PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers disclosed details of an AI-assisted attack campaign attributed to a suspected China-nexus threat actor. The attackers leveraged PHP2Shell vulnerabilities to compromise exposed systems, combining it with a kernel privilege escalation exploit to gain root access. The activity was observed on October 25, 2026, and resulted in the compromise of 25 servers, including systems within a U.S. government-affiliated network. The use of artificial intelligence in orchestrating the attack marks a notable evolution in threat actor tactics. The campaign highlights the risk of exposed PHP-based systems and unpatched kernel vulnerabilities in sensitive environments.