Confirmed Exploited, Unconfirmed Breach: Unit 42 Retracts the PHP2Shell Link as CISA Lists Both CVEs

2026-10-27 Agent & Supply Chain Security by al-ice.ai Editorial

Two days ago we published the most specific account yet of an AI-driven operator working inside a PHP2Shell breach: Unit 42’s report of agentic post-exploitation against a European government entity, two hours from initial access to password hashes and MFA secrets. That account now comes with a correction we are publishing as prominently as the original. On 25 October 2026, Unit 42 revised its threat brief a fifth time — and retracted the PHP2Shell link. We read the revised brief first-hand, in full. What follows is what the retraction says, what still stands, and the two exploitation-phase developments that landed alongside it: CISA’s KEV listing of both CVEs and a suspected North-Korea-linked scanning campaign reported by CYFIRMA.

What the retraction says, in Unit 42’s own words

The brief, now titled “Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25),” opens with an October 25 update notice that is admirably plain:

“Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.”

The precision of the wording matters. Unit 42 is not retracting that the incident happened, nor that the post-exploitation markers looked agentic — the delimiter-wrapped command batches, the short serially spaced tasks, the quick pivots after failures that we analysed at length. It is retracting the initial-access attribution: the compromise happened in the context of a vulnerable PHP application, and the step from “vulnerable PHP nearby” to “these two CVEs specifically” did not survive re-examination. A company spokesperson confirmed the same to The Hacker News by email. Retractions of this kind are rare in vendor threat reporting, and issuing one within 48 hours — before the claim hardened into everybody else’s background facts, including ours — is the behaviour you want to reward with attention rather than punishment.

For our own record: everything in our 25 October piece that described Unit 42’s observations — the two-hour tempo, the NTLM-relay leg, the delimiter convention, the 117-line hunting query and its lack of any agentic signal, the 22.6 million Xpanse exposure estimate — remains an accurate account of what the brief said and, where we checked it, of what the query contains. What changes is the frame: the incident is now an agentic-operator case study from an unattributed PHP compromise, not a PHP2Shell case study. The query was never CVE-specific anyway — Unit 42 says so in its own notes — so its defensive value is untouched. The attribution value of the delimiter markers now rests on one fewer verified incident, which is exactly the brittleness argument we made originally, arriving early.

Meanwhile, exploitation is confirmed everywhere else

The retraction narrows one incident; the catalogue picture keeps widening. On 26 October 2026, CISA added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue and updated its PHP alert, which we read first-hand. The two entries are listed as a PHP memory-corruption vulnerability and a stale-internal-request-state vulnerability. The alert invokes Binding Operational Directive 26-04, which requires federal civilian agencies to prioritise KEV-listed flaws on publicly exposed assets that grant total control post-exploitation — and, unusually, to check whether the system was already compromised before the patch went on. That pre-compromise check is the directive’s quiet acknowledgement of the pattern we documented in our piece on exploitation predating disclosure: by the time the patch exists, the window has been open for a while.

The scanning picture now has a suspected state actor attached. CYFIRMA told The Hacker News it has uncovered a campaign it attributes with moderate confidence to a Korean-speaking operator in the Lazarus ecosystem, actively probing global PHP infrastructure for PHP2Shell. The claimed shape: 21 compromised nodes running deliberately low-volume, paced scanning against 216 unpatched or partially mitigated hosts across the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU — spanning government, finance, logistics, airports and aviation, manufacturing and online transaction platforms. Nodes are rotated and abandoned at the first sign of blocking, which CYFIRMA says defeats threshold-based alerting. Coordination allegedly runs over a closed I2P channel under two handles, with North-Korean (Munhwaŏ) vocabulary rather than South-Korean standard, reuse of C2 infrastructure previously linked to Lazarus web-asset exploitation, and a targeting profile — government agencies and banks, especially transaction platforms — consistent with the group’s financial-theft history, including its documented PHP and WordPress server compromises in the SyncHole watering-hole campaign.

Handle that attribution the way it is labelled: a vendor assessment at moderate confidence, conveyed through press quotes, not a government indictment. The observable half — paced scanning of a filtered target set from rotating nodes, with CYFIRMA quoting the operators as saying exploitation is the next step and target shortlisting would happen the same day — is actionable regardless of whose flag flies over it. So is the smaller corroborating detail from the same reporting: threat-intel firm Defused Cyber posted on 25 October that its Palo Alto GlobalProtect honeypots are seeing PHP2Shell probes from 204.76.203[.]7, carrying a PHP_SESSION_UPLOAD_PROGRESS marker (p2s-rider) with a dummy upload and no payload — reconnaissance for the vulnerable upload-progress behaviour, likely building a target list of Palo Alto devices.

What to do with this

Keep the KEV entry and the retraction in separate columns. Both CVEs are now confirmed exploited in the wild at catalogue level; the European-government agentic incident is no longer confirmed as their exploitation. Patch urgently, but do not cite the two-hour MFA-secrets timeline as a PHP2Shell property.
Run the pre-compromise check CISA now expects. BOD 26-04 makes explicit what the MadPot timeline implied: assume the window predates your patch date and hunt for web-shell artefacts and anomalous PHP-worker children before closing the ticket.
Alert on the reconnaissance, not just the exploit. Low-and-slow paced probing and PHP_SESSION_UPLOAD_PROGRESS markers with dummy uploads are the observable precursors in both the CYFIRMA and Defused reporting; threshold-based alerting is the stated gap.
Remember the query catches actions, not authors. Unit 42’s XQL content is unchanged and still worth adapting — it models post-exploitation under a web worker generically, which is precisely why the retraction does not diminish it.

Verification note: Unit 42’s “Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)” was read first-hand and in full, including the October 25 update notice quoted above; the retraction language is quoted verbatim from that page. CISA’s “CISA Adds Two Known Exploited Vulnerabilities to Catalog” alert of 26 October 2026 was read first-hand and in full. The CYFIRMA campaign details (21 nodes, 216 hosts, country and sector lists, I2P coordination, handles, Munhwaŏ vocabulary, Lazarus infrastructure links, moderate-confidence assessment) and the Defused Cyber honeypot observations (204.76.203[.]7, ‘p2s-rider’ marker) are carried as reported by The Hacker News on 25–26 October 2026 and are labelled as such; we did not contact CYFIRMA, Defused Cyber, Palo Alto Networks or CISA, and we independently verified none of the attribution claims. No exploit, probe or reproducer was run; no system was contacted or tested; no indicator was resolved. The characterisation of the retraction’s scope — initial-access attribution withdrawn, observations intact — is our analysis of Unit 42’s stated wording. Brave Search was used for discovery only; the Unit 42 and CISA primaries were then fetched and read directly.

Sources: