\|\/proc\/ ?:self\| 0-9 + \/environ\|\b ?:cat\|head\|tail\|less\|more\|strings\|grep \b ^\|; \.env\b", "cred access,", "" \| filter signals = "" \| alter recon tool = if signals contains "recon", tool, null // Group per host, PHP worker and account in 1-hour buckets \| bin time span = 1h \| comp count as events, count distinct recon tool as recon tool count, values recon tool as recon tools, values signals as signals, values action process image command line as action process image command line, values actor process command line as actor process command line, values causality actor process command line as causality actor process command line, first event id as event id by time, agent id, agent hostname, causality actor process image name, actor effective username \| alter all signals = arraystring signals, "," // Threshold: any standalone signal, OR 3+ distinct recon tools, OR recon plus a follow-on scored signal \| filter all signals ~= "revshell\|pipe to shell\|writable exec" or recon tool count = 3 or recon tool count = 1 and all signals ~= "download\|staging\|encoded\|persistence\|interpreter\|cred access" | | 1 2 3 4 5 6 7 8 9 10 11 12 | // Description: This query identifies potential inbound exploitation attempts from publicly routed IP addresses using Palo Alto Networks NGFW Threat Logs. config case sensitive = false \| dataset = panw ngfw threat raw \| filter sub type = "vulnerability" \| filter to zone ~= "internet\|untrust\|outside\|external\|wan" \| filter not incidr source ip, "10.0.0.0/8" or incidr source ip, "172.16.0.0/12" or incidr source ip, "192.168.0.0/16" \| filter to string threat id contains "543004" or threat name ~= "php\|multipart\|upload.progress\|longjmp\|CVE-2026-10961 89 " \| comp count as hits, count distinct source ip as sources, values source ip as source ips, values action as actions, values severity as severities, min time as first seen, max time as last seen by threat name, threat id, dest ip, nat dest, dest port, to zone \| sort desc hits | Palo Alto Networks customers can leverage several product protections and updates to identify and defend against these vulnerabilities. Unit 42 Continuous Frontier AI Defense https://www.paloaltonetworks.ca/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense is an offensive security service designed to assist organizations with continuously discovering hidden and unknown exposures in dynamic environments, validate real-world exploitability across attack paths through agentic testing and expert analysis, and provide prioritized remediation and virtual patching guidance to accelerate risk mitigation. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services https://www.paloaltonetworks.com/unit42/threat-intelligence and its Deep and Dark Web Service https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service . If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team https://start.paloaltonetworks.com/contact-unit42.html or call: - North America: Toll Free: +1 866 486-4842 866.4.UNIT42 - UK: +44.20.3743.3660 - Europe and Middle East: +31.20.299.3130 - Asia: +65.6983.8730 - Japan: +81.50.1790.0200 - Australia: +61.2.4062.7950 - India: 000 800 050 45107 - South Korea: +82.080.467.8774 Advanced WildFire The Advanced WildFire https://docs.paloaltonetworks.com/wildfire machine-learning models and analysis techniques have been reviewed and updated in light of indicators associated with chained PHP and kernel vulnerabilities. Cortex XDR https://docs-cortex.paloaltonetworks.com/p/XDR and XSIAM https://docs-cortex.paloaltonetworks.com/p/XSIAM are designed to help protect against post-exploitation activities using the multi-layer protection approach. provide multilayered protection against post-exploitation activities. Cortex XDR also provides visibility into installed software across endpoints and servers, including on-premises and legacy environments, to help security teams identify systems running vulnerable PHP versions and prioritize remediation. Cortex Cloud https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud and Prisma Cloud https://docs.prismacloud.io/ help identify vulnerable PHP versions across code, registry images and runtime instances. Cortex Cloud's Supply Chain Attacks Portal helps teams identify affected assets and take action to prevent vulnerable components from being reintroduced. Additionally, Cortex CLI integrates into CI/CD pipelines to scan images and enforce policies that block vulnerable images before they reach registries and runtime environments. Cortex Xpanse https://docs-cortex.paloaltonetworks.com/p/XPANSE can identify exposed devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the PHP Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. Next-Generation Firewall Next-Generation Firewall https://www.paloaltonetworks.com/network-security/next-generation-firewall with the following security subscriptions can help block the attacks: - Advanced Threat Prevention Plus with Frontier Virtual Patching https://www.paloaltonetworks.com/blog/network-security/harnessing-ai-for-prevention-introducing-frontier-virtual-patching/ since 10:21 p.m. PT on October 20, 2026, via Threat ID 543004 https://threatvault.paloaltonetworks.com/?query=543004 . - Advanced Threat Prevention https://www.paloaltonetworks.com/network-security/advanced-threat-prevention with best practices since October 21, 2026 via the Threat Prevention signatures listed in full in our security advisory https://security.paloaltonetworks.com/CVE-2026-109618 . Device Security Device Security https://docs.paloaltonetworks.com/iot/getting-started/iot-security-solution is designed to proactively protect the specialized device attack surface of operational environments, providing deep visibility into industrial protocols, actionable risk insights, and adaptive security enforcement across all OT and IoT assets. Additional Resources - Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 — Security Advisory, Palo Alto Networks - Millions of PHP Instances Exposed: What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/ — Lee Klarich, Palo Alto Networks - Security advisory: Critical remote code execution vulnerabilities, update now https://www.php.net/archive/2026.php 2026-10-21-5 - PHP - Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers — Dream Research Updated October 21, 2026, at 9:30 a.m. PT to add Palo Alto Networks security advisory, update links in additional resources, and update product protection section. Updated October 21, 2026, at 1:00 p.m. PT to update the product protection section. Updated October 22, 2026, at 4:30 p.m. PT to add additional product protection information for Advanced Threat Prevention, Cortex Cloud, and Prisma Cloud and make light copyedits. Updated October 23, 2026, at 12:30 p.m. PT to add details on agentic AI post-exploitation activity and Managed Threat Hunting queries. Updated October 25, 2026, at 2:15 p.m. PT to retract our October 23 update. Updated October 29, 2026 at 11:00 a.m PT to add details on a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access against PAN-OS management interfaces that are exposed to the internet. October 25 Update Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.