UK — The Register
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Security2 min read
Suspected Chinese hackers used a custom version of the PHP2Shell flaw, plus a Linux kernel bug, to take control of 25 servers. Some of those servers were Palo Alto Networks firewalls linked to US government-affiliated groups.
What happened
Security firm Dream says suspected Chinese attackers broke into 25 servers starting October 23. The targets were in the US, Japan, Taiwan, and South Korea. The attackers gained full control, called root access, on the servers. Several of them were firewalls, which are devices that guard a network from outside threats. Dream says the attackers likely still have remote access to some victims' networks.
Key facts
- 25 servers were taken over, starting on October 23, 2026.
- The first US government-affiliated firewall crashed after about 900 MB of attack traffic. It then stopped responding to 240 automated checks over two hours.
- The second firewall was broken into on October 24.
- Both PHP2Shell bugs have a severity score of 9.2 out of 10.
- The attackers ran about 40 custom scripts inside the networks they reached. The full attack chain took under 15 minutes.
How the attack worked
The attackers first used PHP2Shell, a flaw that lets outsiders run commands on web servers without logging in. They then used Fragnesia, a Linux kernel flaw, to raise their access to root, the highest level of control. The PHP2Shell exploit was not a copy of any public tool. Dream says it was built for the Palo Alto Networks firewalls. The firewalls ran vulnerable versions of PAN-OS, the company's firewall software.
Why it matters
This attack shows how fast a single weak spot can spread. Once inside one firewall, the attackers moved into the internal network and hit a third server within hours. Government-linked networks are high-value targets, so the risk is serious. Organizations should update their software quickly and check their firewalls for signs of break-in.
What to watch
- Whether Palo Alto Networks releases fixes for the PAN-OS versions that were hit.
- Whether CISA and the FBI share more details. Both declined to comment.
- Whether more PHP2Shell attacks are reported. The article says the first successful attacks began only recently, despite many public proof-of-concept tools.
Glossary
- PHP2Shell
- A flaw in PHP, a common web programming language, that lets outsiders run commands on a server without logging in.
- Fragnesia
- A Linux kernel flaw that lets an attacker gain higher, root-level control of a system.
- Palo Alto Networks
- A company that makes security products, including firewalls that protect computer networks.
- PAN-OS
- The software that runs on Palo Alto Networks firewalls.
- CISA
- The US Cybersecurity and Infrastructure Security Agency, which tracks and warns about cyber threats.
- Dream
- An Israeli AI cybersecurity startup that found and reported this attack.