AI-Assisted PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network; CISA Issues Patch Deadline

A suspected China-nexus threat actor has leveraged AI-assisted techniques to exploit PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300), breaching 25 servers, including three within a U.S. government-affiliated environment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these PHP2Shell flaws to its Known Exploited Vulnerabilities catalog, mandating federal civilian agencies to patch by October 29, 2026, due to active exploitation and high risk.