Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewalls

Date:
Fri, 30 Oct 2026 16:05:00 +0000

Description:
Palo Alto Networks firewalls running outdated OS seem to be the target, as Chinese hackers chain PHP2Shell to Fragnesia for the campaign.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Researchers report the first confirmed PHP2Shell compromises, targeting organizations linked to the US government Attackers chained PHP2Shell with a Linux privilege-escalation flaw to gain root access and persistence Breaches progressed from initial compromise to Active Directory attacks within minutes, underscoring patching urgency We now have confirmation of the first successful exploits of the infamous PHP2Shell vulnerability discovered earlier this month.

The news comes courtesy of cybersecurity outfit Dream, who claim to have seen attackers breach organizations affiliated with the US government. PHP2Shell
is a name given to two critical-severity vulnerabilities found in PHP. When they were first disclosed, most of the cybersecurity community went full
panic mode, given that PHP powers roughly 70% of all websites and web apps on the internet, and there was no patch at the time. The flaws allegedly enabled complete website takeover, and some government and education organizations in Europe even preemptively shut down their websites, in anticipation of mass exploitation attempts. Latest Videos From TechRadar Watch full video here:

But after the dust settled, a strange thing happened - there were no successful attacks. Researchers were seeing attempts and probes, but no successful breaches. Amazon said it observed first attacks four days before the patch, and Cloudflare later tracked thousands of attempts in the 10 hours before the patch was announced. This grew to tens of thousands within an hour of disclosure, and hundreds of thousands within two hours. Now, its gone into the millions.

Some said exploiting the bugs was easier said than done, and that threat actors were hitting different roadblocks, including Address Space Layout Randomization, a security feature that randomly changes where a programs code and data are stored in memory every time it runs. Still, they warned that all of that might be temporary, and that a successful hit was a question of when, not if. You may like AWS says hackers tried to exploit PHP security issues days before fix as Cloudflare CEO says it saw a huge rise in targeted attack attempts PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers Experts reveal another major PHP2Shell bug and it's not getting an emergency patch this time Targeting firewalls Now it seems the claims were on point, as Dream says Chinese threat actors successfully chained PHP2Shell with a Linux kernel privilege-escalation flaw against Palo Alto Networks firewalls , breaching 25 servers, some allegedly belonging to US government-affiliated organizations.

The attacks started on October 23 2026, probing firms in the US, Japan, Taiwan, and South Korea, and soon focused on Palo Alto Networks
PAN-OS-powered devices, running an older, vulnerable version of the OS. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro
newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

According to Dream, the crooks chained PHP2Shell with Fragnesia, a local privilege escalation flaw that allows unprivileged users to obtain root access. It was disclosed in mid-May this year and is tracked as CVE-2026-46300.

After breaking into the devices, the attackers ran some 40 custom post-exploitation scripts, Dream added.

Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign - all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet, the companys report reads. What to read next Website admins across the world bracing for impact following major PHP flaw reveal PHP security issues could also threaten your NAS device but not every vendor is able to patch just yet No, the internet isn't dying due to 'one of the most significant vulnerabilities of 2026' - but this is what you need to know Not automated To make matters worse, the researchers believe the attackers still have unabated access.

The total chain - from unauthenticated HTTPS connection to persistent root webshell - completes in under 15 minutes, Dream said. The researchers could not say what the endgame was here because that information was not found in the artifacts they retrieved. Besides the obvious, which seems to be persistent access and credential theft, the threat actors could do anything from dropping backdoors to exfiltrating sensitive information.

In the context of Black October, and the fact were seeing a significant increase in automated attacks, it is also worth mentioning that this incident was likely not AI-powered.

Dream did find evidence of AI usage but believes it was not fully automated. Claude Code was installed, as was an offensive security platform called AIscan, which was configured with Chinese AI models DeepSeek and Kimi. Furthermore, they found API keys for FOFA, a Chinese counterpart to the
Shodan search engine.

With the help of FOFA, the attackers allegedly identified around 19,000 internet-connected Palo Alto Networks firewalls, which they used as a
starting point for their attacks.

Via The Register The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/chinese-hackers-build-php2shell-exploit -use-it-to-root-25-servers-breach-us-government-affiliated-firewalls


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)