PHP2Shell and Linux kernel flaws used to root 25 servers, three in a U.S. government-affiliated network
Dream says the full extent of the compromise is still unclear, with 22 firewalls still holding active web shells.
Dream, an Israeli cybersecurity firm, reported an apparently AI-assisted intrusion by a suspected China-nexus actor that chained the PHP2Shell flaws with a Linux kernel privilege escalation bug to gain root on 25 servers in the U.S., Japan, Taiwan and South Korea. Three of the compromised machines belonged to a U.S. government-affiliated environment, and the attacker went on to target that organisation's Active Directory. Evidence such as traces of Anthropic's Claude Code and configured LLM tooling pointed to AI assistance in building the attack. Dream said the full extent of the compromise is still unclear and that 22 other firewalls remain open to active web shells. Threat actors themselves have, meanwhile, pointed out that turning the PHP2Shell proof of concept into a dependable attack against real targets is difficult.
Why it matters
The intrusion shows how an existing web flaw, paired with a kernel privilege escalation bug, can give an attacker root access across several countries at once. Administrators of PHP-based servers and firewalls in the affected region face the open question of whether their own machines hold similar web shells. For the government-affiliated organisation, the risk now centres on a likely persistent tunnel and attempts against its Active Directory. Dream's finding that AI assistance left traces in the attack also gives a concrete example of how such tools are appearing in real intrusions.
Series Critical PHP flaws
- PHP2Shell and Linux kernel flaws used to root 25 servers, three in a U.S. government-affiliated network
- CISA Flags Two Actively Exploited PHP Flaws Allowing Unauthenticated Code Execution
- Critical PHP flaws prompt urgent patching across a large share of the web
- Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
- Two PHP flaws patched after first confirmed in-the-wild attacks
- PHP2Shell flaws used in fast attack on European government, with wider scanning under way
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.