Cybersecurity researchers have disclosed an AI-assisted attack that exploited PHP2Shell vulnerabilities to breach 25 servers, including three in a U.S. government-affiliated network.
The vulnerability or weakness
The attack leveraged PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) and a kernel privilege escalation exploit (CVE-2026-46300, CVSS 7.8).
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-109619 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-46300 | 7.8 | HIGH | Yes, added 2026-10-28 | 2026-10-31 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
Business impact
The breach could lead to data theft, system compromise, and operational disruptions for affected organizations. Companies using the vulnerable firewall software are at risk.
Industries affected
The incident affects businesses and government entities, particularly those using the specific firewall software.
Users affected
Users of the affected firewall software may have their credentials compromised, leading to potential unauthorized access and data breaches.
