Cyber Attacks, Software Vulnerabilities and AI-Driven Threats Against Critical Infrastructure (2020-2026)

Technical research document for government bodies, critical infrastructure operators, financial institutions and large enterprises. Period: January 2020 to November 2026. All CVE identifiers, dates and exploitation claims are tied to cited primary or vendor sources unless explicitly labelled as assessment.

Scope note: Financial impact figures for exchange incidents are operator or media statements unless independently audited. Attack attribution to nation-state actors follows law-enforcement or vendor threat-intelligence publications, not criminal conviction records.

Table of contents

1. Executive technical summary
2. Vulnerability database
3. Incident analysis
4. Case study A: PHP2Shell (CVE-2026-109618, CVE-2026-109619)
5. Case study B: Binance October 2026
6. Case study C: Software supply chain
7. Case study D: Industrial IT/OT
8. AI in offensive and defensive operations
9. Reference security architecture
10. European regulatory mapping
11. Prioritised remediation matrix and 90-day plan
12. Technical references

---

1. Executive technical summary

Between 2020 and 2026, successful attacks against governments, healthcare, energy, finance and industrial operators converged on a small set of technical failure modes:

Root cause pattern: Organisations optimised for feature delivery and remote operations without proportional inventory, segmentation, privileged access control, exploit-facing patch cadence and signing pipeline isolation.

Immediate engineering priorities (evidence-weighted):

1. Patch or remove from the internet all KEV-listed products on the asset inventory (PHP runtime, FortiMail, Cisco SEG, Citrix/Palo Alto/Fortinet edge where applicable).
2. Separate transaction signing, key custody and production deployment from developer workstations and general DevOps IAM roles.
3. Enforce MFA resistant to phishing (FIDO2/WebAuthn) on all paths that can alter builds, DNS, cloud IAM or wallet policy.
4. Implement immutable, tested backups and network segmentation before advanced AI SOC tooling.

This document complements NIS2 technical readiness for Portugal, PHP October 2026 defensive guide, and enterprise AI security controls.

---

2. Vulnerability database

The table below lists documented CVEs with advisory-backed fields. It is not exhaustive for 2020-2026; it prioritises critical infrastructure relevance and 2025-2026 exploitation evidence.

2.1 Master vulnerability table

2.2 Mechanism reference (defensive)

2.3 Category coverage (2020-2026 research scope)

---

3. Incident analysis

Legend: Confirmed = vendor, government or court-adjacent primary disclosure. Assessment = reputable IR firm or CERT analysis.

3.1 Financial infrastructure

Binance 2018 note: Public documentation describes API key and 2FA weaknesses in the 2018 period; treat loss figures as historical press and exchange statements.

3.2 Critical infrastructure and healthcare

3.3 Supply chain

---

4. Case study A: PHP2Shell

4.1 Vulnerability mechanics

CVE-2026-109618: PHP's OOM handling via non-local control flow can leave request memory in an inconsistent state; later cleanup may treat attacker-influenced memory as valid, leading to corruption and demonstrated RCE (PHP advisory via NVD/GHSA-w8hw-w9fx-j79w).

CVE-2026-109619: Fatal-error handling can leave pointers to a previous request in a worker. The next request on the same worker may dereference stale memory (use-after-free class behaviour), with public demonstrations including mod_php RCE (GHSA-6wmf-4rv5-p3rp).

Prerequisites: Attacker can send HTTP requests to a vulnerable runtime. No application login required for cited mod_php paths. FPM requires same worker reuse.

Boundaries affected: PHP interpreter integrity; downstream OS users (www-data, pool users).

Application-level mitigation limits: WAF, memory_limit, and session.upload_progress.enabled=0 reduce specific paths but do not remove interpreter flaws. Only patched runtimes fully remediate 109618/109619 per PHP and CISA guidance.

4.2 PHP-FPM and hosting

4.3 Detection

• Surge of 5xx from PHP workers; segfaults in php-fpm logs.
• Unexpected child shells or outbound connections from php-fpm UID.
• Memory spikes on small POST bodies (OOM path).
• CISA KEV presence mandates expedited patch evidence for FCEB; private sector should mirror for internet-facing PHP.

See full PHP October 2026 deployment guide.

---

5. Case study B: Binance October 2026

5.1 Confirmed timeline elements (operator publications)

Sources: Binance blog update, 3 Nov 2026; Chainalysis, Nov 2026; Binance announcement, 30 Oct 2026.

FBI public attribution to DPRK cited in operator blog (3 Nov 2026). Chainalysis attributes activity to TraderTraitor cluster (assessment).

5.2 Why withdrawal suspension did not stop all outflows

Confirmed mechanism (operator): Ethereum EIP-7702 allows an EOA to delegate code execution to a contract. The attacker established on-chain delegations using valid signing paths. Suspending the central withdrawal UI does not revoke delegations already recorded on Ethereum; separate on-chain revocation transactions are required. This is a transaction-authorisation architecture problem, not only an application toggle.

Implications for MPC and hot wallets:

5.3 Architecture lessons (technical, non-marketing)

1. Signing service network isolation: No route from developer VPN or CI agents to signing APIs.
2. Policy-bound keys: Keys that can approve EIP-7702-style delegations require hardware-backed MFA and dual control.
3. Chain policy layer: Monitor delegation authorizations as first-class security events.
4. Assume breach on DevOps: Separate build/deploy roles from transaction policy roles (aligns with NIS2 governance duties).

Financial figures (~$6.34B impacted, replenishment percentages) are Binance statements as of early November 2026.

---

6. Case study C: Software supply chain

6.1 Comparative root causes

6.2 Defensive engineering requirements

• SBOM per release (CycloneDX/SPDX) stored with artifact.
• Dependency pinning with automated PR for CVE diff (SCA).
• Reproducible builds and dual-person merge for release branches.
• Code signing with hardware-backed keys; transparency log where supported.
• Secrets: No long-lived cloud tokens on developer laptops; short-lived OIDC from CI only.
• Developer identity: Phishing-resistant MFA on GitHub/GitLab; device compliance posture.

---

7. Case study D: Industrial IT/OT

7.1 Architecture

[Corporate IT] --(often overly trusted)--> [DMZ jump] --> [Engineering WS] --> [PLC/RTU] | [SCADA/HMI]

7.2 IT attack vs OT impact

Colonial Pipeline lesson (confirmed): IT account compromise led to OT operational decision to halt pipeline flows; segmentation and MFA on remote access are IT controls with OT consequences.

CISA ICS advisories (2020-2026) continue to document default credentials and internet-exposed HMIs; treat as inventory findings, not hypothetical risk.

---

8. AI in cybersecurity

8.1 Offensive use (documented, not autonomous magic)

No credible public record of a fully autonomous AI executing a critical infrastructure breach without human operators (2020-2026).

8.2 Defensive use

8.3 AI-specific risks in security programmes

---

9. Reference security architecture (minimum viable for critical systems)

9.1 Identity

9.2 Network

9.3 Applications and infrastructure

• SDLC: SAST + SCA in CI; block merge on critical CVE.
• Runtime: WAF on public PHP/Java; immutable containers; read-only rootfs where feasible.
• Kubernetes: RBAC least privilege; no privileged pods; network policies default deny.
• CSPM: Continuous misconfig detection on AWS/Azure/GCP.

9.4 Monitoring and recovery

---

10. European regulatory mapping

Legal text prevails over this summary. Portugal NIS2 implementation detail is expanded in NIS2 Portugal guide.

Distinction: NIS2 Art. 21(2)(d) explicitly references basic cyber hygiene, including patch handling and MFA. CRA manufacturer duties do not replace operator NIS2 duties for deployed products.

---

11. Prioritised remediation matrix

90-day plan

Metrics: % assets with KEV cleared, MTTD for internet RCE exploitation, privileged accounts without phishing-resistant MFA, successful quarterly restore tests.

---

Comparative root cause analysis (2020-2026)

Convergence: Attackers prefer few hops from internet to high impact. Patching edge and runtime, and isolating signing, removes the majority of 2025-2026 headline chains without novel AI capability.

---

12. Technical references

---

Document control: Version 1.0 (November 2026). For technical assessment and architecture planning only; not legal advice. Update when NVD scores, operator statements or national transposition texts change.