PHP2Shell exploit attacks breach at least 25 firewalls
An attacker believed to be linked to China combined PHP2Shell with a Linux privilege escalation vulnerability to breach firewall systems in South Korea, the United States, Japan and Taiwan. Three servers in a U.S. government-related environment were heavily targeted, and the attacker accessed firewall configurations and credentials and decrypted LDAP service account passwords to continue attacking internal networks. Breaches of at least 25 Palo Alto Networks firewalls and deployment of root-privilege web shells were confirmed, and the vendor's security team Unit 42 independently confirmed the attack tools and breach results.
Key facts
- Affected organization
- Being confirmed
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- At least 25 firewalls breached
- Cause / method
- Gaining root privileges by combining PHP2Shell with a Linux privilege escalation vulnerability and deploying web shells
- Location
- Other countries
If your data was exposed
Exposed dataPassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- The breach of firewalls and internal management servers of a U.S. government-related agency by an attacker believed to be linked to China emerged.
- Security firm Dream reported the breach of 24 firewalls and a concentrated attack on three servers in a U.S. government-related environment.
- An attack that took control of 25 servers targeting firewall systems in South Korea, the United States, Japan and Taiwan was confirmed.
- Unit 42's independent confirmation of the breach of at least 25 Palo Alto Networks firewalls and the deployment of root-privilege web shells emerged.
5 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.