PHP2Shell Vulnerabilities Exploited in AI-Assisted Attack Rooting 25 Servers, U.S. Government Network Breached

According to researchers, the attack campaign observed on October 25, 2026, involved a suspected China-nexus threat actor combining PHP2Shell vulnerabilities with a kernel privilege escalation exploit to gain root access on exposed systems. The exploitation led to 25 servers being rooted and a U.S. government-affiliated network being breached. The nature of the PHP2Shell vulnerabilities and the specific kernel exploit used have not been publicly detailed, but the combination allowed the attacker to achieve persistent, elevated access. The incident was disclosed on October 28, 2026, by The Hacker News. Researchers noted that the attack leveraged AI-assisted orchestration, though the extent of AI involvement in the attack chain is subject to ongoing analysis. The full scope of affected systems beyond the 25 rooted servers and the specific data exfiltrated from the government network remain under verification. Administrators of exposed PHP2Shell systems are advised to audit and secure their environments.