← All stories

AI security

PHP2Shell Exploitation Hits European Government Entity Amid Global Scanning and AI-Assisted Hacking

By The Hacker News1 min read

Threat actors are exploiting two PHP2Shell vulnerabilities and using agentic AI platforms for post-exploitation, with one European government entity breached within two hours, The Hacker News reports. The activity comes amid global scanning for the flaws.

Cover for a ai-security story

Threat actors are actively exploiting a pair of vulnerabilities known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, and in some cases are turning to agentic artificial intelligence platforms to carry out post-exploitation activity, according to a report from The Hacker News.

The outlet said the exploitation campaign is unfolding amid widespread global scanning for the vulnerable software. In one incident detailed in the report, attackers targeted a government entity in Europe and moved with striking speed: within two hours of the initial exploitation, they had successfully accessed password hashes and multi-factor authentication data.

The reporting points to signs of AI-assisted hacking, with agentic AI platforms being used to automate or accelerate stages of the intrusion after initial access is gained. Security researchers have increasingly warned that such tooling can compress the time between compromise and data theft, shrinking the window defenders have to detect and contain a breach.

The Hacker News described a case in which "the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor" authentication material, underscoring how quickly the intruders escalated their access.

The report did not name the affected government body, attribute the attacks to a specific group, or identify the developer or maintainer of the vulnerable PHP2Shell component. Organizations running potentially exposed systems are advised to review the technical details and any mitigation guidance published alongside the findings, and to monitor for signs of scanning or unauthorized access.

Source: The Hacker News

Cover for a ai-security story

AI security

Apple Adds Setting to Exclude Apps from Siri AI, EFF Says

Apple's latest device update, iOS 27.2, introduces a setting that lets users exclude apps from Siri AI features, according to the Electronic Frontier Foundation, which says the change addresses a request from its Encrypt It Already campaign.

1 min read

AI-written summary Source: EFF Updates · Fetched

Cover for a ai-security story

AI security

Unit 42 Warns of Peak Season Cyber Threats Targeting Retailers

Unit 42 has outlined the key cyber threats facing retailers during the peak shopping season, ranging from ransomware to attacks involving artificial intelligence, along with guidance on defending operations and customer trust.

1 min read

AI-written summary Source: Unit 42 · Fetched

Cover for a ai-security story

AI security

GitHub's npm package firewall can block brand-new versions before they install

GitHub has announced a package firewall for npm that checks packages against an enterprise's policy before they install, blocking known malware, critical vulnerabilities and brand-new versions, Help Net Security reported. The checks run before a package reaches a developer's laptop, a build or a coding agent.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.