Hackers Use AI to Steal Passwords in Hours

Hackers are now deploying AI agents after breaching systems, allowing them to steal sensitive data like passwords in just a couple of hours.

Attackers are actively exploiting a critical PHP vulnerability and, for the first time in a major incident, are using agentic artificial intelligence to accelerate their attacks once inside a network. According to a report from The Hacker News, threat actors breached a European government entity by abusing the PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. What followed marks a significant evolution in cybercrime tactics. Within just two hours of the initial compromise, the attackers had successfully navigated the victim's network and exfiltrated sensitive data, including password hashes and multi-factor authentication details. This rapid progression from breach to data theft was reportedly facilitated by an AI agent performing post-exploitation tasks that would typically require a skilled human operator.

The key innovation here is the use of an "agentic AI" for post-exploitation activities. After an attacker gains an initial foothold in a system—in this case, by exploiting the PHP flaw—the post-exploitation phase begins. This traditionally involves a human attacker manually exploring the compromised network, identifying valuable assets, escalating their privileges, and moving laterally to other systems to find and steal data. An AI agent automates this entire process. It can independently execute commands, interpret the results, and decide on the next best action to achieve its goal, such as finding and exfiltrating a database of user credentials. This is not merely an automated script; it's a system capable of dynamic decision-making, making it far more effective and harder to predict than traditional malware.

This incident provides the first concrete, public evidence of a threat that security researchers have long warned about: the weaponization of AI to conduct faster and more sophisticated cyberattacks. The evolution of hacking tools has moved from manual techniques to automated scripts and frameworks, but the introduction of autonomous agents represents a paradigm shift. It dramatically lowers the barrier to entry for complex attacks and allows a single threat actor to manage multiple intrusions simultaneously with greater efficiency. This development confirms that AI is a dual-use technology, providing powerful new capabilities to both defenders and attackers. While security teams are leveraging AI for threat detection and analysis, adversaries are now clearly using it to increase the speed and scale of their own operations, creating a new front in the cybersecurity arms race.

For developers, security teams, and business leaders, the primary takeaway is the radical compression of the incident response timeline. The average "dwell time"—the period an attacker remains undetected within a network—has historically been measured in days, weeks, or even months, giving defenders a window to identify and contain a threat. With AI-driven attacks, that window may be collapsing to just a few hours or minutes. This puts immense pressure on organizations to prioritize proactive security hygiene, such as timely patching of known vulnerabilities like PHP2Shell, to prevent the initial breach. It also underscores the critical need for automated detection and response systems (SOAR and XDR platforms) that can react at machine speed, as human-led response may soon be too slow to effectively counter an AI-powered adversary. Organizations must now operate under the assumption that a breach can lead to catastrophic data loss almost instantaneously.

The use of agentic AI for post-exploitation marks a significant tactical shift. It automates and accelerates network reconnaissance and data exfiltration, drastically reducing the time defenders have to detect and respond to a breach. This fundamentally changes the calculus for incident response teams.

This development dramatically increases security risk by shortening the breach-to-impact timeline. A compromise that once took days can now lead to significant data loss in hours, raising the stakes for proactive security and demanding faster response capabilities to protect critical business assets.