Case php2shell-ai-assisted-us-gov-networkAI-assisted malwareUnited States
AI-assisted PHP2Shell attack roots 25 servers, breaches US government-affiliated network
Dream researchers say an apparently AI-assisted attack, attributed only as a suspected China-nexus actor, chained a custom PHP2Shell exploit with the Fragnesia Linux kernel flaw (CVE-2026-46300) to root 25 firewall servers across the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment, then targeted Active Directory; activity was observed on 25 Oct 2026 and the full extent of compromise is indeterminate. The AI link rests on Claude Code installed on attacker infrastructure, API keys for an AI offensive platform and AI-style scripts.
HighAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 25, 2026
- Location
- United States
- Target
- Exposed PHP servers; US government-affiliated network
- Severity
- High
- Verification
- Reported by credible press or researchers
- Triggered by
- Suspected China-nexus threat actor
- Actor type
- Unknown
- Sector
- Government & public sector
- Reported loss
- None reported
- CVE
- None
What happened
Dream researchers say an apparently AI-assisted attack, attributed only as a suspected China-nexus actor, chained a custom PHP2Shell exploit with the Fragnesia Linux kernel flaw (CVE-2026-46300) to root 25 firewall servers across the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment, then targeted Active Directory; activity was observed on 25 Oct 2026 and the full extent of compromise is indeterminate. The AI link rests on Claude Code installed on attacker infrastructure, API keys for an AI offensive platform and AI-style scripts.
Impact: 25 servers rooted and a US government-affiliated network breached.
Who triggered it
Actor: Suspected China-nexus threat actor
Attribution: Suspected China-nexus actor, per cybersecurity researchers cited by The Hacker News; not confirmed.
Motive: Unknown
How it happened
Attack vector: Exploitation of PHP2Shell vulnerabilities in exposed systems, apparently with AI assistance.
Root cause: Vulnerable, internet-exposed PHP systems exploited using AI-assisted tooling.
Timeline
- Reported by The Hacker News
Response
Researchers disclosed details of the activity; no other response stated.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Dream Security dreamgroup.com
- The Register theregister.com
Cite this case
AI-assisted PHP2Shell attack roots 25 servers, breaches US government-affiliated network. AI Threat Watch, case php2shell-ai-assisted-us-gov-network, Oct 25, 2026. https://aithreat.io/cases/php2shell-ai-assisted-us-gov-network/
Permanent link: https://aithreat.io/cases/php2shell-ai-assisted-us-gov-network/
Related cases
The same type of incident, most recent first.