US Government Networks Targeted via PHP2Shell Vulnerability

A new threat has emerged in the cybersecurity landscape: researchers report that hacker groups have successfully utilised the PHP2Shell vulnerability for the first time to breach servers and firewalls associated with US government organisations. The targeted campaign has resulted in the compromise of at least 25 servers.

The PHP2Shell Threat

PHP2Shell consists of two critical vulnerabilities discovered within the PHP programming language. Given that approximately 70% of websites on the internet are built using this language, the discovery initially caused significant alarm. While experts initially feared that hackers would use it for mass attacks, no successful cyberattacks were recorded for some time. Nevertheless, cybersecurity specialists warned that it was only a matter of time.

Attack Mechanism

In this instance, attackers employed a sophisticated tactic: they combined PHP2Shell with a Linux kernel privilege escalation flaw known as Fragnesia (CVE-2026-46300). This combination allowed them to infiltrate the management panels of Palo Alto Networks firewalls and gain full root access to the systems.

The attacks began on 23 October 2026, impacting the US, Japan, Taiwan, and South Korea. Hackers utilised the FOFA search engine to identify Palo Alto Networks devices running vulnerable versions. According to experts, the entire process—from the initial insecure HTTPS request to gaining persistent system access—takes less than 15 minutes.

Aftermath of the Attack

Once inside the network, the attackers deployed approximately 40 specialised post-exploitation scripts. Within hours, they were able to penetrate internal networks and launch a full-scale attack against Active Directory, the service that manages access to network resources. While the specific intent of the attackers remains unknown, researchers suspect the primary goal is data theft and the establishment of a persistent presence within the system.

Interestingly, the attack was not fully automated. Although the hackers utilised artificial intelligence tools such as Claude Code and the Chinese models DeepSeek and Kimi, the operation still required human intervention. This incident underscores the urgent need for timely system updates and stricter security policies, particularly regarding critical infrastructure connected to the internet.