Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewalls

Chinese hackers have created the PHP2Shell exploit and exploited it to compromise 25 servers, ultimately breaching US government-affiliated firewalls. The attack began on October 23, 2026, when Chinese threat actors targeted firms in the US, Japan, Taiwan, and South Korea. They first exploited the PHP2Shell vulnerability, which affects PHP-powered websites and web applications, and then combined it with a Linux kernel privilege-escalation flaw, called Fragnesia.

Using these exploits, they were able to gain root access and persistence on Palo Alto Networks firewalls, which are running an older version of the OS. The attackers then ran 40 custom post-exploitation scripts and gained access to the internal network, compromising an additional server using the PHP2Shell exploit. They proceeded to launch a full Active Directory attack campaign.

The entire chain of attacks from initial compromise to persistent root webshell takes under 15 minutes. The researchers, Dream, believe the hackers still have unabated access, and the endgame could involve persistent access, credential theft, dropping backdoors, or exfiltrating sensitive information.