China-Nexus Attack Using PHP2Shell Breaches U.S. Government-Affiliated Network

# China-Nexus Attack Using PHP2Shell Breaches U.S. Government-Affiliated Network

https://gcdradar.vercel.app/incidents/china-nexus-attack-using-php2shell-breaches-u-s-government-a · AIR-2026-1621 · closed 2026-11-11

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation and intrusion against a real target network.
- Fix status: No fix needed
- First reported: 2026-10-28 (happened 2026-10-25)
- AI role: No AI role
- Products: PHP2Shell

## Summary

Threat actors exploited PHP2Shell vulnerabilities and combined them with a kernel privilege escalation exploit to compromise 25 servers in a network with U.S. government affiliation. The activity was identified by cybersecurity researchers as part of an active campaign.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-28: PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network (https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html)

## Sources

- 2026-10-28 The Hacker News: PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.