Act
active
PHP2Shell + Kernel Privesc Used to Root 25 Servers Including US Gov Network
- Engineer — Plan: Active nation-state exploitation of PHP2Shell combined with a kernel privilege escalation chain is confirmed as of Oct 25; audit all internet-exposed PHP applications for signs of compromise and track vendor advisories for a specific CVE and patch version.
- SOC/IR — Act: China-nexus actor ran an active campaign on Oct 25 combining PHP webshell deployment with kernel priv-esc — hunt for anomalous PHP process trees, unexpected kernel exploits, and new root-level persistence in web server logs since that date.
- Leader — Learn: A suspected China-nexus threat actor used AI-assisted techniques to breach a US government-affiliated network; useful context for board discussions on AI-enabled adversary tradecraft, but no immediate leadership action required unless your organization has direct government or defense-sector exposure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.