ATTACKERS BREACH 25 SERVERS USING PHP2SHELL FLAWS

Cybersecurity company Dream said attackers used PHP2Shell flaws and a Linux kernel exploit to gain root access to 25 servers. Dream identified Palo Alto Networks firewalls linked to US government-affiliated organisations among the affected devices. It described the attackers as suspected Chinese actors and said the activity began on 23 October. Dream identified targets in the United States, Japan, Taiwan and South Korea. The company described the intrusions as the first confirmed successful PHP2Shell compromises.

Dream said the attackers compromised one US government-affiliated firewall on 23 October before the device crashed. It remained unresponsive through 240 automated checks over two hours, according to Dream, which cited about 900 MB of exploit traffic as a possible cause. Dream said the attackers compromised a second firewall on 24 October. The affected firewalls ran vulnerable versions of Palo Alto Networks’ PAN-OS software. Within hours of a firewall compromise, the attackers entered an internal network, compromised another server using PHP2Shell and began an Active Directory attack campaign, Dream said.

Dream said the attackers “likely still” have remote access to affected organisations’ networks. It said the attack chain began with “a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet”. PHP2Shell refers to two critical vulnerabilities in PHP that initially had no available patch. Amazon reported attack attempts four days before a patch became available, while Cloudflare counted thousands of attempts in the 10 hours before its announcement. Cloudflare said its tally reached tens of thousands within an hour of disclosure and hundreds of thousands within two hours.