PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers have disclosed an apparently AI-assisted attack, attributed to a suspected China-nexus actor, that combined the PHP2Shell vulnerabilities with a Linux kernel privilege-escalation exploit to root 25 servers across the United States, Japan, Taiwan and South Korea. The activity, observed on October 25, included three systems in a U.S. government-affiliated environment and a path from exposed firewall management interfaces toward internal Active Directory services.