# PHP2Shell Vulnerability Exploited in AI-Assisted Attacks on Government Infrastructure Threat actors leveraged custom PHP2Shell exploits to compromise 25 servers across multiple strategic regions. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c9ca1018-45f6-4a46-b9e2-1e5a017765d7 ## Coordinated PHP2Shell Breach On October 25, 2026, a suspected China-nexus threat actor successfully compromised 25 servers using a custom PHP2Shell exploit chain. The operation targeted specific firewall software versions, utilizing a kernel privilege escalation vulnerability identified as CVE-2026-46300. Three of the affected systems were located within a U.S. government-affiliated environment, marking a significant security incident. ## Customized Exploit Development Researchers from Dream discovered that the attack utilized a non-public, custom build of the PHP2Shell exploit. Unlike generic proof-of-concept code, this version was specifically tailored for the target firewall platform's management server. It exploited the session.upload_progress mechanism in PHP 8.0.30, leveraging high memory limits to facilitate successful memory corruption stages during execution. ## AI-Augmented Attack Infrastructure Evidence suggests the attacker utilized AI tools to accelerate the development process. Forensic artifacts revealed the installation of Anthropic's Claude Code and an offensive security platform called aiscan, which integrated DeepSeek and Kimi LLMs. The consistency in code structure and commenting styles across nearly 40 scripts indicates significant AI-driven augmentation throughout the operation. ## Targeting Identity Infrastructure After gaining root access to the firewall systems, the attacker pivoted to target Active Directory domains. The operation involved credential extraction and directory enumeration, aiming to deepen their foothold within the compromised networks. This transition from edge device compromise to internal identity infrastructure highlights a sophisticated lateral movement strategy employed by the threat actor. ## Strategic Geographic Focus The 25 compromised servers were distributed across the U.S., Japan, Taiwan, and South Korea. These nations represent primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater. The selection of these specific regions underscores the geopolitical motivations behind the campaign, moving beyond simple opportunistic exploitation of vulnerabilities. ## Persistent Threat Presence While the full extent of the compromise remains indeterminate, 22 of the rooted firewalls currently host active web shells. The persistent tunnel into the U.S. government organization likely remains operational. Furthermore, the attacker has fingerprinted approximately 19,000 additional potential targets, suggesting that they are actively developing profiles for various other operating system versions. ## Technical Challenges of Exploitation Despite the success of this specific operation, PHP2Shell remains difficult to exploit in the wild. Security researchers note that reliable exploitation requires unique offsets from libphp.so, which vary by build and cannot be easily brute-forced. The attacker's ability to overcome these technical hurdles demonstrates a high level of capability and access to target-specific environmental data. ## Implications for Security Operations This incident demonstrates how exposed management interfaces serve as critical entry points into sensitive identity infrastructure. Organizations must prioritize closing visibility gaps and strengthening their attack surface management. As threat actors increasingly integrate AI into their development workflows, security teams must adapt by enhancing their detection capabilities for both human and AI-driven malicious activities. ## Sources covering this story - https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._