PHP2Shell CVEs exploited in two hours to extract MFA secrets from European government host

Palo Alto Networks Unit 42 documented command batches delimited by markers such as ==SHELLUSER== and ==PASSWD==, enabling machine-readable output for AI parsing. The operators performed LDAP queries via curl, hunted DNS/AD integration, and established an NTLM relay into Active Directory. CYFIRMA separately tracked 21 compromised nodes conducting low-volume scans against 216 unpatched hosts across government, finance, and aviation sectors in 12 countries. The scanning rotated nodes rapidly to evade rate-limiting thresholds. Technical indicators include C2 infrastructure previously tied to Lazarus Group operations and documented PHP web shell deployment patterns from the SyncHole campaign. Language markers and I2P handles provide moderate-confidence linkage to Korean-speaking operators but lack malware signatures or infrastructure ownership proof that would constitute independent technical attribution. No public CVE exploit code or CVSS scores have been released, limiting external verification of exploit maturity. Government and financial targets align with Lazarus financial objectives yet could also reflect opportunistic AI tooling available to multiple actors. Organizations should audit PHP deployments for the two CVEs and monitor for anomalous LDAP and NTLM traffic rather than relying on volume-based alerts. Expect continued low-and-slow probing of the remaining target list with rapid AI post-exploitation on any new foothold.