PHP2Shell + Kernel Privesc Used to Root 25 Servers Including US Gov Network

Wed, 28 Oct 2026 17:09:30 +0000

Engineer — Plan: Active nation-state exploitation of PHP2Shell combined with a kernel privilege escalation chain is confirmed as of Oct 25; audit all internet-exposed PHP applications for signs of compromise and track vendor advisories for a specific CVE and patch version.
SOC/IR — Act: China-nexus actor ran an active campaign on Oct 25 combining PHP webshell deployment with kernel priv-esc — hunt for anomalous PHP process trees, unexpected kernel exploits, and new root-level persistence in web server logs since that date.
Leader — Learn: A suspected China-nexus threat actor used AI-assisted techniques to breach a US government-affiliated network; useful context for board discussions on AI-enabled adversary tradecraft, but no immediate leadership action required unless your organization has direct government or defense-sector exposure.

China-Nexus on CuraSec