Chinese hackers leverage PHP2Shell to seize root on dozens of servers, breaching U.S. government‑linked firewalls

Security researchers have confirmed that a Chinese hacking group deployed a newly crafted PHP2Shell exploit to gain root privileges on 25 servers, including firewalls tied to U.S. government agencies. The operation marks the first publicly documented use of PHP2Shell in the wild and demonstrates a sophisticated, multi‑stage intrusion that moved from initial foothold to full control of Active Directory environments.

PHP2Shell is a web‑application backdoor that enables attackers to execute arbitrary PHP code on vulnerable servers. By injecting malicious scripts into poorly secured PHP endpoints, the tool can bypass typical web‑application firewalls and establish a persistent command channel. While variants of PHP shells have been observed for years, the PHP2Shell version identified in this campaign incorporates obfuscation techniques that make detection by conventional scanners more difficult.

The researchers, who chose to remain anonymous, traced the intrusion to a series of compromised domains hosting the malicious payload. Their analysis revealed that the affected organizations shared a common link to U.S. government operations, suggesting a focused targeting effort rather than opportunistic scanning. The initial compromise appeared to stem from credential reuse and outdated PHP modules, providing the attackers with a foothold to upload the PHP2Shell backdoor.

Once the backdoor was in place, the threat actors chained it with a known Linux privilege‑escalation vulnerability, allowing them to elevate their privileges from the web‑server user to the root account. This dual‑exploit approach granted them unrestricted access to the underlying operating system and enabled the creation of hidden persistence mechanisms, such as cron jobs and kernel modules, that could survive system reboots.

With root access secured, the attackers moved laterally across the network, targeting directory services. By compromising Active Directory, they obtained the ability to create privileged accounts, modify group policies, and exfiltrate sensitive data. The depth of the intrusion underscores the risk posed by a single web‑application breach escalating into full‑scale network control, especially when critical infrastructure components like firewalls are involved.

Experts warn that organizations must prioritize hardening of PHP applications, enforce strict credential hygiene, and apply patches for known Linux kernel flaws. Continuous monitoring for anomalous PHP activity and rapid incident response are also essential to thwart similar chains of exploitation. The incident highlights the evolving tactics of state‑aligned actors and the importance of coordinated defense efforts between the private sector and government agencies to mitigate future incursions.