Chinese cyber‑espionage group exploits PHP2Shell to capture root on 25 servers, breaching U.S. government‑linked firewalls

Security researchers have verified that a Chinese hacking outfit employed a newly‑developed PHP2Shell exploit to obtain root privileges on 25 servers, among them firewalls associated with U.S. government agencies. The campaign represents the first publicly recorded deployment of PHP2Shell in the wild and showcases a complex, multi‑stage intrusion that progressed from an initial foothold to full dominance over Active Directory environments.

PHP2Shell functions as a web‑application backdoor, allowing adversaries to run arbitrary PHP code on vulnerable hosts. By inserting malicious scripts into inadequately secured PHP endpoints, the tool can slip past conventional web‑application firewalls and set up a lasting command channel. Although PHP shells have been seen for years, the PHP2Shell variant used here incorporates obfuscation methods that hinder detection by standard scanners.

The unnamed researchers traced the breach back to a chain of compromised domains that hosted the malicious payload. Their investigation showed that the compromised entities all shared a connection to U.S. government operations, indicating a deliberate targeting campaign rather than random scanning. The initial entry point appears to have resulted from credential reuse and outdated PHP modules, giving the attackers a foothold to upload the PHP2Shell backdoor.

After the backdoor was installed, the actors linked it with a known Linux privilege‑escalation flaw, enabling them to raise their rights from the web‑server account to the root user. This two‑pronged exploit granted unrestricted system access and allowed the creation of hidden persistence mechanisms—such as cron jobs and kernel modules—that could survive reboots.

With root privileges secured, the intruders moved laterally across the network, focusing on directory services. By compromising Active Directory, they gained the ability to forge privileged accounts, alter group policies, and siphon sensitive data. The depth of this intrusion highlights the danger of a single web‑application breach escalating into full‑scale network control, especially when critical infrastructure like firewalls is affected.

Experts caution that organisations should prioritize hardening of PHP applications, enforce rigorous credential hygiene, and patch known Linux kernel vulnerabilities. Ongoing monitoring for anomalous PHP activity and swift incident response are also vital to block similar exploitation chains. The episode underscores the evolving tactics of state‑aligned actors and the need for coordinated defence between the private sector and government agencies to curb future incursions.