PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Summary: Researchers at Dream reported an attack observed on October 25, 2026, in which a suspected China-nexus actor combined the PHP2Shell vulnerabilities with a kernel privilege escalation exploit, CVE-2026-46300, to root 25 servers across the U.S., Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment. Dream said the PHP2Shell implementation was a custom, non-public build targeting PHP's session.upload_progress mechanism on a firewall vendor's appweb management server running PHP 8.0.30, and that artifacts including Anthropic's Claude Code, FOFA API keys, and an AI offensive platform configured with DeepSeek and Kimi LLMs point to AI-assisted tooling.
What's compelling: Dream says the 22 other rooted firewalls remain parked with active web shells, the tunnel into the U.S. government organization is likely still running, and the attacker holds 19,000 fingerprinted targets to revisit - so the exposure is not closed.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-46300
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 28, 2026CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability Known Exploited Vulnerabilities · Oct 28, 2026