China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems

• •PHP2Shell vulnerabilities allow unauthenticated remote code execution, affecting many PHP installations.
• •A suspected China-linked actor exploited these vulnerabilities to breach 25 servers, including U.S. government systems.
• •CISA has confirmed active exploitation and set a deadline for federal agencies to apply patches by October 29.

On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25 servers, including three connected to a U.S. government-affiliated organization. The attackers used the vulnerabilities to gain root access to firewalls and deployed webshells for persistent access. The attack involved scanning 19,000 internet-facing firewalls and successfully exploiting 24 of them. The attackers also utilized a Linux kernel privilege escalation vulnerability (CVE-2026-46300) to further their access. CISA added the PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, confirming active exploitation in the wild. Organizations are urged to patch their systems immediately to mitigate risks.