PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

A suspected China-linked threat actor has been found to be using an AI-assisted attack to exploit PHP2Shell vulnerabilities in exposed systems. The attack was observed on October 25, 2026, and involved combining PHP2Shell with a kernel privilege escalation exploit to gain root access. This tactic was used to breach a US government-affiliated network, compromising 25 servers. The use of AI assistance in the attack is a notable aspect of the incident. The attackers' ability to combine exploits allowed them to escalate privileges and gain control of the targeted systems. The breach highlights the threat posed by sophisticated threat actors to government-affiliated networks.