Chinese-linked Hacker Breaches U.S. Government Firewalls Using Chained PHP2Shell Exploit

Security researchers have identified a cyber intrusion in which a suspected actor with ties to China obtained root privileges on Palo Alto Networks firewall devices used by U.S. government agencies. The breach, uncovered by the firm Dream, relied on a chained PHP2Shell exploit to bypass the firewalls' defenses and gain full control of the underlying servers.

Dream's investigation revealed that the threat group first compromised a web‑application server that exposed a vulnerable PHP interpreter. By chaining a publicly known PHP2Shell payload with additional custom scripts, the attackers escalated their privileges, eventually obtaining root access on the firewall management plane. Once inside, they were able to modify security policies, intercept traffic, and potentially exfiltrate data from the protected networks.

The PHP2Shell exploit, originally released as an open‑source web‑shell, enables remote code execution on systems where PHP is improperly configured. In this case, the attackers combined the shell with a series of privilege‑escalation techniques to move laterally from a low‑privilege web service to the high‑value firewall infrastructure. Such chaining of exploits is a hallmark of sophisticated adversaries who seek to maximize impact while minimizing detection.

Root access to Palo Alto firewalls is particularly concerning because these devices sit at the perimeter of an organization’s network, controlling inbound and outbound traffic. Compromise of the firewall can allow an intruder to reroute or inspect communications, insert malicious code, and hide further activity within the network. The incident appears to have targeted multiple government entities, although the exact scope of data accessed has not been disclosed.

The operation fits a broader pattern of cyber activity attributed to state‑aligned groups from China, which have previously leveraged supply‑chain compromises and zero‑day vulnerabilities against both private and public sector targets. Analysts note that the use of a publicly available web‑shell, rather than a custom zero‑day, suggests the attackers prioritized speed and stealth over the development of novel exploits.

Palo Alto Networks issued an emergency advisory urging customers to apply the latest firmware updates and review firewall configurations for signs of unauthorized access. U.S. cybersecurity agencies have opened investigations to assess the full impact and to determine whether additional systems have been affected. Organizations are being advised to monitor for anomalous admin activity and to enforce multi‑factor authentication for privileged accounts.

Experts warn that the incident underscores the importance of hardening web‑facing services and regularly auditing network‑security appliances. As threat actors continue to chain existing tools to breach high‑value assets, the cybersecurity community is likely to see increased emphasis on rapid patch deployment and continuous monitoring to detect similar intrusion pathways before they can be exploited further.