Cybersecurity researchers have disclosed what appears to be an AI-assisted attack by a suspected China-nexus threat actor that used the PHP2Shell vulnerabilities to breach exposed systems, according to a report from Israeli firm Dream covered by The Hacker News on 28 October. The activity, observed on 25 October 2026, combined PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including three systems in a US government-affiliated environment. The affected devices run specific versions of a large vendor's firewall software, whose name was not disclosed, although Dream said it had notified the entity.

From flaw to rooted servers

Once inside, the attacker launched attacks against Active Directory, and recovered artefacts confirm credential extraction and directory enumeration, Dream said. The two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2, allow unauthenticated remote code execution on PHP installations serving web requests, and were patched on 21 October in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The US Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalogue on 26 October, giving federal civilian agencies until Thursday 29 October to fix affected systems, after saying on 21 October that it had not observed exploitation.

Two attributions, kept separate

Attribution in the wider reporting is not uniform and should not be merged: Dream links the server-rooting campaign to a suspected China-nexus actor, while a separate Cyfirma analysis links scanning of 216 vulnerable hosts to a suspected North Korean campaign that uses AI to rank public exploits. The two reports describe different activity around the same flaws. This disclosure follows the KEV listing itself, which was already reported; the new fact here is the observed rooting of 25 servers, not the existence of the flaws. Organisations running internet-facing PHP should patch and check for signs of compromise rather than assuming the patch alone closes the incident.

Sources: The Hacker News (Dream research) and MLQ News (CISA KEV).