# AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation

> Symantec's Dick O'Brien (IRISSCON 2026) argues that AI-assisted attackers now compress time-to-exploit to roughly one day and run post-compromise activity at machine speed. Two 2026 cases illustrate this: PHP2Shell (CVE-2026-109618/109619), exploited from 17 October 2026 during the embargo, and the September 2026 breach of the Dutch Institute for Vulnerability Disclosure (DIVD), attributed by DIVD to an agentic AI attack chaining Zammad zero-days CVE-2026-102489 and CVE-2026-102490.

- **Published:** 2026-11-12T12:12:27Z
- **Last reviewed:** 2026-11-12T12:12:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5857
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5857.png
- **ID:** TL-2026-5857
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-102489, CVE-2026-102490

## Description

This record consolidates a conference-talk thesis and the two incidents behind it. Dick O'Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 (Dublin, 11 November 2026) that organizations 'can't patch their way out of AI'. He said attackers use AI to find zero-days and chain low-severity flaws, and that defenders should measure mean time to mitigate instead of mean time to patch. He expects 'end-to-end agentic orchestration of attacks' within a year. The Zero Day Clock figures he cites (about one week in 2025, about one day in 2026, projected about one minute in 2027) are as reported by Infosecurity Magazine; the zerodayclock.com page we could fetch did not state those figures, so treat them as secondary.

PHP2Shell: two PHP core use-after-free flaws (CWE-416, CVSS 9.8 per F5), CVE-2026-109619 (global state keeps a reference into request-scoped memory that is not reset between requests) and CVE-2026-109618 (longjmp() on out-of-memory leaves request memory uninitialized and cleanup routines later read it). Triggering uses the session upload-progress feature via the PHP_SESSION_UPLOAD_PROGRESS field in a multipart/form-data POST. Amazon (MadPot honeypot) saw the first exploitation attempt on 17 October 2026, four days before the 21 October patches, from an IP on a commercial anonymization network. Details leaked on 20 October and the PHP team accelerated the release. Patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare, watchTowr, Hadrian, Patchstack and Previdian logged unsuccessful pre-disclosure attempts. Most public PoCs did not achieve RCE; Wiz found the memory-exhaustion stage worked but the heap-leak stage failed in every captured run. Adel Karimi documented confirmed RCE on single-worker Apache mod_php honeypots on 24 October, and CISA added PHP2Shell to KEV on 26 October (per Wiz). Wiz also documented an unrelated PHP2Shell-branded tool using session poisoning plus an LFI sink, and JFrog reported fake PoCs and prank malware on GitHub. The '19 minutes after disclosure' figure is cited by Symantec/Infosecurity; one secondary write-up attributes it to watchTowr observations (no activity at 11:26 UTC, attempts at 14:19), but we could not confirm it against watchTowr's own publication, and F5 saw scanning about five hours before the advisories. Exposure estimates range from about 1.57 million unpatched hosts (Censys) to over 2.6 million internet-facing PHP hosts (VulnCheck).

DIVD: on 21 September 2026 an attacker breached DIVD, a volunteer nonprofit. DIVD said the modus operandi, including volumes of scripts whose comments appeared to show agents reasoning, indicated an agentic AI-powered attack, while using hedged language. The entry point was later traced to chained Zammad flaws: CVE-2026-102489 (session hijack leading to code execution as the zammad user; Zammad 6.3.0-6.5.4) and CVE-2026-102490 (local privilege escalation to root; 1.5.0 through 7.1.0-alpha), tracked as DIVD-2026-00015. Root was reached within seconds of the hijack. The agent also ran password spraying that interfered with its own man-in-the-middle attempt. Exposed data includes volunteer email addresses and parts of the CSIRT ticketing system; DIVD's network segmentation limited lateral movement. Symantec's reading of DIVD's report: detection took 19 minutes, response began 19 hours later, and containment took a further 9 hours. It is not established whether the agent discovered the zero-days or only chained them (DIVD says it found the CVEs during its own investigation). Claims that this was the first fully autonomous AI attack are vendor commentary, not DIVD's conclusion. No actor or model has been named in any source.

Sources are mostly trade press and vendor blogs; the DIVD, Symantec, Amazon and PHP Foundation primary reports were not directly fetched, and the NVD and CVE records for these CVEs were not verified here.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1595.001 Active Scanning: Scanning IP Blocks
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1090.003 Proxy: Multi-hop Proxy
- T1110.003 Brute Force: Password Spraying
- T1557 Adversary-in-the-Middle

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PHP2Shell (CVE-2026-109618/109619) Session Upload-Progress Exploitation Attempt** (`TL-2026-5857-SPL-001`)

Behaviour-first Splunk search for PHP2Shell exploitation of the PHP use-after-free flaws CVE-2026-109618 and CVE-2026-109619 (T1190, TL-2026-5857). Fires on HTTP requests carrying the PHP_SESSION_UPLOAD_PROGRESS multipart trigger, the F5-published probe/exploit boundaries (php2shelld656557dacfa4fbc, B7kQpoc618) or the PHP2Shell exploit/scanner User-Agents, and rolls results up per source with target spread to separate mass scanning (T1595.002) from focused exploitation. Exploitation was observed 4 days before the 21 Oct 2026 patches and CISA added the CVE pair to KEV.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002, T1595.001
- **Data sources:** splunk:index=web sourcetype=stream:http, splunk:index=web sourcetype=access_combined
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype="stream:http" OR sourcetype="access_combined") earliest=-24h
| eval ua=coalesce(http_user_agent, useragent), src=coalesce(src_ip, clientip), tgt=coalesce(dest, host), body=coalesce(form_data, http_request_body, "")
| eval ua_hit=if(match(ua, "(?i)^(php2shell-(verify|109618|poc|scan|scanner)|php-upload-progress-scan)"), 1, 0)
| eval trigger_hit=if(match(body, "PHP_SESSION_UPLOAD_PROGRESS") OR match(body, "php2shelld656557dacfa4fbc") OR match(body, "B7kQpoc618"), 1, 0)
| where ua_hit=1 OR trigger_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen dc(tgt) as targets values(ua) as user_agents values(uri_path) as uris sum(trigger_hit) as trigger_requests by src
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| sort - count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestClientApplication matches regex @"(?i)^(php2shell-(verify|109618|poc|scan|scanner)|php-upload-progress-scan)"
    or Message has "PHP_SESSION_UPLOAD_PROGRESS"
    or AdditionalExtensions has "PHP_SESSION_UPLOAD_PROGRESS"
    or Message has "php2shelld656557dacfa4fbc"
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Targets = dcount(DestinationIP), UserAgents = make_set(RequestClientApplication, 10),
            Urls = make_set(RequestURL, 10) by SourceIP
| order by Hits desc
```

### Sigma

```yaml
title: PHP2Shell CVE-2026-109618/109619 Exploit and Scanner User-Agents
id: 3f1c9a52-7d0e-4b6a-9c41-5a8e2d7b1f60
status: experimental
description: Detects web requests whose User-Agent matches published PHP2Shell exploit, probe and scanner tooling targeting the PHP session upload-progress use-after-free flaws.
references:
    - https://f5.com/labs/articles/php2shell-exploitation-attempts-observed
    - https://www.wiz.io/pt-br/blog/php2shell-exploitation-so-far
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - attack.t1595.001
    - cve.2026.109618
    - cve.2026.109619
logsource:
    category: webserver
detection:
    selection_ua:
        cs-user-agent|startswith:
            - 'php2shell-verify/'
            - 'php2shell-109618'
            - 'php2shell-poc/'
            - 'php2shell-scan/'
            - 'php2shell-scanner/'
            - 'php-upload-progress-scan/'
    condition: selection_ua
falsepositives:
    - Authorized vulnerability scanners or red-team exercises reusing the public PHP2Shell tooling
    - Internal exposure-validation jobs run after the PHP patch rollout
level: high

```

**Known false positives:**

- Authorized vulnerability scanners or red-team exercises using the public PHP2Shell tooling
- Legitimate large multipart uploads that use session.upload_progress (field present in body but no exploit pattern or tool User-Agent)

**Tuning notes:** Body capture requires stream:http (Splunk Stream) or a WAF/ModSecurity feed mapped to form_data; with plain access_combined only the User-Agent branch can fire, so also deploy the WAF rule blocking PHP_SESSION_UPLOAD_PROGRESS. Allowlist internal scanner IPs, raise the targets threshold to prioritise mass scanners, and adjust index/sourcetype names to your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PHP2Shell Exploitation Attempt via WAF/CEF Telemetry (CVE-2026-109618/109619) (locked: unlock with TL Creds)
- Web/Rails Process Spawning Shell and Zammad-to-Root Escalation (MDE for Linux) (locked: unlock with TL Creds)
- Endpoint Connection to PHP2Shell Payload Server and Related Infrastructure (locked: unlock with TL Creds)
- PHP2Shell CVE-2026-109618/109619 Exploit and Scanner User-Agents (locked: unlock with TL Creds)
- Web or Rails Application Process Spawning Shell or Download Tool on Linux (locked: unlock with TL Creds)
- Connection to PHP2Shell Payload Server or Community-Observed PHP2Shell Infrastructure (locked: unlock with TL Creds)
- Zammad/PHP Application Process Spawning Shell or Root Process (CVE-2026-102489/102490, PHP2Shell) (locked: unlock with TL Creds)
- PHP2Shell Payload Server and Exploit-Source Infrastructure Communication (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- IP address: `85.11.187[.]35`
- IP address: `3.37.227[.]134`
- IP address: `31.56.197[.]72`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Security Teams Must Shift from Patching to Mitigation in the AI Era (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/shift-patching-mitigation-ai-era/)
- [Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer)](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/)
- [PHP2Shell: Exploitation Attempts and Remediation Trends (Wiz)](https://www.wiz.io/pt-br/blog/php2shell-exploitation-so-far)
- [PHP2Shell exploitation attempts observed (F5 Labs)](https://f5.com/labs/articles/php2shell-exploitation-attempts-observed)
- [PHP2Shell Exploitation Started Days Before Patches (SecurityWeek)](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/)
- [DIVD-2026-00015: Zammad Vulnerabilities](https://csirt.divd.nl/cases/DIVD-2026-00015/)
- [AI Agent Exploits Zammad Zero-Days in DIVD Breach (Sysdig)](https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it)
- [Zammad Zero-Day Chain: An AI Agent Breaches DIVD (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-agentic-zero-day-chain-zammad-20261003-csa/)
- [Zero Day Clock](https://zerodayclock.com/)
- [PHP2Shell honeypot data (Adel Karimi)](https://github.com/0x4D31/honeypot-data)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5857