News
cybersecurity Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster - Aikido Security cybersecurity Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - BleepingComputer ai Creating AI value with enterprise context - MIT Technology Review cybersecurity Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - Wired Security cybersecurity Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - Wired Security cybersecurity Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - The Hacker News threat-intel OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery - GBHackers cybersecurity Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. - The Hacker News cybersecurity Cloudflare Image Transformation Flaw Could Let Hackers Execute Malicious JavaScript on Websites - CyberPress cybersecurity Sony ISP subsidiary data breach exposes 2.5 million customer records - BleepingComputer cybersecurity Introducing Agent Activity: See What Your AI Agents Are Actually Doing - OX Security cybersecurity PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - The Hacker News cybersecurity Volt Typhoon hides zero-day attacks using 'Silent Train' framework - BleepingComputer ai Anthropic's unreleased AI model builds working exploits for Chrome, Safari, Windows, Linux and Android - Pasquale Pillitteri - Anthropic - Claude AI cybersecurity Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - SecurityWeek
1 / 15
All news ›
Cybersecurity

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

The Hacker News ·

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.