PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

On October 25, 2026, cybersecurity researchers disclosed an AI-assisted attack that exploited PHP2Shell vulnerabilities, targeting and compromising 25 servers, including three systems in a U.S. government-affiliated network. The attack chain combined PHP2Shell with a kernel privilege escalation exploit, affecting devices running specific versions of a large vendor's firewall software.

The attacker then launched attacks against Active Directory, extracting credentials and enumerating directories. Dream researchers, who analyzed the recovered artifacts, confirmed the attacker's actions. The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, successfully rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.

Artifacts indicated that the operation began in a lab environment, with persistent access obtained to a U.S. government organization's internal Active Directory domain. The attacker targeted three specific servers in the U.S.-affiliated environment. While it's unclear if the attacker successfully found valid credentials or created backdoor accounts, the full extent of the compromise remains undetermined.

The attack highlights how an exposed management interface can provide access to an organization's identity infrastructure. The 22 remaining rooted firewalls still contain active web shells, and the attacker retains 19,000 fingerprinted targets for future exploitation. The disclosure comes as the PHP2Shell vulnerabilities have seen limited exploitation in the wild, with threat actors highlighting the challenges in converting proof-of-concept (PoC) code into reliable attack vectors against real targets.