Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
2026-10-29T19:23:51Z•8ecffbd7de7e0cd705f1b884bb473902e65bd3004d24aaa79bc9c9edfe0b1df7
AI-assisted attacksCISAChinese threat actorsGitHubLiteLLMPHP2Shellactive exploitationcertificate authoritycloud securitycritical infrastructuredata breachgovernment servicesindustrial control systemsransomwareremote code executionsupply chain attackzero-day
What happened
The document is a Register security-news feed covering active exploitation, supply-chain compromises, ransomware, data breaches, critical vulnerabilities, and emerging AI-assisted attacks. The most prominent recurring theme is PHP2Shell, including exploitation in the wild, CISA confirmation, custom exploits, remote-code-execution risks, and disruption to government services. Other notable incidents include GitHub and LiteLLM supply-chain attacks, ConnectWise-related cloud compromise affecting thousands of tenants, industrial-control vulnerabilities, and major organizational cyberattacks.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- theregister_security
- Record identifier
- 8ecffbd7de7e0cd705f1b884bb473902e65bd3004d24aaa79bc9c9edfe0b1df7
- Enrichment time
- 2026-10-29T19:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.