Cybersecurity experts have unveiled details about a sophisticated cyberattack facilitated by artificial intelligence (AI), believed to be executed by a China-linked threat group. This attack exploited PHP2Shell vulnerabilities, compromising several systems.
Details of the Cyberattack
On October 25, 2026, attackers utilized PHP2Shell alongside a kernel privilege escalation exploit to gain control of 25 servers. Among these, three were part of a U.S. government-affiliated network. The affected devices were running particular versions of a major vendor’s firewall software. Dream, the cybersecurity firm that identified the incident, reported that the attackers targeted Active Directory, extracting credentials and mapping out directories.
While the vendor’s identity remains undisclosed, Dream confirmed notification of the entity. The attack leveraged two critical vulnerabilities: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel flaw, Fragnesia (CVE-2026-46300). These vulnerabilities allowed unauthenticated remote code execution and privilege escalation, respectively.
Attack Methodology and AI Involvement
The attack was characterized by a custom build, not derived from any known public exploit, specifically designed for the targeted firewall platform. It manipulated PHP’s session.upload_progress feature on the firewall’s management server, which used PHP 8.0.30 with high memory limits, enabling memory corruption.
The attackers reportedly used AI tools, including Anthropic’s Claude Code and aiscan, to streamline their operations. The tools facilitated identifying nearly 19,000 internet-facing firewalls, filtering them to locate 240 viable targets based on specific criteria like PHP version and geographic location.
Implications and Strategic Intentions
The attack resulted in the successful rooting of 25 servers across the U.S., Japan, Taiwan, and South Korea. Artifacts suggest that the attackers developed the exploit in a controlled environment before gaining persistent access to a U.S. government network. AI-assisted processes were integral to the operation, evidenced by the structured code and use of large language models (LLMs).
The attackers’ strategic focus on these countries aligns with their status as key adversaries in the Pacific region, suggesting potential nation-state involvement. The operation highlighted vulnerabilities in exposed management interfaces, which could jeopardize an organization’s identity infrastructure.
Despite the scale of the attack, the PHP2Shell vulnerabilities remain underexploited globally. Challenges persist in translating proof-of-concept exploits into effective tools against real-world targets due to the unique nature of each build’s offsets, as noted by cybersecurity forums.
The ongoing threat underscores the need for vigilance and robust cybersecurity measures, as attackers still have numerous identified targets that they can explore as they refine their techniques and tools.
