Chinese hackers breach 25 servers using custom PHP2Shell exploit

Summarised from 2 outlets · Updated 30 Oct, 16:18 · Archive

Chinese attackers have exploited the PHP2Shell vulnerability to breach 25 servers, some belonging to US government-affiliated organisations.

Cybersecurity firm Dream has confirmed the first successful exploits of the PHP2Shell vulnerability, which affects critical flaws in PHP. Chinese attackers used the vulnerability chained with a Linux kernel privilege-escalation flaw against Palo Alto Networks firewalls running outdated operating systems. According to TechRadar's reporting, the attack successfully breached 25 servers, some belonging to organizations affiliated with the US government.

PHP2Shell refers to two critical-severity vulnerabilities in PHP, a language that powers roughly 70% of all websites and web apps on the internet. When first disclosed earlier this month, no patch was available. Amazon and Cloudflare observed thousands of exploitation attempts before a patch was released, but researchers initially found no successful breaches. Some analysts attributed this to technical obstacles, including Address Space Layout Randomization, a security feature that randomly changes where a program's code and data are stored in memory. However, security researchers had warned that successful attacks were likely inevitable.

The Register reports that attackers are 'likely still' in possession of access to the US government-affiliated network they compromised. TechRadar indicates that the attackers targeted Palo Alto Networks firewalls specifically, combining the PHP2Shell exploit with an additional Linux kernel flaw to achieve their objective.

How it is being reported

• Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewallsPalo Alto Networks firewalls running outdated OS seem to be the target, as Chinese hackers chain PHP2Shell to Fragnesia for the campaign.TechRadar · 30 Oct, 16:05
• Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 serversSnoops 'likely still' have access to US government-affiliated networkThe Register · 29 Oct, 19:05

In this story: Chinese · Dream · Palo Alto Networks · US government · PHP · Amazon · Cloudflare

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log