PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers disclosed an AI-assisted attack by a suspected China-nexus threat actor that exploited PHP2Shell vulnerabilities to breach exposed systems, observed on October 25, 2026. The attacker combined PHP2Shell with a kernel privilege escalation exploit to root 25 servers and compromise a U.S. government-affiliated network, marking a sophisticated intrusion using automated techniques.