Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.

The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment.

"The affected devices run specific versions of a large vendor's firewall software," cybersecurity firm Dream said. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."

The name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel -

"The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell," Dream researchers explained. "It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform."

"The vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack."

The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.

S. government organization's internal Active Directory domain.

Source link