Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

Researchers uncovered a Chinese AI-assisted campaign that exploited vulnerabilities in firewall software to compromise 25 servers globally, including systems in a US government-affiliated environment. The attackers chained together two exploits (PHP2Shell and a kernel privilege escalation) to gain root access without credentials, then targeted Active Directory systems for credential extraction and directory enumeration. Evidence suggests AI tools like Claude and Chinese LLMs were used in the attack infrastructure, though the operation was not fully autonomous.