Chinese cyber actors use PHP2Shell to obtain root on dozens of servers, breaching firewalls linked to US government

Researchers in security have verified that a Chinese threat actor employed a freshly developed PHP2Shell exploit to obtain root access on 25 machines, among them firewalls associated with U.S. government bodies. This campaign represents the inaugural publicly recorded instance of PHP2Shell being used operationally and showcases a complex, multi‑stage breach that progressed from an initial foothold to complete domination of Active Directory infrastructures.

PHP2Shell functions as a web‑application backdoor that lets attackers run arbitrary PHP code on vulnerable hosts. By slipping malicious scripts into poorly defended PHP endpoints, the tool can evade standard web‑application firewalls and set up a lasting command channel. Although PHP shells have been seen for years, the PHP2Shell variant spotted in this operation uses obfuscation methods that hinder detection by traditional scanners.

The investigators, who opted to stay unnamed, linked the intrusion to a chain of hijacked domains that served the malicious payload. Their review showed that the compromised entities all had ties to U.S. government activities, pointing to a deliberate targeting campaign rather than random scanning. The breach appears to have originated from reused credentials and outdated PHP modules, which gave the attackers a foothold to upload the PHP2Shell backdoor.

After planting the backdoor, the actors combined it with a known Linux privilege‑escalation flaw, enabling them to lift their rights from the web‑server account to the root user. This two‑pronged exploit granted unrestricted system access and allowed the creation of hidden persistence mechanisms—such as cron jobs and kernel modules—that could survive reboots.

With root privileges in hand, the group moved laterally throughout the network, focusing on directory services. By compromising Active Directory, they were able to forge privileged accounts, alter group policies, and siphon confidential information. The depth of this breach highlights how a single web‑application compromise can evolve into full‑scale network control, especially when essential infrastructure like firewalls is affected.

Analysts caution that firms must prioritize hardening of PHP applications, enforce rigorous credential hygiene, and patch known Linux kernel vulnerabilities. Ongoing monitoring for unusual PHP activity and swift incident response are also vital to block comparable exploitation chains. The case underscores the shifting tactics of state‑aligned actors and the need for coordinated defenses between the private sector and government to curb future intrusions.