PHP2Shell exploit compromises 25 servers
The gist
Israeli firm Dream reported a chained PHP2Shell attack compromised 25 servers, including a US government-affiliated firewall.
The flaws allow unauthenticated remote code execution, so patching exposed firewalls is urgent.
How it unfolded
- Oct 17, 2026PHP2Shell was made public; Amazon Threat Intelligence reported exploitation attempts in its MadPot honeypot network beginning this date, before public disclosure.
- Oct 23, 2026Attackers began exploiting servers targeting organizations across the US, Japan, Taiwan and South Korea; hackers used FOFA to identify 19,000 internet-facing firewalls from a specific vendor.
- Oct 23, 2026The first US government-affiliated firewall was rooted; it crashed shortly afterward, possibly due to around 900 MB of exploit traffic, and stayed unresponsive despite 240 automated checks over two hours.