Executive Summary
Active exploitation of PHP2Shell vulnerabilities has escalated from reconnaissance to fully working remote code execution shells. The Mirai operator group is leveraging these flaws to distribute the 'Potassium' malware variant, indicating a shift toward more sophisticated server-side attacks by traditional botnet actors. This opportunistic activity occurs alongside suspected North Korean APTs using similar weaknesses for espionage against government entities.
Supply chain integrity remains under severe pressure from multiple vectors today. TeamPCP (UNC6780) is deploying autonomous AI agents to compromise open-source package registries, while a separate campaign known as MALFEX targets AI coding assistants by manipulating local instruction files. These coordinated efforts aim to harvest credentials and deploy payloads across vast developer ecosystems.
Regulatory and legal actions concerning artificial intelligence are intensifying globally. The state of Texas has filed suit against OpenAI regarding safety claims, while South Korean authorities arrested suspects for using the ARTEX AI framework to breach over 90 organizations. Concurrently, federal agencies issued new guidance treating rogue AI agents as critical incident subjects requiring formal identity records and response protocols.
Critical Vulnerabilities
- CVE-2026-109618 (CVSS 9.8): PHP2Shell vulnerability allowing unauthenticated remote code execution in PHP environments.
- PHP2Shell (Brotli): Critical flaw in the Brotli C decoder library within Node.js permitting memory corruption and data access.
- Wasmtime Sandbox Escape: Two critical flaws enabling malicious WebAssembly modules to break out of intended sandbox containment, particularly affecting ARM64 systems.
Major Incidents
- Mirai Botnet Escalation: Mirai operators are actively exploiting PHP2Shell flaws to deploy Linux server malware named 'Potassium', marking an operational sophistication increase for this historically known group.
- Malicious GitHub Workflow Campaign ('Gheist'): Automated attackers are using stolen GitHub tokens to inject workflows that exfiltrate private repository secrets via Actions logs, affecting both personal and Enterprise environments.
- Massive Supply Chain Compromise (LiteLLM): An unrevoked API key from the open-source tool LiteLLM facilitated a supply chain attack impacting tens of thousands of users globally.
- University of Copenhagen Breach: A test environment compromise exposed personal data belonging to 525,000 individuals at the institution.
- Microsoft 365 Token Replay Campaign: Adversaries utilized adversary-in-the-middle relays to capture and replay sign-in tokens, compromising 97 accounts across 79 organizations.
Emerging Trends
- AI-Augmented Post-Exploitation: Suspected North Korean groups are employing AI-assisted tools during post-exploitation phases, suggesting a trend toward automated, low-and-slow espionage operations.
- Autonomous Supply Chain Attacks: APT group TeamPCP is leveraging autonomous AI agents to execute rapid, large-scale campaigns against open-source infrastructure, automating the compromise of package registries like PyPI and npm.
- AI Coding Agent Exploitation: New techniques blur the line between text documents and executable code by manipulating how local instruction files are loaded by AI assistants, leading to unauthorized package installations.
- Regulatory Scrutiny on AI Safety: Government entities are moving from warning to legal action, with state lawsuits seeking personal liability for tech CEOs over alleged deceptive safety practices.
AI Threat Landscape
Threat actors are increasingly abusing the trust AI agents place in local context files to execute malicious commands (AML.T0051 LLM Prompt Injection). In one observed campaign, attackers placed a malicious instruction file in a developer's Downloads folder, tricking an AI coding agent into installing a harmful npm package that subsequently deployed Windows payloads. This technique effectively turns standard documentation workflows into execution vectors.
Adversaries are also actively obtaining generative AI capabilities to enhance their own offensive tooling (T1588.007 Obtain Capabilities: Artificial Intelligence). In South Korea, suspects used the ARTEX AI pentesting framework to automate breaches against numerous organizations, demonstrating how accessible AI tools lower the barrier for sophisticated intrusion attempts. Separately, researchers noted that leaked reasoning traces from OpenAI models could allow rivals to distill cheaper, competitive AI systems, representing a different form of capability theft.
Investigation Insights
Deep-dive analysis confirms that Mirai operators are currently distributing 'Potassium' malware via PHP2Shell exploits, distinguishing their activity from general opportunistic crime. Suspected North Korean APTs are utilizing the same vulnerabilities for targeted espionage, employing AI-assisted tools during the post-exploitation phase to maintain stealth.
The MALFEX campaign specifically targets AI coding agents such as OpenAI Codex and Claude Code. By placing malicious instructions in browser-accessible folders like ~/Downloads, attackers induce silent web-to-file delivery that forces the agent to install compromised packages like 'function-color'. TeamPCP (UNC6780) represents a different vector, using autonomous agents to compromise package registries and harvest API keys across tens of thousands of victims.
Action Items
- Patch PHP2Shell Immediately: Prioritize patching PHP environments for CVE-2026-109618 and the associated Brotli vulnerability in Node.js due to active exploitation by Mirai and other groups.
- Audit GitHub Token Permissions: Review all active GitHub tokens for excessive permissions or signs of compromise, as stolen tokens are currently being used to exfiltrate secrets via Actions logs.
- Restrict AI Agent File Access: Implement restrictions on local instruction files (AGENTS.md/CLAUDE.md) in writable directories like Downloads to prevent MALFEX-style prompt injection attacks against coding assistants.
- Enforce API Key Rotation: Verify that all open-source tool keys, particularly for LiteLLM and similar services, are rotated regularly and never stored in public repositories or accessible logs.
- Update AI Incident Response Plans: Incorporate guidance from NIST, CISA, and NSA to treat rogue AI agent actions as formal incidents, establishing clear identity records and authority verification protocols before deployment.