Threat Actors Use AI Platforms to Exploit PHP2Shell CVEs in European Government Attack

Actors leveraged agentic AI to post‑exploit PHP2Shell vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619, accessing password hashes, MFA secrets, and establishing an NTLM‑relay tunnel into Active Directory within two hours of initial compromise, with command output wrapped in delimiters for AI parsing.