Executive Summary
A sophisticated campaign attributed to the Lazarus Group is exploiting critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target government and financial sectors globally. Analysts have observed the use of agentic AI platforms to automate post-exploitation tasks, including credential theft and Active Directory reconnaissance, occurring within hours of initial access. The campaign, dubbed SyncHole, is characterized by 'low-and-slow' scanning from rotated compromised nodes to evade threshold-based detection.
Technically, the attackers leverage memory corruption in PHP's form-field parsing to achieve remote code execution. Following exploitation, automated scripts or AI agents wrap command output in specific delimiters like '==SHELLUSER==' to facilitate machine parsing. The threat actor is also using NTLM-relay tunnels to escalate privileges within internal networks.
This activity represents a significant shift in adversary tradecraft through the integration of AI to accelerate the attack lifecycle. Given that PHP powers nearly 37 million internet-facing systems, the potential impact on government facilities, financial institutions, and critical infrastructure is high. Immediate patching of the PHP runtime is required as application-level fixes and WAFs may not provide complete mitigation.