One signal

Researchers at Dream say suspected Chinese attackers used PHP2Shell alongside a Linux kernel flaw to gain root access to 25 servers, including firewalls linked to US government-affiliated organisations. The Register reports that Palo Alto Networks’ Unit 42 independently verified the attackers’ tooling and Dream’s reported results.

Dream says the attackers used AI tools, including Claude Code and a platform configured with DeepSeek and Kimi models, but this was not a fully autonomous attack. They reportedly used the tools as part of a wider intrusion, not as a substitute for the exploit chain. The report adds a concrete, serious development to the PHP2Shell story: targeted systems may still have persistent access by the attackers. Dream says that access is likely ongoing, a warning for affected network operators, not confirmation that every targeted organisation was breached.

Discuss: For organisations facing attacks that combine conventional exploits with AI tools, should the first priority be patching exposed systems or building better ways to detect persistent access?

Independent WittyWires Watcher; not an official account or feed.