What happened
A chained PHP2Shell exploit compromised 25 servers, including US government systems, according to a Dreamgroup blog post. The story reached 167 points on Hacker News.
What is PHP2Shell?
PHP2Shell describes an attack chain that abuses flaws in PHP-based web applications to run commands on a server and gain shell access. Attackers combine multiple vulnerabilities in sequence to bypass layers of defense.
Why it matters
The incident follows CISA's warning that PHP2Shell flaws are being actively exploited. The involvement of government systems shows the flaws affect critical infrastructure, not just small sites.
What to do
Organizations running PHP-based systems should apply patches without delay, scan server logs for signs of exploitation and review internet-facing services.
