AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5857 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PHP2Shell (CVE-2026-109618/109619) Session Upload-Progress Exploitation Attempt

Behaviour-first Splunk search for PHP2Shell exploitation of the PHP use-after-free flaws CVE-2026-109618 and CVE-2026-109619 (T1190, TL-2026-5857). Fires on HTTP requests carrying the PHP_SESSION_UPLOAD_PROGRESS multipart trigger, the F5-published probe/exploit boundaries (php2shelld656557dacfa4fbc, B7kQpoc618) or the PHP2Shell exploit/scanner User-Agents, and rolls results up per source with target spread to separate mass scanning (T1595.002) from focused exploitation. Exploitation was observed 4 days before the 21 Oct 2026 patches and CISA added the CVE pair to KEV.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002, T1595.001
• Data sources: splunk:index=web sourcetype=stream:http, splunk:index=web sourcetype=access_combined
• Severity: high
• Confidence: high

Splunk SPL

index=web (sourcetype="stream:http" OR sourcetype="access_combined") earliest=-24h
| eval ua=coalesce(http_user_agent, useragent), src=coalesce(src_ip, clientip), tgt=coalesce(dest, host), body=coalesce(form_data, http_request_body, "")
| eval ua_hit=if(match(ua, "(?i)^(php2shell-(verify|109618|poc|scan|scanner)|php-upload-progress-scan)"), 1, 0)
| eval trigger_hit=if(match(body, "PHP_SESSION_UPLOAD_PROGRESS") OR match(body, "php2shelld656557dacfa4fbc") OR match(body, "B7kQpoc618"), 1, 0)
| where ua_hit=1 OR trigger_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen dc(tgt) as targets values(ua) as user_agents values(uri_path) as uris sum(trigger_hit) as trigger_requests by src
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| sort - count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestClientApplication matches regex @"(?i)^(php2shell-(verify|109618|poc|scan|scanner)|php-upload-progress-scan)"
    or Message has "PHP_SESSION_UPLOAD_PROGRESS"
    or AdditionalExtensions has "PHP_SESSION_UPLOAD_PROGRESS"
    or Message has "php2shelld656557dacfa4fbc"
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Targets = dcount(DestinationIP), UserAgents = make_set(RequestClientApplication, 10),
            Urls = make_set(RequestURL, 10) by SourceIP
| order by Hits desc

Sigma

title: PHP2Shell CVE-2026-109618/109619 Exploit and Scanner User-Agents
id: 3f1c9a52-7d0e-4b6a-9c41-5a8e2d7b1f60
status: experimental
description: Detects web requests whose User-Agent matches published PHP2Shell exploit, probe and scanner tooling targeting the PHP session upload-progress use-after-free flaws.
references:
    - https://f5.com/labs/articles/php2shell-exploitation-attempts-observed
    - https://www.wiz.io/pt-br/blog/php2shell-exploitation-so-far
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - attack.t1595.001
    - cve.2026.109618
    - cve.2026.109619
logsource:
    category: webserver
detection:
    selection_ua:
        cs-user-agent|startswith:
            - 'php2shell-verify/'
            - 'php2shell-109618'
            - 'php2shell-poc/'
            - 'php2shell-scan/'
            - 'php2shell-scanner/'
            - 'php-upload-progress-scan/'
    condition: selection_ua
falsepositives:
    - Authorized vulnerability scanners or red-team exercises reusing the public PHP2Shell tooling
    - Internal exposure-validation jobs run after the PHP patch rollout
level: high

Known false positives:

• Authorized vulnerability scanners or red-team exercises using the public PHP2Shell tooling
• Legitimate large multipart uploads that use session.upload_progress (field present in body but no exploit pattern or tool User-Agent)

Tuning notes: Body capture requires stream:http (Splunk Stream) or a WAF/ModSecurity feed mapped to form_data; with plain access_combined only the User-Agent branch can fire, so also deploy the WAF rule blocking PHP_SESSION_UPLOAD_PROGRESS. Allowlist internal scanner IPs, raise the targets threshold to prioritise mass scanners, and adjust index/sourcetype names to your environment.

• 🔒 PHP2Shell Exploitation Attempt via WAF/CEF Telemetry (CVE-2026-109618/109619) · unlock with TL Creds
• 🔒 Web/Rails Process Spawning Shell and Zammad-to-Root Escalation (MDE for Linux) · unlock with TL Creds
• 🔒 Endpoint Connection to PHP2Shell Payload Server and Related Infrastructure · unlock with TL Creds
• 🔒 PHP2Shell CVE-2026-109618/109619 Exploit and Scanner User-Agents · unlock with TL Creds
• 🔒 Web or Rails Application Process Spawning Shell or Download Tool on Linux · unlock with TL Creds
• 🔒 Connection to PHP2Shell Payload Server or Community-Observed PHP2Shell Infrastructure · unlock with TL Creds
• 🔒 Zammad/PHP Application Process Spawning Shell or Root Process (CVE-2026-102489/102490, PHP2Shell) · unlock with TL Creds
• 🔒 PHP2Shell Payload Server and Exploit-Source Infrastructure Communication · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5857.

Sample indicators (3 of 13)

• IP address: 85.11.187[.]35
• IP address: 3.37.227[.]134
• IP address: 31.56.197[.]72

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

This record consolidates a conference-talk thesis and the two incidents behind it. Dick O'Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 (Dublin, 11 November 2026) that organizations 'can't patch their way out of AI'. He said attackers use AI to find zero-days and chain low-severity flaws, and that defenders should measure mean time to mitigate instead of mean time to patch. He expects 'end-to-end agentic orchestration of attacks' within a year. The Zero Day Clock figures he cites (about one week in 2025, about one day in 2026, projected about one minute in 2027) are as reported by Infosecurity Magazine; the zerodayclock.com page we could fetch did not state those figures, so treat them as secondary.

PHP2Shell: two PHP core use-after-free flaws (CWE-416, CVSS 9.8 per F5), CVE-2026-109619 (global state keeps a reference into request-scoped memory that is not reset between requests) and CVE-2026-109618 (longjmp() on out-of-memory leaves request memory uninitialized and cleanup routines later read it). Triggering uses the session upload-progress feature via the PHP_SESSION_UPLOAD_PROGRESS field in a multipart/form-data POST. Amazon (MadPot honeypot) saw the first exploitation attempt on 17 October 2026, four days before the 21 October patches, from an IP on a commercial anonymization network. Details leaked on 20 October and the PHP team accelerated the release. Patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare, watchTowr, Hadrian, Patchstack and Previdian logged unsuccessful pre-disclosure attempts. Most public PoCs did not achieve RCE; Wiz found the memory-exhaustion stage worked but the heap-leak stage failed in every captured run. Adel Karimi documented confirmed RCE on single-worker Apache mod_php honeypots on 24 October, and CISA added PHP2Shell to KEV on 26 October (per Wiz). Wiz also documented an unrelated PHP2Shell-branded tool using session poisoning plus an LFI sink, and JFrog reported fake PoCs and prank malware on GitHub. The '19 minutes after disclosure' figure is cited by Symantec/Infosecurity; one secondary write-up attributes it to watchTowr observations (no activity at 11:26 UTC, attempts at 14:19), but we could not confirm it against watchTowr's own publication, and F5 saw scanning about five hours before the advisories. Exposure estimates range from about 1.57 million unpatched hosts (Censys) to over 2.6 million internet-facing PHP hosts (VulnCheck).

DIVD: on 21 September 2026 an attacker breached DIVD, a volunteer nonprofit. DIVD said the modus operandi, including volumes of scripts whose comments appeared to show agents reasoning, indicated an agentic AI-powered attack, while using hedged language. The entry point was later traced to chained Zammad flaws: CVE-2026-102489 (session hijack leading to code execution as the zammad user; Zammad 6.3.0-6.5.4) and CVE-2026-102490 (local privilege escalation to root; 1.5.0 through 7.1.0-alpha), tracked as DIVD-2026-00015. Root was reached within seconds of the hijack. The agent also ran password spraying that interfered with its own man-in-the-middle attempt. Exposed data includes volunteer email addresses and parts of the CSIRT ticketing system; DIVD's network segmentation limited lateral movement. Symantec's reading of DIVD's report: detection took 19 minutes, response began 19 hours later, and containment took a further 9 hours. It is not established whether the agent discovered the zero-days or only chained them (DIVD says it found the CVEs during its own investigation). Claims that this was the first fully autonomous AI attack are vendor commentary, not DIVD's conclusion. No actor or model has been named in any source.

Sources are mostly trade press and vendor blogs; the DIVD, Symantec, Amazon and PHP Foundation primary reports were not directly fetched, and the NVD and CVE records for these CVEs were not verified here.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1090.003 Proxy: Multi-hop Proxy

Credential Access

T1110.003 Brute Force: Password Spraying; T1557 Adversary-in-the-Middle

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

lateral-movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595.001 Active Scanning: Scanning IP Blocks; T1595.002 Active Scanning: Vulnerability Scanning

Remediation

Patches

• PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (CVE-2026-109618/109619); backports for older branches vary
• Zammad 7.x/7.2.0 for CVE-2026-102489; no fix for CVE-2026-102490 as of 5 October 2026 per Sysdig

Immediate actions

• Patch internet-facing PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or take unpatched PHP servers offline (UK NCSC guidance)
• If patching is not immediately possible, disable session.upload_progress and use WAF rules to block multipart requests carrying PHP_SESSION_UPLOAD_PROGRESS
• Upgrade Zammad to 7.2.0 or later, or take the instance offline; run DIVD's CVE-2026-102489 IoC check script against Zammad logs
• Preserve /var/log/zammad and /var/log/nginx before rebuilding; treat any exploitation as full compromise and rotate all credentials reachable from the host
• Enable behavior blocking and default-deny for what can execute

Workarounds

• Disable PHP upload-progress tracking
• Rate-limit high-frequency empty multipart file uploads
• Restrict server access to trusted administrators while CVE-2026-102490 is unfixed

Longer-term hardening

• Track mean time to mitigate instead of mean time to patch
• Apply least privilege to every AI agent and token and bind each agent action to a named human
• Inspect data before it leaves the device and enforce default-deny egress on helpdesk segments
• Segment high-value systems (DIVD's segmentation limited lateral movement)
• Pre-authorize automated containment for high-fidelity alerts
• Deploy detection across multiple control points to spot rogue or malicious AI-agent behavior

Affected and fixed versions

• PHP Group — PHP
  Vulnerable versions: Unpatched 8.2-8.5 releases and end-of-life branches (exact ranges not published in sources read)
  Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35
• Zammad — Zammad helpdesk
  Vulnerable versions: 6.3.0-6.5.4 (CVE-2026-102489 RCE); 1.5.0 through 7.1.0-alpha (CVE-2026-102490 LPE)
  Fixed in: 7.2.0 hardens the affected code for CVE-2026-102489; no CVE-2026-102490 fix as of 2026-10-05

Timeline

• 2026-09-21 Attacker gains access to DIVD systems by chaining Zammad zero-days CVE-2026-102489 and CVE-2026-102490.
• 2026-09-22 DIVD detects the intrusion, cuts off access to all data center systems and engages Merlon Security; reproduction of the flaws follows on 22-23 September.
• 2026-09-24 DIVD reports the breach to the Dutch data protection authority and NCSC, announces it publicly, and notifies Zammad, saying the modus operandi indicates an agentic AI attack.
• 2026-09-29 DIVD publishes case files and CVE records for the Zammad vulnerabilities (DIVD-2026-00015).
• 2026-10-01 DIVD confirms data exfiltration, including volunteer email addresses and parts of the CSIRT ticketing system.
• 2026-10-17 Amazon MadPot sees the first PHP2Shell exploitation attempt, four days before patches, from an IP on a commercial anonymization network.
• 2026-10-20 PHP2Shell details, including CVE IDs, leak online; the PHP security team accelerates its release.
• 2026-10-21 PHP patches CVE-2026-109618 and CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36, 8.2.35); CISA alert issued; mass scanning and exploitation attempts follow, with first exploitation attempts reported minutes after disclosure per Symantec.
• 2026-10-24 Adel Karimi publishes confirmed RCE against single-worker Apache mod_php honeypots.
• 2026-10-26 CISA adds PHP2Shell to the Known Exploited Vulnerabilities catalog (per Wiz).
• 2026-11-11 Symantec's Dick O'Brien presents at IRISSCON 2026 on AI-accelerated exploitation and the shift from patching to mitigation; reported by Infosecurity Magazine on 12 November.

Sources cited

• DIVD-2026-00015: Zammad Vulnerabilities csirt.divd.nl · Advisory · 2026-10-01
• PHP2Shell: Exploitation Attempts and Remediation Trends (Wiz) Wiz · Vendor report · 2026-10-26
• PHP2Shell exploitation attempts observed (F5 Labs) f5.com · Vendor report
• AI Agent Exploits Zammad Zero-Days in DIVD Breach (Sysdig) sysdig.com · Vendor report · 2026-10-05
• Zammad Zero-Day Chain: An AI Agent Breaches DIVD (Cloud Security Alliance) labs.cloudsecurityalliance.org · Research · 2026-10-03
• Zero Day Clock zerodayclock.com · Research
• PHP2Shell honeypot data (Adel Karimi) GitHub · Code repository · 2026-10-24
• Security Teams Must Shift from Patching to Mitigation in the AI Era (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-11-12
• Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer) BleepingComputer · News
• PHP2Shell Exploitation Started Days Before Patches (SecurityWeek) SecurityWeek · News · 2026-10-22

More in threat intel

• ARTEX open-source AI pentesting framework weaponized by China-aligned and criminal actors (Storm-0940, VAPOR PANDA, Storm-3358, Crafty Falcon); leaked secrets are the primary entry vector; backdoored Docker images
• Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)
• ARTEX open-source AI autonomous pentest framework abused by threat actors; 1,465 exposed consoles per Censys
• AI-Agent-Driven Intrusion Campaign Against Asian Government Systems (reported as Taiwan-targeted): Multi-Agent Password Spraying, SSO Pivoting and JWT 'none' Forgery
• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)

Other reports on CVE-2026-109618

• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released
• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
• ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning
• Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls

Other reports on CVE-2026-109619

• Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)
• Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise
• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
• PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777
• PHP HTTP2Shell: Critical Brotli Out-of-Bounds Write Reachable via cURL (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619)
• Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets Admin-Level Attackers Execute System Commands

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors