{
  "id": 16923385,
  "title": "PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network",
  "url": "https://urgent.news/2026/10/28/php2shell-attack-roots-25-servers-breaches-u-s-government-affiliated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T16:02:45.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html"
  },
  "original_language": "en",
  "account": "On October 25, 2026, cybersecurity researchers disclosed an AI-assisted attack that exploited PHP2Shell vulnerabilities, targeting and compromising 25 servers, including three systems in a U.S. government-affiliated network. The attack chain combined PHP2Shell with a kernel privilege escalation exploit, affecting devices running specific versions of a large vendor's firewall software.\n\nThe attacker then launched attacks against Active Directory, extracting credentials and enumerating directories. Dream researchers, who analyzed the recovered artifacts, confirmed the attacker's actions. The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, successfully rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.\n\nArtifacts indicated that the operation began in a lab environment, with persistent access obtained to a U.S. government organization's internal Active Directory domain. The attacker targeted three specific servers in the U.S.-affiliated environment. While it's unclear if the attacker successfully found valid credentials or created backdoor accounts, the full extent of the compromise remains undetermined.\n\nThe attack highlights how an exposed management interface can provide access to an organization's identity infrastructure. The 22 remaining rooted firewalls still contain active web shells, and the attacker retains 19,000 fingerprinted targets for future exploitation. The disclosure comes as the PHP2Shell vulnerabilities have seen limited exploitation in the wild, with threat actors highlighting the challenges in converting proof-of-concept (PoC) code into reliable attack vectors against real targets.",
  "summary": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}