Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.

The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U. S. government-affiliated environment.

"The affected devices run specific versions of a large vendor's firewall software," cybersecurity firm Dream said . "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."

The name of the affected vendor was not disclosed, but the Israeli company said it notified the entity.

The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel - "The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell," Dream researchers explained.

"It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform." "The vulnerability targets PHP's session. upload_progress mechanism on the firewall's appweb management server. The firewall OS uses PHP 8. 0.

30 with a high memory limit that enables the memory corruption stages of the attack." The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U. S. , Japan, Taiwan, and South Korea.

Artifacts discovered by Dream indicate that the operation started with exploit development in a lab environment before obtaining persistent access to a U. S. government organization's internal Active Directory domain. "Once rooted, the attacker zeroed in on three specific servers in a U. S.

government-affiliated environment," the company noted.

The links to AI-assisted tooling stem from evidence pointing to the installation of Anthropic's Claude Code in the attack infrastructure, along with the presence of API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.

What's more, the code structure, commenting style, and consistency across nearly 40 scripts suggest the use of AI to augment the development process.

The entire operation, per Dream, unfolds as follows - It's unclear if the activity allowed the threat actor to successfully find valid credentials or create backdoor accounts. As a result, the full extent of the compromise remains indeterminate. "Since [the] U. S.

, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts," Dream said.

The disclosure comes as the PHP2Shell vulnerabilities have witnessed only limited exploitation in the wild, with threat actors highlighting the challenges in converting a proof-of-concept (PoC) into a reliable attack vector against real targets despite integrating them into their campaigns .

"In practice it's unexploitable crap. To exploit real targets you need the offsets from libphp. so, which are unique to every build and impossible to brute-force.

You can reproduce it on your own test bench, or if you already have access to the target's file system," a member who goes by the handle c0d3x on the XSS forum said, according to Flare .

Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities.

Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar.