AI-assisted attackers breach European government via PHP2Shell
PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach
Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.