Hackers have reportedly broken into 25 servers across four countries, including systems connected to a U.S. government-affiliated organization. Security researchers also discovered evidence that AI tools may have played a role in the attack.
According to a new report from Dream Research, published Monday, the attackers exploited critical vulnerabilities in PHP, a programming language used by millions of websites, before using another security flaw to gain full control of vulnerable systems.
The attacks targeted servers in the United States, Japan, Taiwan and South Korea. Researchers found evidence pointing to a possible Chinese connection, although they have not identified the attackers or confirmed any government involvement.
What makes the discovery particularly concerning is how far the attackers managed to get. In one U.S. government-affiliated environment, they moved beyond the initial breach and gained access to internal network information, employee account listings and authentication credentials.
And while AI's exact role remains unclear, researchers found several tools in the attacker's environment that raise questions about how AI could be accelerating cyberattacks.
The attack started with two critical security flaws, known collectively as PHP2Shell, that were publicly disclosed on October 21.
PHP is used behind the scenes by millions of websites, including WordPress sites and online services. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can let hackers run malicious commands on vulnerable servers.
But the attackers didn't stop there. They combined those flaws with another Linux vulnerability called Fragnesia, allowing them to take full control of certain firewall systems without needing a username or password .
Source link
