{"id":1305,"date":"2026-10-25T11:47:52","date_gmt":"2026-10-25T09:47:52","guid":{"rendered":"https:\/\/familiebuckens.nl\/?p=1305"},"modified":"2026-10-26T11:49:30","modified_gmt":"2026-10-26T09:49:30","slug":"php2shell-exploitation-attempts-continue-amid-suspected-n-korea-global-scanning-activity","status":"publish","type":"post","link":"https:\/\/familiebuckens.nl\/index.php\/2026\/10\/25\/php2shell-exploitation-attempts-continue-amid-suspected-n-korea-global-scanning-activity\/","title":{"rendered":"PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>In an update, Palo Alto Networks Unit 42 said it&#8217;s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>&#8220;What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,&#8221; a spokesperson for the company told The Hacker News via email. &#8220;This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs.&#8221;<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The original story follows.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the <a href=\"https:\/\/thehackernews.com\/2026\/10\/php2shell-exploit-attempts-hit-millions.html\" target=\"_blank\" rel=\"noopener\">PHP2Shell<\/a> vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets,&#8221; Palo Alto Networks Unit 42 <a href=\"https:\/\/unit42.paloaltonetworks.com\/cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">said<\/a>.<\/p>\n\n\n<a class=\"wp-block-read-more\" href=\"https:\/\/familiebuckens.nl\/index.php\/2026\/10\/25\/php2shell-exploitation-attempts-continue-amid-suspected-n-korea-global-scanning-activity\/\" target=\"_self\"><a href=\"https:\/\/thehackernews.com\/2026\/10\/php2shell-exploitation-hits-government.html\">PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity<\/a><span class=\"screen-reader-text\">: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity<\/span><\/a>","protected":false},"excerpt":{"rendered":"<p>In an update, Palo Alto Networks Unit 42 said it&#8217;s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. &#8220;What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,&#8221;&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[72,39],"class_list":["post-1305","post","type-post","status-publish","format-standard","hentry","category-vulnerability","tag-72","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1305","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/comments?post=1305"}],"version-history":[{"count":1,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1305\/revisions"}],"predecessor-version":[{"id":1306,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1305\/revisions\/1306"}],"wp:attachment":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/media?parent=1305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/categories?post=1305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/tags?post=1305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}