NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)

Key facts for NCSC AI ransomware warning

Detection coverage for NCSC AI ransomware warning

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5150 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Splunk SPL, Post-Exploitation)

Detects web server or PHP worker processes spawning shells, scripting runtimes or download tools, PHP files written into web roots by worker processes, and a root-owned child (ran_as_root) that may indicate chained Fragnesia (CVE-2026-46300) privilege escalation. Reflects root webshell persistence reported on PAN-OS management servers after PHP2Shell exploitation (TL-2026-5150). SPL and KQL variants also match three community-related sample SHA256 hashes (low confidence).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1059.004, T1068
• Data sources: sysmon_for_linux, microsoft_defender_for_endpoint_linux, auditd
• Severity: critical
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventID=1 earliest=-24h
```Web server or PHP worker spawning a shell or download tool indicates a webshell or PHP2Shell RCE; root children suggest chained kernel privilege escalation (Fragnesia CVE-2026-46300); hash leg covers community-sourced sample hashes (low confidence)```
| eval parent_base=mvindex(split(ParentImage,"/"),-1), child_base=mvindex(split(Image,"/"),-1)
| eval web_to_shell=if(match(parent_base,"^(httpd|apache2|php-fpm[0-9.]*|php-cgi|php|nginx|lighttpd)$") AND match(child_base,"^(sh|bash|dash|busybox|nc|ncat|curl|wget|python3?|perl|ssh)$"),1,0)
| eval hash_hit=if(match(_raw,"590942bc868e9ee89884bb183de4b4c49dbf96d51578a4936d1fa88f422d3b1f|917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c|a75ff95e30207fd4cfc325be1b10a7e2a775fe0b061a151a2072eaf0070d041d"),1,0)
| eval ran_as_root=if(User="root",1,0)
| where web_to_shell=1 OR hash_hit=1
| stats count min(_time) AS first_seen max(_time) AS last_seen max(ran_as_root) AS ran_as_root max(hash_hit) AS hash_hit values(CommandLine) AS commands BY host parent_base child_base
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let WebProcs = dynamic(["httpd", "apache2", "php-fpm", "php-cgi", "php", "nginx", "lighttpd"]);
let ShellSpawn = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (WebProcs) or InitiatingProcessFileName startswith "php-fpm"
| where FileName in~ ("sh", "bash", "dash", "busybox", "nc", "ncat", "curl", "wget", "python3", "perl", "ssh")
| project Timestamp, DeviceName, AccountName, Detection = "web_worker_child_process", Artifact = FileName, Detail = ProcessCommandLine, ParentProcess = InitiatingProcessFileName;
let WebshellDrop = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where InitiatingProcessFileName in~ (WebProcs) or InitiatingProcessFileName startswith "php-fpm"
| where FolderPath has_any ("/var/www", "/usr/share/nginx", "/srv/www", "/opt/lampp/htdocs") and FileName endswith ".php"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Detection = "php_file_written_by_web_worker", Artifact = FolderPath, Detail = FileName, ParentProcess = InitiatingProcessFileName;
let HashHit = DeviceFileEvents
| where Timestamp > ago(24h)
| where SHA256 in~ ("590942bc868e9ee89884bb183de4b4c49dbf96d51578a4936d1fa88f422d3b1f", "917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c", "a75ff95e30207fd4cfc325be1b10a7e2a775fe0b061a151a2072eaf0070d041d")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Detection = "community_hash_match", Artifact = FolderPath, Detail = SHA256, ParentProcess = InitiatingProcessFileName;
union ShellSpawn, WebshellDrop, HashHit
| order by Timestamp desc

Sigma

title: Web Server or PHP Worker Spawning Shell or Download Tool (PHP2Shell Post-Exploitation)
id: 51500b01-7c3e-4d2a-9b10-000000000001
status: experimental
description: Detects a web server or PHP worker process (httpd, apache2, php-fpm, nginx) spawning a shell, scripting runtime, netcat or download utility on Linux. This is the typical post-exploitation pattern after PHP2Shell RCE (CVE-2026-109618/109619) and for webshells such as those reported on PAN-OS management servers in TL-2026-5150. A root-owned child process may indicate chained privilege escalation via Fragnesia (CVE-2026-46300).
references:
  - https://pentest-tools.com/research/php2shell-rce
  - https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
  - https://securityaffairs.com/?p=201840
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.004
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026-109618
  - cve.2026-109619
  - cve.2026-46300
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/lighttpd'
      - '/php-cgi'
      - '/php-fpm'
      - '/php-fpm8'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/busybox'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that legitimately shell out (backup, image conversion, deployment hooks)
  - Admin maintenance scripts launched through a web control panel
level: high

Known false positives:

• Web applications that legitimately shell out for backups, image conversion or deployments
• CMS plugin installers that write PHP files to the web root
• Admin maintenance scripts launched via web control panels

Tuning notes: Baseline legitimate parent-child pairs per host and exclude them by CommandLine. Alert at higher severity when the child runs as root or from a world-writable path. Update the file-write path list for your web roots. Treat the community hash and IP matches as corroboration only and review them periodically.

• 🔒 PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Sentinel KQL, Exploitation) · unlock with TL Creds
• 🔒 Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Sentinel KQL, Post-Exploitation) · unlock with TL Creds
• 🔒 Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Sentinel KQL, C2 / Lateral Movement) · unlock with TL Creds
• 🔒 PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Sigma, Exploitation) · unlock with TL Creds
• 🔒 Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Sigma, Post-Exploitation) · unlock with TL Creds
• 🔒 Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Sigma, C2 / Lateral Movement) · unlock with TL Creds
• 🔒 PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Splunk SPL, Exploitation) · unlock with TL Creds
• 🔒 Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Splunk SPL, C2 / Lateral Movement) · unlock with TL Creds

Indicators of compromise for NCSC AI ransomware warning

As of 2026-11-03, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5150.

How NCSC AI ransomware warning works

This is a strategic, forward-looking assessment from the UK National Cyber Security Centre (NCSC), not a report of a specific malware family or campaign. Speaking at the launch of the NCSC Annual Review in London on 3 November 2026, NCSC CEO Richard Horne warned that AI-powered malware is strongly expected in ransomware attacks on UK critical national infrastructure (power stations, airports, hospitals) by 2028, and that nation states such as Russia and China are expected to routinely incorporate AI into cyber activity in pursuit of geopolitical objectives. Horne stated that vulnerabilities tolerated for far too long can now be discovered and exploited at a scale once unimaginable, and criticised end-of-life systems kept running 'for just one more year' and upgrades deferred as a 'cost efficiency'.

The warning builds on earlier NCSC statements. The NCSC assessment 'Impact of AI on cyber threat from now to 2027' (7 May 2025, CYBERUK) judged AI will almost certainly enhance threat actors' ability to exploit known vulnerabilities, shortening the window between disclosure and exploitation; that AI is already used for victim reconnaissance and social engineering; that AI-enabled tools will highly likely widen access for state and non-state actors; that advanced actors may use AI for zero-day discovery; and that a 'digital divide' will emerge between well-defended systems and a large, more vulnerable remainder. Fully autonomous end-to-end attacks were assessed as unlikely to 2027. That report does not address ransomware as a distinct category. On 17 June 2026 the NCSC reported 200+ incidents affecting UK CNI in the year to May 2026, about 75% linked to state actors (Russia, China and Iran named), and judged it highly likely that by 2028 AI tools will be used to exploit known weaknesses in ageing CNI technology.

The 3 November coverage cites 'PHP2Shell' as the best recent example of exploitable weaknesses; NCSC issued 110,000 proactive notifications and Early Warning alerts. Secondary reporting (BleepingComputer, Pentest-Tools, Security Affairs, Infosecurity Magazine) identifies PHP2Shell as two PHP core flaws: CVE-2026-109618 (out-of-memory request-memory corruption leading to RCE) and CVE-2026-109619 (stale internal request-state / heap use-after-free reachable via INI diagnostics and the session upload-progress handler), vendor CVSS 9.2 (v4.0), 9.8 per Pentest-Tools (v3.1). The flaws trace back to PHP 5.4 (2012) and are highest risk for mod_php, where an unauthenticated request can trigger the bug before application code runs. PHP shipped fixes on 21 October 2026 (8.5.12, 8.4.27, 8.3.36, 8.2.35); branches 8.1 and earlier are end-of-life with no official fixes, which directly illustrates the NCSC's legacy-technology theme. Amazon Threat Intelligence observed first exploitation attempts on 17 October, four days before patches, from VPN/commercial anonymisation infrastructure and apparently multiple actors; details leaked on 20 October. VirusTotal counted about 5.1 million exposed PHP hosts (about 3.8 million with open ports). CISA added both CVEs to KEV on 26 October 2026 (federal due date 29 October). Dream reported a suspected China-nexus actor chaining PHP2Shell with the Linux kernel flaw 'Fragnesia' (CVE-2026-46300, XFRM ESP-in-TCP) against PAN-OS management servers: about 19,000 internet-facing PAN-OS devices scanned, 240 narrowed to PAN-OS 12.1/12.2 with PHP 8.0.30, 24-25 servers rooted across the US, Japan, Taiwan and South Korea, persistent webshells and reverse SSH tunnels, and a third US government-affiliated server giving central access to managed firewall configurations and potential Active Directory exposure. Dream did not attribute to a named actor; indicators cited include Chinese tooling (DeepSeek, Kimi, FOFA). Cyfirma separately reported suspected North Korea-linked scanning coordinated over I2P. These are secondary-source claims and the CVE identifiers could not be confirmed on a primary NVD/PHP page during this research.

Government announcements on 24 October 2026 include GBP 60m National Cyber Shield, GBP 70m NERV Centre, GBP 120m AI Security Institute, GBP 40m National Agentic Security Unit, GBP 25m Challenge Fund and GBP 24m public-sector defence, plus a 75% Cyber Essentials discount and 230+ Cyber Resilience Pledge signatories.

Defensive implications: retire end-of-life technology, patch internet-facing PHP immediately, enrol in NCSC Early Warning, apply the Cyber Assessment Framework and 10 Steps to Cyber Security, and rehearse ransomware recovery. No ransomware family, hashes or attacker IPs are named in the sources, so there are no network indicators to correlate in BeaconBeagle.

MITRE ATT&CK techniques by tactic:

Command and Control

T1090 Proxy; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Execution

T1203 Exploitation for Client Execution

Persistence

T1505 Server Software Component

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Remediation for NCSC AI ransomware warning

Patches

• PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 released 2026-10-21; source backports for older branches
• Update PHP to the latest fixed supported release as advised by NCSC

Immediate actions

• Enrol in the NCSC Early Warning service and act on notifications for internet-facing assets
• Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (PHP2Shell, CVE-2026-109618/109619) or take affected systems offline until patched
• Patch Palo Alto PAN-OS management interfaces and the Linux kernel (CVE-2026-46300) and hunt for webshells and reverse SSH tunnels
• Inventory end-of-life and legacy technology supporting critical services

Workarounds

• CVE-2026-109618: set memory_limit=-1, lower post_max_size, apply container limits (partial protection only)
• CVE-2026-109619: disable session.upload_progress and restart workers (partial protection only)
• Isolate and segment legacy systems that cannot be replaced from the internet and operational networks

Longer-term hardening

• Retire or replace end-of-life technology (including PHP 8.1 and earlier) and fund deferred upgrades
• Apply the NCSC Cyber Assessment Framework and 10 Steps to Cyber Security
• Build operational continuity and rapid-recovery capability for ransomware scenarios
• Implement the AI Cyber Security Code of Practice for AI systems and their dependencies

Affected and fixed versions

• Various — UK critical national infrastructure legacy and end-of-life technology
  Vulnerable versions: Outdated and end-of-life systems (no specific versions stated)
• PHP Group — PHP (PHP2Shell, cited example)
  Vulnerable versions: 8.2 before 8.2.35; 8.3 before 8.3.36; 8.4 before 8.4.27; 8.5 before 8.5.12; 8.1, 8.0, 7.x, 5.x (end-of-life, no official fix)
  Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12

Timeline of NCSC AI ransomware warning

• 2025-05-07 UK government announces the AI Cyber Security Code of Practice, which will inform a new ETSI global standard.
• 2025-05-07 NCSC publishes 'Impact of AI on cyber threat from now to 2027' at CYBERUK, assessing AI will highly likely increase the volume and impact of intrusions and create a digital divide between well-defended and vulnerable systems.
• 2026-06-17 NCSC CEO locked-ioc-9 reports 200+ incidents affecting UK CNI in the year to May 2026, about 75% linked to state actors (Russia, China, Iran), and warns of adversary pre-positioning; NCSC judges AI will highly likely be used to exploit known weaknesses in legacy CNI technology by 2028.
• 2026-10-17 Amazon Threat Intelligence observes first PHP2Shell exploitation attempts, four days before patches, from VPN/commercial anonymisation infrastructure and apparently multiple actors.
• 2026-10-20 PHP2Shell details (CVE identifiers and mitigation guidance) leak publicly ahead of the coordinated release.
• 2026-10-21 PHP releases fixes for CVE-2026-109618 and CVE-2026-109619 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier remain unpatched as end-of-life; NCSC urges organisations to update or take PHP systems offline.
• 2026-10-24 UK government announces cyber and AI security investments including GBP 60m National Cyber Shield, GBP 70m NERV Centre, GBP 120m AI Security Institute and GBP 40m National Agentic Security Unit.
• 2026-10-26 CISA adds CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of 29 October 2026.
• 2026-10-30 Reporting emerges of a suspected China-nexus actor chaining PHP2Shell with Linux kernel flaw Fragnesia (CVE-2026-46300) to root about 25 PAN-OS firewall and management servers, including US government-affiliated systems.
• 2026-11-03 At the NCSC Annual Review launch in London, locked-ioc-9 warns of AI-powered malware in ransomware attacks on UK CNI by 2028 and cites PHP2Shell, for which NCSC issued 110,000 proactive notifications and Early Warning alerts, as an example of exploitable weaknesses.

Sources cited for NCSC AI ransomware warning

• NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems NCSC (UK) · Advisory · 2026-06-17
• Impact of AI on cyber threat from now to 2027 NCSC (UK) · Advisory · 2025-05-07
• UK critical systems at increased risk from 'digital divide' created by AI threats NCSC (UK) · Advisory · 2025-05-07
• U.S. CISA adds PHP2Shell flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com · Government advisory · 2026-10-26
• PHP2Shell - what it is, how to detect, how to patch pentest-tools.com · Research · 2026-10-21
• NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure infosecurity-magazine.com · News · 2026-11-03
• UK Warns of AI-Based Attacks Against Critical Infrastructure bankinfosecurity.com · News · 2025-05-07
• Hostile States Behind 75% of Cyber-Attacks on UK Critical Infrastructure, NCSC Warns infosecurity-magazine.com · News
• PHP ships emergency patches for critical PHP2Shell flaws BleepingComputer · News · 2026-10-21
• Amazon says PHP2Shell exploitation began 4 days before patches BleepingComputer · News
• Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit infosecurity-magazine.com · News
• PHP2Shell vulnerabilities now under active exploitation computing.co.uk · News
• NCSC urges immediate action over critical PHP flaws allowing remote code execution localgovernmentlawyer.co.uk · News

More in ransomware

• Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak
• Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
• HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
• 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate
• Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)

Further reading

• Ransomware C2 Hosting Abuse: LockBit, BianLian
• ChromaDB, LiteLLM, PraisonAI, Langflow RCEs
• OpenClaw AI Agent Threat Landscape: 8 Attacks