As cited
Copy frozen at (site build).
breaches incidents
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers disclosed details of an artificial intelligence (AI)-assisted attack by a suspected China-nexus threat actor that exploited PHP2Shell vulnerabilities to compromise 25 servers. The attacker combined PHP2Shell with a kernel privilege escalation exploit to gain root access on a U.S. government-affiliated network, with the activity observed on October 25, 2026.
Why it matters: U.S. government and related entities must patch PHP2Shell and review network access logs for similar exploitation patterns, as a capable state-sponsored group has demonstrated active targeting of exposed systems.
- Source published
- First seen by Cybersecurity Tracker