{
  "id": 17251078,
  "title": "Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewalls",
  "url": "https://urgent.news/2026/10/30/chinese-hackers-build-php2shell-exploit-use-it-to-root-25-servers",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T16:05:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/chinese-hackers-build-php2shell-exploit-use-it-to-root-25-servers-breach-us-government-affiliated-firewalls"
  },
  "original_language": "en",
  "account": "Chinese hackers have created the PHP2Shell exploit and exploited it to compromise 25 servers, ultimately breaching US government-affiliated firewalls. The attack began on October 23, 2026, when Chinese threat actors targeted firms in the US, Japan, Taiwan, and South Korea. They first exploited the PHP2Shell vulnerability, which affects PHP-powered websites and web applications, and then combined it with a Linux kernel privilege-escalation flaw, called Fragnesia. Using these exploits, they were able to gain root access and persistence on Palo Alto Networks firewalls, which are running an older version of the OS. The attackers then ran 40 custom post-exploitation scripts and gained access to the internal network, compromising an additional server using the PHP2Shell exploit. They proceeded to launch a full Active Directory attack campaign. The entire chain of attacks from initial compromise to persistent root webshell takes under 15 minutes. The researchers, Dream, believe the hackers still have unabated access, and the endgame could involve persistent access, credential theft, dropping backdoors, or exfiltrating sensitive information.",
  "summary": "Palo Alto Networks firewalls running outdated OS seem to be the target, as Chinese hackers chain PHP2Shell to Fragnesia for the campaign.",
  "key_points": [
    "Chinese hackers developed PHP2Shell exploit",
    "Exploit used to compromise 25 servers",
    "Attack breached US government-affiliated firewalls"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "PHP2Shell: a practical patch and check guide for PHP servers",
        "url": "https://urgent.news/2026/10/30/php2shell-a-practical-patch-and-check-guide-for-php-servers",
        "published": "2026-10-30T17:31:51.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}