Cybersecurity firms flag limited PHP2Shell exploits and suspected Chinese intrusion of U.S. government‑linked servers

Two cybersecurity firms have independently reported a small but notable wave of attacks leveraging the PHP2Shell vulnerability, a flaw that allows remote code execution on vulnerable web servers running outdated PHP versions.

The first firm disclosed that it has observed roughly six distinct exploit attempts targeting the PHP2Shell bug across a variety of websites, suggesting that threat actors are actively scanning for and compromising unpatched installations. While the incidents appear isolated, the firm cautioned that even limited exploitation can lead to data theft, defacement, or the deployment of additional malware.

In a separate investigation, a second security company identified a well‑coordinated intrusion campaign that appears to be linked to a Chinese threat group. The operation focused on servers described as "government affiliated" in the United States, achieving footholds that could enable espionage or the manipulation of sensitive information.

Both reports were initially highlighted by The Record, which noted that the Chinese‑linked campaign employed sophisticated phishing and credential‑stuffing techniques before leveraging the PHP2Shell vulnerability to establish persistence. The attackers’ choice of high‑value, government‑related targets underscores a strategic interest in gathering intelligence rather than indiscriminate disruption.

Experts say the convergence of a known PHP flaw with a state‑sponsored intrusion effort illustrates a broader trend: adversaries are repurposing publicly disclosed vulnerabilities to achieve targeted objectives. The PHP2Shell bug, first publicized in early 2023, remains exploitable on systems that have not applied the recommended patches or upgraded to supported PHP releases.

Officials from U.S. cyber‑defense agencies have not publicly confirmed the breach but have urged organizations, especially those handling government data, to audit their web infrastructure, apply the latest security updates, and monitor for anomalous activity. As the investigations continue, the incidents serve as a reminder that even limited exploit activity can have outsized implications when coupled with sophisticated, state‑backed actors.