# NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)

> On 3 November 2026 NCSC CEO Richard Horne warned of a real prospect of an unprecedented rise in cyber incidents, with AI-powered malware expected in ransomware attacks on UK critical national infrastructure by 2028. Nation states including Russia and China are expected to routinely use AI in cyber operations, and outdated or end-of-life technology is cited as a root cause of exposure; PHP2Shell (actively exploited, CISA KEV) is the cited example.

- **Published:** 2026-11-03T12:17:58Z
- **Last reviewed:** 2026-11-03T12:17:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5150
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5150.png
- **ID:** TL-2026-5150
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-46300

## Description

This is a strategic, forward-looking assessment from the UK National Cyber Security Centre (NCSC), not a report of a specific malware family or campaign. Speaking at the launch of the NCSC Annual Review in London on 3 November 2026, NCSC CEO Richard Horne warned that AI-powered malware is strongly expected in ransomware attacks on UK critical national infrastructure (power stations, airports, hospitals) by 2028, and that nation states such as Russia and China are expected to routinely incorporate AI into cyber activity in pursuit of geopolitical objectives. Horne stated that vulnerabilities tolerated for far too long can now be discovered and exploited at a scale once unimaginable, and criticised end-of-life systems kept running 'for just one more year' and upgrades deferred as a 'cost efficiency'.

The warning builds on earlier NCSC statements. The NCSC assessment 'Impact of AI on cyber threat from now to 2027' (7 May 2025, CYBERUK) judged AI will almost certainly enhance threat actors' ability to exploit known vulnerabilities, shortening the window between disclosure and exploitation; that AI is already used for victim reconnaissance and social engineering; that AI-enabled tools will highly likely widen access for state and non-state actors; that advanced actors may use AI for zero-day discovery; and that a 'digital divide' will emerge between well-defended systems and a large, more vulnerable remainder. Fully autonomous end-to-end attacks were assessed as unlikely to 2027. That report does not address ransomware as a distinct category. On 17 June 2026 the NCSC reported 200+ incidents affecting UK CNI in the year to May 2026, about 75% linked to state actors (Russia, China and Iran named), and judged it highly likely that by 2028 AI tools will be used to exploit known weaknesses in ageing CNI technology.

The 3 November coverage cites 'PHP2Shell' as the best recent example of exploitable weaknesses; NCSC issued 110,000 proactive notifications and Early Warning alerts. Secondary reporting (BleepingComputer, Pentest-Tools, Security Affairs, Infosecurity Magazine) identifies PHP2Shell as two PHP core flaws: CVE-2026-109618 (out-of-memory request-memory corruption leading to RCE) and CVE-2026-109619 (stale internal request-state / heap use-after-free reachable via INI diagnostics and the session upload-progress handler), vendor CVSS 9.2 (v4.0), 9.8 per Pentest-Tools (v3.1). The flaws trace back to PHP 5.4 (2012) and are highest risk for mod_php, where an unauthenticated request can trigger the bug before application code runs. PHP shipped fixes on 21 October 2026 (8.5.12, 8.4.27, 8.3.36, 8.2.35); branches 8.1 and earlier are end-of-life with no official fixes, which directly illustrates the NCSC's legacy-technology theme. Amazon Threat Intelligence observed first exploitation attempts on 17 October, four days before patches, from VPN/commercial anonymisation infrastructure and apparently multiple actors; details leaked on 20 October. VirusTotal counted about 5.1 million exposed PHP hosts (about 3.8 million with open ports). CISA added both CVEs to KEV on 26 October 2026 (federal due date 29 October). Dream reported a suspected China-nexus actor chaining PHP2Shell with the Linux kernel flaw 'Fragnesia' (CVE-2026-46300, XFRM ESP-in-TCP) against PAN-OS management servers: about 19,000 internet-facing PAN-OS devices scanned, 240 narrowed to PAN-OS 12.1/12.2 with PHP 8.0.30, 24-25 servers rooted across the US, Japan, Taiwan and South Korea, persistent webshells and reverse SSH tunnels, and a third US government-affiliated server giving central access to managed firewall configurations and potential Active Directory exposure. Dream did not attribute to a named actor; indicators cited include Chinese tooling (DeepSeek, Kimi, FOFA). Cyfirma separately reported suspected North Korea-linked scanning coordinated over I2P. These are secondary-source claims and the CVE identifiers could not be confirmed on a primary NVD/PHP page during this research.

Government announcements on 24 October 2026 include GBP 60m National Cyber Shield, GBP 70m NERV Centre, GBP 120m AI Security Institute, GBP 40m National Agentic Security Unit, GBP 25m Challenge Fund and GBP 24m public-sector defence, plus a 75% Cyber Essentials discount and 230+ Cyber Resilience Pledge signatories.

Defensive implications: retire end-of-life technology, patch internet-facing PHP immediately, enrol in NCSC Early Warning, apply the Cyber Assessment Framework and 10 Steps to Cyber Security, and rehearse ransomware recovery. No ransomware family, hashes or attacker IPs are named in the sources, so there are no network indicators to correlate in BeaconBeagle.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1572 Protocol Tunneling
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Splunk SPL, Post-Exploitation)** (`TL-2026-5150-SPL-002`)

Detects web server or PHP worker processes spawning shells, scripting runtimes or download tools, PHP files written into web roots by worker processes, and a root-owned child (ran_as_root) that may indicate chained Fragnesia (CVE-2026-46300) privilege escalation. Reflects root webshell persistence reported on PAN-OS management servers after PHP2Shell exploitation (TL-2026-5150). SPL and KQL variants also match three community-related sample SHA256 hashes (low confidence).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1059.004, T1068
- **Data sources:** sysmon_for_linux, microsoft_defender_for_endpoint_linux, auditd
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

````spl
index=linux sourcetype="sysmon:linux" EventID=1 earliest=-24h
```Web server or PHP worker spawning a shell or download tool indicates a webshell or PHP2Shell RCE; root children suggest chained kernel privilege escalation (Fragnesia CVE-2026-46300); hash leg covers community-sourced sample hashes (low confidence)```
| eval parent_base=mvindex(split(ParentImage,"/"),-1), child_base=mvindex(split(Image,"/"),-1)
| eval web_to_shell=if(match(parent_base,"^(httpd|apache2|php-fpm[0-9.]*|php-cgi|php|nginx|lighttpd)$") AND match(child_base,"^(sh|bash|dash|busybox|nc|ncat|curl|wget|python3?|perl|ssh)$"),1,0)
| eval hash_hit=if(match(_raw,"590942bc868e9ee89884bb183de4b4c49dbf96d51578a4936d1fa88f422d3b1f|917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c|a75ff95e30207fd4cfc325be1b10a7e2a775fe0b061a151a2072eaf0070d041d"),1,0)
| eval ran_as_root=if(User="root",1,0)
| where web_to_shell=1 OR hash_hit=1
| stats count min(_time) AS first_seen max(_time) AS last_seen max(ran_as_root) AS ran_as_root max(hash_hit) AS hash_hit values(CommandLine) AS commands BY host parent_base child_base
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let WebProcs = dynamic(["httpd", "apache2", "php-fpm", "php-cgi", "php", "nginx", "lighttpd"]);
let ShellSpawn = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (WebProcs) or InitiatingProcessFileName startswith "php-fpm"
| where FileName in~ ("sh", "bash", "dash", "busybox", "nc", "ncat", "curl", "wget", "python3", "perl", "ssh")
| project Timestamp, DeviceName, AccountName, Detection = "web_worker_child_process", Artifact = FileName, Detail = ProcessCommandLine, ParentProcess = InitiatingProcessFileName;
let WebshellDrop = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where InitiatingProcessFileName in~ (WebProcs) or InitiatingProcessFileName startswith "php-fpm"
| where FolderPath has_any ("/var/www", "/usr/share/nginx", "/srv/www", "/opt/lampp/htdocs") and FileName endswith ".php"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Detection = "php_file_written_by_web_worker", Artifact = FolderPath, Detail = FileName, ParentProcess = InitiatingProcessFileName;
let HashHit = DeviceFileEvents
| where Timestamp > ago(24h)
| where SHA256 in~ ("590942bc868e9ee89884bb183de4b4c49dbf96d51578a4936d1fa88f422d3b1f", "917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c", "a75ff95e30207fd4cfc325be1b10a7e2a775fe0b061a151a2072eaf0070d041d")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Detection = "community_hash_match", Artifact = FolderPath, Detail = SHA256, ParentProcess = InitiatingProcessFileName;
union ShellSpawn, WebshellDrop, HashHit
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server or PHP Worker Spawning Shell or Download Tool (PHP2Shell Post-Exploitation)
id: 51500b01-7c3e-4d2a-9b10-000000000001
status: experimental
description: Detects a web server or PHP worker process (httpd, apache2, php-fpm, nginx) spawning a shell, scripting runtime, netcat or download utility on Linux. This is the typical post-exploitation pattern after PHP2Shell RCE (CVE-2026-109618/109619) and for webshells such as those reported on PAN-OS management servers in TL-2026-5150. A root-owned child process may indicate chained privilege escalation via Fragnesia (CVE-2026-46300).
references:
  - https://pentest-tools.com/research/php2shell-rce
  - https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
  - https://securityaffairs.com/?p=201840
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.004
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026-109618
  - cve.2026-109619
  - cve.2026-46300
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/lighttpd'
      - '/php-cgi'
      - '/php-fpm'
      - '/php-fpm8'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/busybox'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that legitimately shell out (backup, image conversion, deployment hooks)
  - Admin maintenance scripts launched through a web control panel
level: high

```

**Known false positives:**

- Web applications that legitimately shell out for backups, image conversion or deployments
- CMS plugin installers that write PHP files to the web root
- Admin maintenance scripts launched via web control panels

**Tuning notes:** Baseline legitimate parent-child pairs per host and exclude them by CommandLine. Alert at higher severity when the child runs as root or from a world-writable path. Update the file-write path list for your web roots. Treat the community hash and IP matches as corroboration only and review them periodically.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Sentinel KQL, Exploitation) (locked: unlock with TL Creds)
- Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Sentinel KQL, Post-Exploitation) (locked: unlock with TL Creds)
- Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Sentinel KQL, C2 / Lateral Movement) (locked: unlock with TL Creds)
- PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Sigma, Exploitation) (locked: unlock with TL Creds)
- Web Worker Spawning Shell or Webshell Drop After PHP2Shell RCE (Sigma, Post-Exploitation) (locked: unlock with TL Creds)
- Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Sigma, C2 / Lateral Movement) (locked: unlock with TL Creds)
- PHP2Shell (CVE-2026-109618/109619) Exploitation Crash Pattern (Splunk SPL, Exploitation) (locked: unlock with TL Creds)
- Persistent Reverse SSH Tunnel and Community Watchlist C2 Contact (Splunk SPL, C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure](https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/)
- [NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems](https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks)
- [Impact of AI on cyber threat from now to 2027](https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027)
- [UK critical systems at increased risk from 'digital divide' created by AI threats](https://www.ncsc.gov.uk/news/ai-to-2027-threat-assessment)
- [UK Warns of AI-Based Attacks Against Critical Infrastructure](https://www.bankinfosecurity.com/uk-warns-ai-based-attacks-against-critical-infrastructure-a-28341)
- [Hostile States Behind 75% of Cyber-Attacks on UK Critical Infrastructure, NCSC Warns](https://infosecurity-magazine.com/news/hostile-states-cni-75-percent-ncsc)
- [PHP ships emergency patches for critical PHP2Shell flaws](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [PHP2Shell - what it is, how to detect, how to patch](https://pentest-tools.com/research/php2shell-rce)
- [Amazon says PHP2Shell exploitation began 4 days before patches](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/amp/)
- [U.S. CISA adds PHP2Shell flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/?p=201840)
- [Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit](https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/)
- [PHP2Shell vulnerabilities now under active exploitation](https://www.computing.co.uk/news/2026/security/php2shell-under-active-exploitation)
- [NCSC urges immediate action over critical PHP flaws allowing remote code execution](https://www.localgovernmentlawyer.co.uk/information-law/398-information-law-news/102043-ncsc-urges-immediate-action-over-critical-php-flaws-allowing-remote-code-execution)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5150