AI security
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Researchers have detailed an apparently AI-assisted intrusion by a suspected China-nexus threat actor that used PHP2Shell vulnerabilities and a kernel privilege escalation exploit to root 25 servers, including a U.S. government-affiliated network, according to The Hacker News.
Cybersecurity researchers have disclosed details of an intrusion campaign that appears to have been carried out with the assistance of artificial intelligence, according to The Hacker News.
The activity, attributed to a suspected China-nexus threat actor, was observed on October 25, 2026. The attacker leveraged the PHP2Shell vulnerabilities to compromise exposed systems, then combined that access with a kernel privilege escalation exploit to gain root control of the targeted machines.
According to the report, the campaign resulted in 25 servers being rooted. Among the victims was a network affiliated with the U.S. government, underscoring the sensitivity of the targets involved.
The case is notable for the apparent use of AI assistance in orchestrating the attack, a trend that security researchers have been tracking as threat actors increasingly incorporate AI tools into their operations. The pairing of a web-facing initial access vector, in the form of the PHP2Shell vulnerabilities, with a local kernel exploit for privilege escalation also illustrates a common attack chain: exploiting exposed services to gain a foothold, then escalating privileges to seize full control of the underlying system.
The Hacker News report indicates the disclosure came from cybersecurity researchers who analyzed the activity. Further technical details, including the specific vulnerabilities abused and the full scope of the compromise, were not included in the item available to this newsroom. Organizations running internet-exposed PHP-based systems are generally advised to ensure prompt patching and to monitor for signs of privilege escalation and unauthorized root-level access.
Source: The Hacker News
