Researchers revealed that a suspected China-linked threat actor used AI-assisted tactics to exploit PHP2 Shell vulnerabilities. The campaign hit 25 servers and compromised a U. S. government-affiliated network. Activity was first observed on October 25, 2026.
The attacker combined PHP2 Shell with automated tools to scale the intrusion. This approach allowed rapid movement across multiple hosts. The breach targeted exposed systems running vulnerable PHP configurations.
The operation relied on machine learning to identify weak points. Attackers used AI to map the network and select high-value targets. This reduced human intervention and sped up the attack chain.
PHP2 Shell remains a critical vulnerability in PHP environments. It allows remote code execution without authentication. The U. S. government-affiliated network was among the most significant compromises.
Automation enabled the actor to test hundreds of endpoints simultaneously. AI models prioritized targets based on exposure and criticality. This made the campaign faster and harder to detect.
Security teams noted the attacker left minimal traces. Log analysis showed short dwell times on each server. The use of AI helped evade traditional signature-based detection.
The breach highlights growing reliance on automated attack tools. Organizations running PHP must patch PHP2 Shell immediately. Network segmentation reduces lateral movement risk.
What is PHP2 Shell? PHP2 Shell is a vulnerability in PHP that permits unauthenticated remote code execution. It affects many web servers and is frequently exploited in the wild.
How many servers were compromised? Researchers confirmed 25 servers were rooted during the campaign. The U. S. government-affiliated network was also breached.
What should organizations do now? Patch PHP to the latest version and audit all exposed endpoints. Review network segmentation and monitor for anomalous login patterns.