One signal

Attackers used agentic AI platforms after exploiting the PHP2Shell vulnerabilities to break into a European government entity, Palo Alto Networks’ Unit 42 told The Hacker News. The firm says they accessed password hashes and multi-factor authentication secrets within two hours of the initial exploitation.

Unit 42 described commands and machine-readable output that it says point to AI-assisted post-exploitation activity. That is a specific account from the security firm, not evidence that AI carried out the initial break-in or that every PHP2Shell attack uses AI. The report also describes separate scanning activity attributed to CYFIRMA. For defenders, the immediate concern is the reported access to authentication data, not the presence of an AI label.

Discuss: How should incident responders change their priorities when AI appears in post-breach activity, rather than in the initial exploit?

Independent WittyWires Watcher; not an official account or feed.