{"id":61684,"date":"2026-10-29T19:05:17","date_gmt":"2026-10-29T19:05:17","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5306456"},"modified":"2026-10-29T19:05:17","modified_gmt":"2026-10-29T19:05:17","slug":"suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/","title":{"rendered":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers"},"content":{"rendered":"
<\/div>\n

<\/p>\n

Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers.<\/p>\n

The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls.<\/p>\n

\u201cWithin hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign – all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,\u201d the Israeli AI cybersecurity startup said<\/a> in a report. <\/p>\n

Plus, the attackers \u201clikely still\u201d have persistent, remote access to compromised organizations\u2019 networks, Dream noted.<\/p>\n

The attackers rooted the first US government-affiliated firewall on October 23, but the device crashed shortly afterward, possibly due to around 900 MB of exploit traffic. According to Dream, it remained unresponsive despite 240 automated checks over two hours. They successfully exploited the second firewall a day later, on October 24.<\/p>\n

The compromised firewalls ran vulnerable versions of Palo Alto Networks’ PAN-OS. Dream said it had been working with the vendor to investigate the compromises, and Palo Alto Networks’ Unit 42 researchers independently verified<\/a> the attacker’s tooling and confirmed Dream’s reported results.<\/p>\n

To break into the firewalls, the attackers built a custom exploit chain that includes PHP2Shell and a Fragnesia kernel flaw, and ran about 40 custom post-exploitation scripts once they were inside the targeted organizations.<\/p>\n

Total attack chain in under 15 minutes <\/h3>\n

PHP2Shell<\/a>, comprised of CVE-2026-109618 and CVE-2026-109619, came to light<\/a> early last week, along with fears that attackers<\/a> would abuse the bugs to take down most of the internet<\/a>. Despite \u201chundreds\u201d of PHP2Shell proof-of-concept repositories<\/a> on GitHub, the first reports of successful attacks<\/a> didn\u2019t start until Saturday.<\/p>\n

Both bugs have CVSS scores of 9.2 and can be exploited without authentication to run code on vulnerable PHP servers.<\/p>\n

The PHP2Shell exploit recovered by Dream was not a copy of any known public exploit. It \u201cappears to have been independently developed and tailored specifically for the targeted firewall platform,\u201d the researchers wrote.<\/p>\n

The attackers combined PHP2Shell with Fragnesia (CVE-2026-46300<\/a>), a high-severity local privilege-escalation vulnerability affecting the Linux kernel’s XFRM ESP-in-TCP subsystem. The US Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> this Linux kernel bug to its catalog of Known Exploited Vulnerabilities on Wednesday.<\/p>\n

Both CISA and the FBI declined to comment.<\/p>\n

The miscreants developed a four-stage PHP2Shell exploit that allowed them to execute commands without authentication on vulnerable Palo Alto Networks firewalls. They then used Fragnesia to escalate their privileges and gain root access. The attackers targeted PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that enabled the exploit’s memory-corruption stages.<\/p>\n

\u201cThe total chain – from unauthenticated HTTPS connection to persistent root webshell – completes in under 15 minutes,\u201d the Dream team wrote.<\/p>\n

4 steps to root<\/h3>\n

Here\u2019s how it works: First, they flood the servers with crafted multipart POST requests to corrupt PHP\u2019s memory, and force a predictable memory layout. <\/p>\n

Then a second request forges the stale session ID length from the memory corruption part of the attack, forcing an out-of-bounds read and exposing the base address of libphp.so in the running process.<\/p>\n

The attackers then exhaust PHP’s memory again to force mod_data=NULL, creating a stale reference they can forge in the final stage to execute commands as the nobody user. They use Fragnesia to escalate to root and plant a web shell in a publicly accessible directory on the firewall.<\/p>\n

After breaking in via the compromised firewalls, the attackers snooped around in Active Directory, stealing credentials and other sensitive information. With root access, the attackers also had the master key to decrypt the LDAP service account password, which they hardcoded into every subsequent script.<\/p>\n

They also enumerated every user and group in the domain via LDAP queries, and sprayed passwords against every user account. Attackers also tried to create backdoor AD accounts and attempted SAML signing key extraction – but Dream doesn\u2019t know if these were successful.<\/p>\n

\u201cThe attack results – whether the password spray found valid credentials, whether the backdoor accounts were created, whether SAML keys were extracted – stayed on the management server’s local filesystem and were not among the artifacts we recovered,\u201d the researchers noted.<\/p>\n

AI tools in the attack<\/h3>\n

The investigation also uncovered evidence that the attackers used AI tools, but noted that this was not a fully autonomous attack. <\/p>\n

The researchers found Anthropic’s Claude Code installed, an AI-powered offensive security platform called aiscan configured with Chinese models DeepSeek and Kimi, and API keys for the FOFA reconnaissance service. FOFA is a Chinese internet asset search engine similar to Shodan. The attackers used it to identify about 19,000 internet-facing Palo Alto Networks firewalls worldwide.<\/p>\n

\u201cThe persistent tunnel into the US government organization is likely still running,\u201d Dream warned. \u201cAnd the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional PAN-OS versions.\u201d\u00ae<\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Snoops ‘likely still’ have access to US government-affiliated network READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":61685,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[307],"class_list":["post-61684","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register","tag-security"],"yoast_head":"\nSuspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-29T19:05:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/image.theregister.com\/5304691.jpg?imageId=5304691&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers\",\"datePublished\":\"2026-10-29T19:05:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/\"},\"wordCount\":873,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg\",\"keywords\":[\"Security\"],\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/\",\"name\":\"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg\",\"datePublished\":\"2026-10-29T19:05:17+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg\",\"width\":100,\"height\":70},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/","og_locale":"en_US","og_type":"article","og_title":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2026-10-29T19:05:17+00:00","og_image":[{"url":"https:\/\/image.theregister.com\/5304691.jpg?imageId=5304691&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers","datePublished":"2026-10-29T19:05:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/"},"wordCount":873,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/11\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg","keywords":["Security"],"articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/","url":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/","name":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/11\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg","datePublished":"2026-10-29T19:05:17+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/11\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/11\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers.jpg","width":100,"height":70},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.threatshub.org\/blog\/tag\/security\/"},{"@type":"ListItem","position":3,"name":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=61684"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61684\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/61685"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=61684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=61684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=61684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}