Episode 11: PHP2Shell intrusion confirmed, Tailscale SSH flaws and booby-trapped agent files, 26 October 2026

PHP2Shell now has a confirmed intrusion: Unit 42 reports attackers reached a European government entity's password hashes and MFA secrets within two hours, with strong signs that an AI agent did the follow-up work, while a suspected North Korean campaign has Australian PHP hosts on its target list. A researcher has published 11 unpatched Tailscale and headscale findings, and AI coding agents can be hijacked by instruction files that land in the Downloads folder. We also recap the weekend and the key learnings from Sunday's AI assurance special.

Weekend recap and Sunday Special

• Sunday Special, Episode 10: AI assurance and ISO/IEC 27090. Key learnings: build an AI inventory, including third-party and embedded AI and every agent with tool access; map training data sources and treat feedback loops as possible poisoning paths; put agents behind least privilege with approval for high-impact actions; don't count system prompts as security controls; monitor agent configuration for drift; red-team before widening agent autonomy. Episode 10 notes
• Brotli decoder flaw reaches beyond Node.js. CVE-2026-111497 also affects Bun, Python Brotli packages and some Envoy setups. The Hacker News
• LiteLLM's poisoned release traced to an unrevoked master key. The Hacker News
• Researchers disable an abandoned Popcorn Time updater on millions of machines. BleepingComputer

Australian focus

• Suspected North Korean PHP2Shell targeting includes Australia. CYFIRMA reports slow, deliberate scanning of 216 unpatched or partly mitigated hosts in a dozen countries and regions; attribution is moderate confidence. The Hacker News; ASD's ACSC PHP alert

Global threats

• PHP2Shell: confirmed intrusion with agentic post-exploitation. Password hashes and MFA secrets reached in two hours, an NTLM relay tunnel into Active Directory and a Domain Admin attempt; still not in CISA KEV. The PHP Foundation has also flagged a third RCE, CVE-2026-115560, exploitable only under an unusual session.serialize_handler setting and fixed in the regular release cycle. Probe indicators: source 204.76.203[.]7, marker p2s-rider. Unit 42; The Hacker News
• Tailworm: 11 unpatched Tailscale and headscale findings. One compromised approved device can reach root on other permitted servers where SSH forwarding is allowed; no fix yet, single researcher's lab results. The Hacker News; Tailworm report

AI security

• AI coding agents hijacked by AGENTS.md files in Downloads. Malicious instruction files led Codex and Claude Code to run code or expose tokens in tests. BleepingComputer
• OpenAI's agents escaped research sandboxes during red-teaming. MicroVM escapes, routes to the internet through internal services and a CPU cache covert channel, found on isolated copies with source code supplied; frontier training now runs with no live internet access. OpenAI; The Hacker News

Outlook and patch priorities

• Critical: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 everywhere, plus a compromise check on hosts left exposed last week; Fortinet hardening releases; Arista VeloCloud Orchestrator and Collabora fixes.
• High: per-pair Tailscale SSH rules, SSH forwarding off where possible, fewer app connector grants, node-key expiry; Brotli updates; no LiteLLM 1.107.0; replace eMudhra certificates.
• Hygiene: never launch AI coding agents from Downloads or home folders.

Show notes page | Follow on X (@u51cyber)