Chinese hackers exploit PHP2Shell to breach 25 servers, including US government affiliates

How the attack unfolded

Chinese threat actors exploited two critical-severity vulnerabilities in PHP, dubbed PHP2Shell, to gain full control over targeted servers. The vulnerabilities were chained with a Linux kernel privilege-escalation flaw (CVE-2026-46300) to breach Palo Alto Networks firewalls running an older, unpatched version of PAN-OS. The attack began on October 23, 2026, with initial probes targeting organizations in the US, Japan, Taiwan, and South Korea.

The attackers used FOFA, a Chinese search engine similar to Shodan, to identify approximately 19,000 vulnerable Palo Alto Networks firewalls connected to the internet. Within hours of compromising a US government-affiliated firewall, they tunneled into the internal network, exploited PHP2Shell again to compromise a third server, and launched a full Active Directory attack campaign.

Speed and scale of the compromise

The entire attack chain was completed in under 15 minutes, granting the attackers persistent root access to compromised systems. According to Dream, the threat actors ran around 40 custom post-exploitation scripts to maintain access and escalate privileges. Evidence suggests the attackers still retain access to the breached systems, raising concerns about potential data exfiltration or further lateral movement.

While the attackers used AI tools like Claude Code, AIscan, DeepSeek, and Kimi to assist in the operation, cybersecurity experts believe the attack was not fully AI-powered. The focus appears to be on persistent access, credential theft, or deploying backdoors for ongoing espionage.

Broader implications of PHP2Shell

PHP powers roughly 70% of all websites and web applications globally, making PHP2Shell a critical concern for organizations worldwide. Amazon and Cloudflare reported observing the first attacks on PHP2Shell four days before a patch was released, with Cloudflare tracking thousands of exploitation attempts in the hours preceding the patch announcement.

In response to the threat, some government and educational institutions in Europe preemptively shut down their websites to mitigate the risk of mass exploitation. The incident highlights the rapid pace at which state-sponsored actors can weaponize newly disclosed vulnerabilities.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach underscores the urgency for organizations—particularly those in government, critical infrastructure, and enterprise sectors—to prioritize patch management and vulnerability scanning. The speed of the attack, completed in under 15 minutes, demonstrates how quickly threat actors can exploit unpatched systems. Founders and operators should note the attackers' use of FOFA to identify vulnerable targets, a tactic that could be replicated against other exposed systems.

The chaining of PHP2Shell with a Linux privilege-escalation flaw also serves as a reminder that single vulnerabilities, when combined, can lead to devastating outcomes. For startups and enterprises using Palo Alto Networks firewalls or PHP-based applications, this incident is a clear signal to audit infrastructure for outdated software and to implement network segmentation to limit lateral movement in the event of a breach.

Related on Lazyfounder

• More technology news