Unit 42 details how attackers leveraged agentic AI platforms for post-exploitation following PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Discover how threat actors targeted a European government entity, accessed MFA secrets within two hours, and attempted Active Directory privilege escalation.

The attack on a European government organization

In at least one case, unknown attackers targeted a government agency in Europe. Within just two hours of the initial breach, they were able to gain access to passwords and two-step verification secrets.…