Chinese hackers create PHP2SHELL exploit, use it to root 25 servers and breach US government-affiliated firewalls.
follow us
Add us as a preferred source on Google
- Researchers report the first confirmed PHP2Shell compromises, targeting organizations linked to the US government.
- Attackers chained PHP2Shell with a Linux privilege escalation flaw to gain root access and persistence
- Breaches progressed from initial compromise to Active Directory attacks in a matter of minutes, underscoring the urgency to patch
We now have confirmation of the first successful exploits of the infamous PHP2Shell vulnerability discovered earlier this month.
The news comes courtesy of cybersecurity team Dream, which claims to have seen attackers breach organizations affiliated with the US government.
PHP2Shell is the name given to two critical vulnerabilities found in PHP. When they were first disclosed, most of the cybersecurity community went into full panic mode, given that PHP powers approximately 70% of all websites and web applications on the Internet, and there was no patch at the time. The flaws allegedly allowed the website to be completely hijacked, with some government and educational organizations in Europe even pre-emptively shutting down their websites, in anticipation of mass exploitation attempts.
Latest videos ofTechnologyRadar
But after the dust settled, something strange happened: there were no successful attacks. Investigators saw attempts and investigations, but no successful breaches. Amazon said it observed the first attacks four days before the patch, and Cloudflare then tracked “thousands” of attempts in the 10 hours before the patch was announced. This figure rose to tens of thousands within an hour of disclosure, and to hundreds of thousands within two hours. Now, it has risen to millions.
Some said exploiting the bugs was easier said than done, and that threat actors were running into different obstacles, including address space layout randomization, a security feature that randomly changes where a program’s code and data are stored in memory each time it is run. Still, they warned that all of this could be temporary, and that a success was a matter of “when,” not “if.”
Target firewalls
It now appears that the claims were accurate, as Dream says Chinese threat actors successfully chained PHP2Shell with a Linux kernel privilege escalation flaw against Palo Alto Networks’ firewalls, breaching 25 servers, some allegedly belonging to US government-affiliated organizations.
The attacks began on October 23, 2026, targeting companies in the US, Japan, Taiwan and South Korea, and soon focused on devices powered by Palo Alto Networks’ PAN-OS, which were running an older, more vulnerable version of the operating system.
According to Dream, the criminals chained PHP2Shell with Fragnesia, a local privilege escalation flaw that allows unprivileged users to gain root access. It was revealed in mid-May this year and is tracked as CVE-2026-46300.
After breaking into the devices, the attackers ran about 40 custom post-exploitation scripts, Dream added.
“Within hours of compromising a US government-affiliated firewall, they had created a tunnel into the internal network, compromised a third server using the same PHP2Shell exploit, and launched an entire Active Directory attack campaign, all through a chain that began with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the Internet,” the company’s report reads.
Not automated
To make matters worse, researchers believe the attackers still have constant access.
“The entire chain, from the unauthenticated HTTPS connection to the persistent root webshell, is completed in less than 15 minutes,” Dream said. The researchers couldn’t say what the endgame was here because that information wasn’t found on the artifacts they recovered. Besides the obvious, which appears to be persistent access and credential theft, threat actors could do anything from opening backdoors to leaking sensitive information.
In the context of “Black October”, and the fact that we are seeing a significant increase in automated attacks, it is also worth mentioning that this incident was probably not driven by AI.
Dream found evidence of AI use, but believes it was not fully automated. Claude Code was installed, as was an offensive security platform called AIscan, which was configured with Chinese AI models DeepSeek and Kimi. Additionally, they found API keys for FOFA, a Chinese counterpart to the Shodan search engine.
With the help of FOFA, the attackers allegedly identified around 19,000 Palo Alto Networks firewalls connected to the Internet, which they used as a starting point for their attacks.
Through The Registry
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment