CyberSecurity News
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
AI summary
Threat actors are exploiting PHP2Shell vulnerabilities to target organizations, including a government entity in Europe. The attackers were able to access sensitive information, such as password hashes and multi-factor authentication data, within two hours of initial exploitation. The threat actors are utilizing artificial intelligence platforms to facilitate post-exploitation activities. Global scanning for vulnerable systems is also underway, indicating a widespread campaign to exploit these vulnerabilities. The vulnerabilities in question are tracked as CVE-2026-109618 and CVE-2026-109619. The use of AI-assisted hacking techniques suggests a potentially more sophisticated and efficient attack approach.
Vulnerabilities mentioned
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.