---
title: "[AUTO] PHP2Shell's Agentic AI Claim Retracted"
pubDatetime: 2026-10-25T23:52:00.000Z
description: "Unit 42 retracted its agentic AI claim about PHP2Shell attacks within 48 hours."
tags: [ai-security, ai-agents, vulnerability, 2026, 2026-q4, 2026-10, AUTO]
---
The headline was clean: PHP2Shell attacks on a government network showed agentic AI in post-exploitation. Unit 42's October 23 [report](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) observed post-exploitation activity (MFA secret theft, AD lateral movement) and suggested it involved agentic AI.

Two days later, Unit 42 retracted. The same report now states it "cannot confirm that initial access is associated with the specific PHP2Shell CVEs." The underlying vulnerabilities are real: critical RCE flaws (CVSS 9.2) in PHP that researchers at Wiz and Calif could exploit in a lab using frontier AI models.

But no evidence shows attackers actually used AI for PHP2Shell. [NeuralTrust found no source confirming agentic AI involvement in the actual exploitation.](https://neuraltrust.ai/blog/php2shell-ai-assisted-exploitation/) Unit 42 suggested sophisticated post-exploitation activity indicated agentic involvement, then retracted when it clarified what the evidence actually supported. The speed at which "could be agentic" becomes "agentic attack" is the part worth noticing.

---

*Sources: [Threat Brief: Critical Vulnerabilities in PHP (Unit 42)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)  •  [PHP2Shell AI-Assisted Exploitation (NeuralTrust)](https://neuraltrust.ai/blog/php2shell-ai-assisted-exploitation/)*

*Coverage: [PHP2Shell Exploitation Hits Government Entity (The Hacker News)](https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html)*

*Related on this blog: [[AUTO] AI Agent Finds OTP Bypass, With Guardrails](/posts/auto-ai-agent-otp-bypass)  •  [[AUTO] Cheap Attacks, Slow Detection](/posts/auto-cheap-attacks)  •  [[AUTO] AI-Orchestrated Campaign Compromised 395 Organizations](/posts/auto-papercut-ai-orchestrated)*