PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach
Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders urged to watch for telltale crash sequences. PHP also disclosed a third RCE (CVE-2026-115560) with no patch yet but high exploitation requirements and a mitigation to disable session upload progress. Separately, a Brotli decoder memory corruption bug (CVE-2026-111497) affects Node.js and other software, with fixes delayed into October releases. Finally, Capcom says criminals breached Capcom ID, exposing data tied to 11.7 million accounts and resetting impacted passwords.
00:00 Headlines Overview
00:35 Government Breach Details
01:13 Global Scanning Surge
03:11 Third PHP RCE
05:00 Wildfire Or Smoke
06:08 Patch Race Warning
06:53 Brotli Node To Shell
08:47 Capcom Account Breach
10:21 Wrap Up And Outro
Read the original article:
AI-assisted attackers breach European government via PHP2Shell