From Initial Foothold to Active Directory in 120 Minutes: Inside the Agentic AI Exploitation of PHP2Shell

The 120-Minute Breach: How Machine-Parseable Shells Powered an Autonomous Infiltration

When security teams calculate incident response timelines, dwell time is traditionally measured in days or weeks. Threat actors gain a shell, manually catalog the file system, pull down tools, and take periodic breaks while deciding which internal host to attack next. That operating model just collapsed.

A European government organization fell victim to an intrusion chain that bypassed the standard human decision cycle entirely. Attackers exploited twin remote code execution vulnerabilities in default PHP setups—tracked as CVE-2026-109618 and CVE-2026-109619, known collectively as PHP2Shell. Within 120 minutes of sending their first weaponized HTTP packet, the operators had dumped password hashes, stolen multi-factor authentication (MFA) secrets, established an NT LAN Manager (NTLM) relay tunnel straight into the corporate Active Directory, and attempted Domain Admin privilege escalation.

Forensic investigators discovered that the intrusion was guided by an autonomous agentic loop. Rather than waiting for human operators to review terminal output, the injected scripts automatically wrapped command batches in custom string delimiters, such as ==SHELLUSER== and ==PASSWD==.

These tags converted raw terminal noise into clean, machine-parseable data. An automated agent ingested the structured blocks, decided the next logical reconnaissance steps, and immediately executed them without waiting for human confirmation. The system targeted authentication databases, issued anonymous LDAP queries to locate the primary domain controller, and systematically mapped internal network boundaries.

At the same time, threat telemetry revealed that state-backed groups—specifically operators linked to the Lazarus Group ecosystem operating through closed I2P networks—launched coordinated, low-volume reconnaissance campaigns against 216 unpatched enterprise hosts. These targets span aviation networks, government hubs, logistics engines, and payment gateways across 12 countries, including the United States, Japan, South Korea, and the European Union.

216 Enterprise Targets and Millions of Scans: Profiling the PHP2Shell Attack Surface

Widespread deployment makes PHP an attractive target for automated exploitation. The PHP2Shell vulnerabilities do not rely on esoteric, third-party libraries; they exploit how default PHP builds handle session upload progress and allocate memory when parsing incoming multi-part form data.

To bypass network rate limits, state-sponsored attackers deployed a distributed array of 21 compromised scanner nodes. Each node sent low-frequency requests, immediately rotating or disconnecting the moment an endpoint applied HTTP 429 throttling or temporary firewall blocks. As a result, static rate-limiting rules never triggered.

The underlying technical mechanics exploit memory limits set within default configurations. Attackers engineer a web request that looks standard to edge proxies, but craft form-field names that force repeated allocations. When PHP copies the field name into an internal hash table, it trips over its own memory_limit threshold.

Operational Metric	Standard Web Application Attack	PHP2Shell Agentic Intrusion	Defending Infrastructure Impact
Initial Attack Vector	SQLi / Deserialization	PHP_SESSION_UPLOAD_PROGRESS Heap Flaw	Unauthenticated default PHP core engine
Exploitation Target	Application logic code	Hash-table allocation in zend_hash	Memory corruption causing Apache worker crashes
Reconnaissance Style	High-volume port/directory fuzzing	Low-and-slow distributed scanning (21 nodes)	Perimeter WAF threshold alerts fail to flag traffic
Post-Exploitation Execution	Manual human operator terminal sessions	Agentic loop with machine-tagged delimiters	Lateral pivot completed within 120 minutes
Target Filter Strategy	Broad opportunistic scanning	Hand-selected enterprise tier (216 entities)	Focus on banks, aviation, and government Active Directory
Host Artifacts	Installed web shells (.php files on disk)	In-memory heap corruption, HTTP 500 error logs	Ephemeral execution; minimal permanent disk footprint

The operational risk escalates because attackers need no pre-existing valid user accounts. Anyone capable of sending an unauthenticated HTTP POST request to a server running default PHP configurations can initiate heap corruption.

While public scanners leave recognizable signatures—such as the p2s-rider session marker observed on honeypots originating from known exploit relays like 204.76.203[.]7—targeted attackers strip these indicators. They modify request headers to evade simple string-matching rules at the network perimeter.

The Triple Shock to Enterprise Defense: Automation, Heap Corruption, and Credential Harvest

Organizations running exposed PHP runtimes face immediate operational friction across their incident response budgets, system uptime, and internal identity architectures.

Exploding Incident Response OPEX: The Collapse of the Dwell-Time Window

Security Operations Centers (SOCs) rely on human triage workflows. A tier-1 analyst typically has between 12 and 24 hours to review high-priority alerts before an attacker moves from an initial web foothold to internal network segments. When threat actors deploy autonomous AI agents, that response window vanishes.

Because the agent digests command output using machine-parseable tags, it initiates lateral credential dumping within minutes of the initial breach. For a mid-sized enterprise, an uncontained intrusion that reaches Active Directory triggers forensic retainers, regulatory incident notifications, and emergency identity resets that quickly average between $250,000 and $1,200,000 in direct remediation expenses.

Crash Loops and Server Downtime: How Heap Corruption Destabilizes Apache Workers

The mechanics of CVE-2026-109618 require precise request sizing. To trigger the vulnerability, an attacker must force an allocation failure at the exact moment PHP attempts to copy a parameter key into a hash table. They must bypass Address Space Layout Randomization (ASLR) to locate usable memory segments.

Failed attempts do not fail silently. They exhaust the process memory limit, corrupt the heap, and crash the underlying web server child process. When weaponized against high-traffic portals, exploitation attempts trigger continuous crash loops across Apache and PHP-FPM workers.

Web services report sudden surges in HTTP 500 internal server errors, while legitimate user transactions fail midway through execution.

Lateral Movement Velocity: Bypassing Perimeter Defenses to Compromise Active Directory

Perimeter web servers frequently reside in isolated DMZs, but application architectures routinely permit them to query internal Lightweight Directory Access Protocol (LDAP) servers or internal databases. The European government breach revealed how quickly an agent exploits these pathways.

Rather than deploying noisy port scanners, the script issued anonymous, curl-based LDAP requests directly to the internal Domain Controller. After locating administrative account names, it established an NTLM relay tunnel.

By relaying authentication requests through the compromised web server, the attacker bridged the DMZ and core Active Directory services, bypassing network segmentation policies without ever writing a binary file to the host storage system.

Engineering Resilience: Memory Limits, Worker Monitoring, and Log Signatures

Remediating PHP2Shell requires infrastructure teams to address both the underlying memory flaw and the subtle log signatures generated during failed exploit attempts.

Controlled lab testing confirms that an active exploit leaves a distinct trail across server logs. Defenders should query their observability tools—such as Datadog or custom log pipelines—for an exact four-step forensic pattern occurring within a three-second window on an identical client session:

1. Apache Access Log: An incoming HTTP POST request to any valid endpoint returns an immediate HTTP 500 error code.
2. PHP Error Log: An entry logs: PHP Fatal error: Out of memory (allocated X bytes) (tried to allocate Y bytes) in Unknown on line 0.
3. Apache Error Log: The parent process logs a segmentation fault or worker crash: [core:notice] [pid ...] AH00052: child process ... exited with status 11.
4. Operating System Systemd/Journal Log: Kernel memory manager registers a core dump or unhandled page fault for the associated worker process.

A third vulnerability, CVE-2026-115560, demonstrates why static code auditing is essential. This vulnerability allows remote code execution only when an application sets session.serialize_handler to php_binary or php_serialize in its server configuration and subsequently switches it back to standard php at runtime using ini_set() prior to invoking session_start().

If an application maintains a uniform serialization handler throughout its lifecycle, this third vulnerability path remains completely blocked.

The Three-Tier Operational Defense Against Agentic Post-Exploitation

Mitigating autonomous, machine-speed intrusions requires teams to move beyond signature matching and implement layered defensive guardrails.

First Line of Defense: Immediate Runtime Configuration and Heap Crash Audits

Organizations running PHP environments cannot wait for scheduled maintenance windows to roll out defense patches. Security teams must enforce runtime restrictions directly inside production configuration files:

• Disable Session Progress Tracking: In the production php.ini file, confirm that session.upload_progress.enabled = Off is explicitly defined. Turning off this feature eliminates the primary heap allocation path attackers use to execute memory overflow payloads.
• Audit Dynamic Handler Switching: Run a codebase scan for instances of ini_set('session.serialize_handler', ...). Applications must not alternate serialization engines at runtime before starting a session.
• Set Heap Allocation Alarms: Configure infrastructure monitoring to trigger critical severity alerts if more than three Apache or PHP-FPM worker segmentation faults (exit status 11) occur on a single host inside a 10-minute window.

Second Line of Defense: Network Containment and Egress Filtering

Because autonomous agent loops depend on rapid post-exploitation reconnaissance, network isolation is the most effective containment tool.

• Block Outbound Directory Queries: Web servers exposed to the public internet should never have unauthenticated network access to internal LDAP, LDAPS, or Active Directory domain controllers. Ensure firewall rules explicitly drop TCP ports 389, 636, and 3268 originating from perimeter web tiers.
• Restrict NTLM Relay Traffic: Disable NTLM across internal networks wherever possible, or mandate SMB signing and Extended Protection for Authentication (EPA) to ensure captured credentials cannot be relayed to downstream internal hosts.
• Implement Egress Whitelisting: Prevent compromised application processes from reaching back out to the internet to download follow-on modules. Public web servers should only establish outbound connections to explicitly approved API gateways.

Third Line of Defense: Agentic Behavioral Hunting and Anomaly Detection

To combat autonomous scripts that deliberately format output for downstream AI agents, defenders must monitor execution behaviors at the host level:

• Detect Parsing Wrappers: Instrument endpoint detection agents to alert on command outputs containing structured, custom delimiter tokens like ==[A-Z]+== or formatted JSON payloads returned from interactive web shells.
• Audit Process Trees: Continuously inspect process generation trees where standard web server daemons (www-data, apache, nginx) spawn interactive processes such as curl, bash, certutil, or PowerShell.
• Isolate Suspicious Endpoints Automatically: When an unauthenticated process attempts anonymous LDAP queries against local network adapters, endpoint response systems should immediately quarantine the host from the internal network, denying automated actors their lateral movement window.