Correction, Oct 25: Unit 42 retracted the Oct 23 update that described this intrusion, including the AI-agent behavior below, saying it cannot confirm the attacker got in through PHP2Shell. Unit 42 has not republished the agentic-attacker details. We are keeping this item for the record; don't cite it as a confirmed case of an AI agent exploiting PHP2Shell.

Original item (Oct 23), as published:

Unit 42 did not name a model or tool, but it describes behavior that points to a machine operator: output wrapped in parseable delimiters (==SHELLUSER==, ==PASSWD==), short serial tasks and fast pivots after failures. The result was credential and MFA-secret theft and an NTLM-relay path into Active Directory within two hours at a European government entity.

Why it matters for defenders: the window between a web-tier foothold and a domain-level attempt is shrinking to hours, so alerting on web-worker child processes needs to page someone, not wait for a morning queue. The same delimiter habit is also a detection opportunity while it lasts.