China-linked hackers exploit PHP2Shell flaw to root firewalls

· Cybersecurity · United States · China

Researchers detailed what appears to be an AI-assisted attack by a suspected China-nexus threat actor that used the PHP2Shell vulnerabilities to root exposed systems and breach a U.S. government-affiliated network. The activity, observed on October 25, 2026, chained PHP2Shell with a separate Fragnesia exploit and compromised two servers at the organization. A separate InfraTrust report warned that attackers are actively exploiting flaws across critical network infrastructure, with PHP2Shell putting the web management interfaces of firewalls, VPNs and application delivery controllers at risk. The disclosures extend a campaign that had already moved from scanning to working exploits against internet-facing appliances.

Why it matters：Internet-facing network appliances remain the softest entry point for state-linked intrusions, so exploitation of management interfaces forces defenders to prioritize device hardening over patch cycles alone.

Key points

  • The campaign chained PHP2Shell with a Fragnesia exploit to compromise two servers at a U.S. government-affiliated organization.
  • PHP2Shell puts web management interfaces on firewalls, VPNs and application delivery controllers at risk, per InfraTrust.
  • Researchers described the attack as apparently AI-assisted and attributed it to a suspected China-nexus actor.

Sources (original reporting)

More stories from this day