Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Summary
Suspected Chinese attackers have reportedly developed and utilized a custom PHP2Shell exploit. This exploit has been used to gain root access to at least 25 servers, with ongoing suspicion that attackers may still have access to a US government-affiliated network.
IFF Assessment
The discovery of a custom exploit and unauthorized server access by suspected state-sponsored actors represents a significant threat to network defenders.
Defender Context
This incident highlights the sophistication of nation-state threat actors and their ability to develop custom tools like PHP2Shell for targeted attacks. Defenders should remain vigilant for unusual network activity and ensure robust patching and intrusion detection measures are in place, particularly for systems exposed to potential state-sponsored threats.