AI-Assisted PHP2Shell Exploit Compromises 25 Servers in U.S. Government Network

A suspected China-nexus threat actor used an AI-assisted attack combining PHP2Shell vulnerabilities and kernel privilege escalation to root 25 servers, breaching a U.S. government-affiliated network. The October 25, 2026 incident highlights sophisticated exploitation of software vulnerabilities for high-impact cyber intrusions.

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.

The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

Read original article