PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

Covered by 2 publishers within 12 hours of the first report.

Summary from The Hacker News.

Reporting2

THN The Hacker News PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network · info@thehackernews.com (The Hacker News) 12:02 PM

CSN Cyber Security News Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers · Guru Baran 11:55 PM

Related

REC More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus November 4

BC CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers October 20

UAI South Korea’s FSC Discloses New Wave of Financial Sector Breaches October 28

THN Attacker exploits SGLang flaw to access NEAR AI inference server November 10

Topics Data breaches