Unit 42 Flags Agentic AI Indicators; CYFIRMA Reports 216 PHP2Shell Targets

Palo Alto Networks’ Unit 42 says it found indicators of agentic AI during post-exploitation at an unnamed European government entity, where attackers accessed password hashes and multi-factor authentication secrets within two hours of initial exploitation. Separately, CYFIRMA reports that suspected DPRK-linked operators selected 216 PHP servers for PHP2Shell checks; Unit 42 did not specify the entry vulnerability in its government case.