Suspected China-Linked Intruders Root 25 Servers in Government-Tied Network

Key points

• Intrusion identified on 29 October 2026 in a government-tied network.
• Twenty-five server systems were compromised with root-level control.
• Attackers used PHP2Shell and a custom exploit; no CVE was assigned.
• Long-term access raises risks of lateral movement and persistence.

On 29 October 2026, an intrusion was identified in a network connected to government operations. Investigators suspect China-linked threat actors were responsible. The intruders compromised twenty-five server systems, crafted a bespoke exploit, and gained root-level control on the machines. They also kept a foothold after the initial compromise, indicating a deliberate effort to maintain a long-term presence.

The affected environment is a government-affiliated network, so the incident carries significance beyond the individual hosts. Once attackers hold root on servers, they can alter system trust, access credentials and secrets, and move laterally into other parts of the estate. Even where no data theft has been confirmed, administrators should treat every rooted machine as untrusted until it is rebuilt and validated.

No CVE identifiers were tied to this incident. That matters because signature-based patching and vulnerability scanners may not provide a complete defense against a custom exploit. The use of PHP2Shell tooling alongside a tailored exploit suggests a targeted operation rather than opportunistic scanning. Defenders should focus on behavioral detection, host integrity checks, and rapid containment rather than waiting for a vendor advisory.

What to watch: unexpected PHP process activity, new services or scheduled tasks, root-level file changes, anomalous outbound connections, and authentication patterns that suggest credential misuse. Organizations should also review logs for signs of lateral movement and persistence. Because the intruders retained access, cleaning malware alone is insufficient; affected servers should be rebuilt from trusted images and all credentials rotated.

This case reinforces the need for network segmentation, least privilege on server accounts, and centralized logging that can survive host compromise. IT teams should preserve evidence, coordinate with cyber authorities, and brief leadership on containment status. The priority is to evict the adversary, restore trusted systems, and prevent re-entry.

What to do now

1. Isolate the twenty-five affected servers and preserve forensic images before any rebuild or cleanup.
2. Hunt across the estate for PHP2Shell artifacts, custom exploit traces, suspicious PHP processes, new services, cron jobs, and startup entries.
3. Rebuild rooted hosts from trusted images, then rotate all passwords, keys, tokens, and service-account secrets.
4. Review authentication and network logs for lateral movement, reset privileged accounts, and enforce MFA where possible.
5. Segment server networks and restrict outbound traffic to reduce the adversary's ability to retain access or pivot.
6. Audit PHP-facing services and configurations, apply available hardening, and monitor closely for re-entry attempts.
7. Brief leadership and coordinate with cyber authorities while maintaining an incident timeline and containment record.

Original source

The Register — Security