PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Live updates

1. 2h ago

   PHP2Shell Attack Roots 25 Servers, Breaching U.S. Network

   A suspected China-nexus threat actor used an artificial intelligence-assisted attack to chain PHP2Shell vulnerabilities with a kernel privilege escalation exploit, successfully rooting 25 servers. The compromised infrastructure includes three systems within a U.S. government-affiliated environment, alongside servers located in the United States, Japan, Taiwan, and South Korea. Cybersecurity firm Dream observed the activity on October 25, 2026. The targeted devices run specific versions of a large vendor's firewall software, specifically Palo Alto Networks PAN-OS management interfaces. Following initial access, the attacker targeted Active Directory, confirming credential extraction and directory enumeration activities.

   Why it matters

   The campaign highlights the mounting danger of attackers leveraging artificial intelligence to weaponize critical vulnerabilities across enterprise infrastructure. Security researchers and vendors such as Palo Alto Networks have collaborated on investigations following the discovery of the custom exploit chain. The exploitation of internet-exposed management interfaces underscores urgent remediation requirements for organizations relying on vulnerable firewall configurations.

   What is confirmed

   • A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities and a kernel privilege escalation exploit to root 25 servers.
   • The compromised servers include three systems in a U.S. government-affiliated environment.
   • The activity was observed on October 25, 2026.
   • The affected devices run specific versions of Palo Alto Networks firewall software.
   • The attacker launched attacks against Active Directory, confirming credential extraction and directory enumeration.

   Still unconfirmed

   • The attack was orchestrated using artificial intelligence assistance.

   What to watch next

   • Further disclosures from Palo Alto Networks regarding patched PAN-OS firewall versions
   • Additional telemetry from security firms tracking the China-nexus threat actor's infrastructure
   Sources used for this update (22)

   1. thehackernews.com — The Hacker News | #1 Trusted Source for Cybersecurity News
   2. www.helpnetsecurity.com — Cybersecurity News and Expert Analysis - Help Net Security
   3. tech.yahoo.com — 5 Classic SNES Games That Are Unplayable Today - Yahoo Tech
   4. www.bleepingcomputer.com — Retail giant Ahold Delhaize takes systems offline after cyberattack - BleepingComputer
   5. wiz.io — PHP2Shell: Exploitation Attempts and Remediation Trends
   6. The New York Times — Silicon Valley Is Grappling With a Flood of Bugs Found by A.I.
   7. Federal News Network — CISA gives agencies days to patch critical PHP bugs
   8. Bloomberg — How AI Is Making Cyberattacks a Bigger Threat
   9. Salesforce — What You Need to Know About the Critical PHP Vulnerabilities (PHP2Shell)
   10. thehackernews.com — PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
   11. The Hacker News — Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
   12. O'Reilly Media — The PHP Incident
   confidence 95%