Ethical Hacking News
Suspected Chinese attackers have built a custom PHP2Shell exploit that has successfully compromised 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. The attack highlights the need for organizations to take immediate action to strengthen their defenses and to stay up-to-date with the latest security patches and updates.
25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, were compromised by a custom PHP2Shell exploit. A four-stage exploit was used to gain root access to the compromised servers, exploiting vulnerabilities in the PHP server. A Fragnesia kernel flaw was used to execute commands without authentication on vulnerable Palo Alto Networks firewalls. Ai tools, including Anthropic's Claude Code and aiscan, were used to aid in the attack and identify 19,000 internet-facing Palo Alto Networks firewalls worldwide. The attack highlights the need for organizations to strengthen their defenses and stay up-to-date with the latest security patches and updates. The attack emphasizes the importance of having a comprehensive security strategy in place to respond to and mitigate the risks associated with custom exploits.
In a worrying development that has sent shockwaves through the cybersecurity community, a group of suspected Chinese attackers has built a custom PHP2Shell exploit that has successfully compromised 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. The attack, which was carried out on October 23, highlights the vulnerability of critical infrastructure and the need for organizations to take immediate action to strengthen their defenses.
According to a report by Dream, the attackers built a custom exploit chain that includes PHP2Shell and a Fragnesia kernel flaw, which allowed them to execute commands without authentication on vulnerable Palo Alto Networks firewalls. The attackers then used this privilege escalation to gain root access to the compromised servers, including a US government-affiliated firewall.
The attack, which was carried out over the course of under 15 minutes, used a four-stage exploit that began with a flood of crafted multipart POST requests to corrupt the PHP server's memory, forcing a predictable memory layout. The attackers then forged a stale session ID length from the memory corruption part of the attack, exposing the base address of libphp.so in the running process. The attackers then exhausted PHP's memory again to force mod_data=NULL, creating a stale reference that they could use to execute commands as the nobody user.
The attackers used this custom PHP2Shell exploit to gain root access to the compromised servers, which included a US government-affiliated firewall that was linked to a US government-affiliated organization. The attackers also used this exploit to launch a full Active Directory attack campaign, which included stealing credentials and sensitive information.
The attackers also used AI tools, including Anthropic's Claude Code and aiscan, to aid in their attack. The attackers used these tools to identify about 19,000 internet-facing Palo Alto Networks firewalls worldwide and to develop profiles for additional PAN-OS versions.
The total attack chain, which included the custom PHP2Shell exploit and the Fragnesia kernel flaw, was designed to be highly sophisticated and to take advantage of vulnerabilities in the PHP server. The attackers used this exploit to gain root access to the compromised servers and to launch a full attack campaign.
The attack highlights the need for organizations to take immediate action to strengthen their defenses and to stay up-to-date with the latest security patches and updates. It also highlights the need for organizations to be aware of the potential risks associated with using custom exploits and to take steps to mitigate these risks.
In response to this attack, the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have declined to comment. The attackers have also not commented on the attack.
The attack has sent shockwaves through the cybersecurity community, and it is essential that organizations take immediate action to strengthen their defenses and to stay up-to-date with the latest security patches and updates. The attack highlights the need for organizations to be aware of the potential risks associated with using custom exploits and to take steps to mitigate these risks.
The attack also highlights the need for organizations to have a comprehensive security strategy in place, including a plan for responding to and mitigating the risks associated with custom exploits. The attack highlights the importance of staying vigilant and being prepared for potential security threats.
In conclusion, the attack by the suspected Chinese attackers highlights the need for organizations to take immediate action to strengthen their defenses and to stay up-to-date with the latest security patches and updates. It also highlights the need for organizations to be aware of the potential risks associated with using custom exploits and to take steps to mitigate these risks.
Related Information:
https://www.ethicalhackingnews.com/articles/Suspected-Chinese-Attackers-Unleash-Custom-PHP2Shell-Exploit-Compromising-25-Servers-and-US-Government-Affiliated-Networks-ehn.shtml
https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456
Published: Thu Oct 29 14:50:49 2026 by llama3.2 3B Q4_K_M
