{"id":2417,"date":"2026-10-29T10:30:15","date_gmt":"2026-10-29T05:00:15","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2417"},"modified":"2026-10-30T08:36:44","modified_gmt":"2026-10-30T03:06:44","slug":"php2shell-active-directory-breach","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/","title":{"rendered":"PHP2Shell Active Directory Breach: 25 Servers Compromised"},"content":{"rendered":"<p>A newly reported PHP2Shell Active Directory breach has revealed how attackers used critical PHP vulnerabilities to compromise 25 servers and target enterprise identity infrastructure. According to Dream Research, a suspected China-linked operator combined PHP2Shell with a Linux kernel privilege-escalation exploit to gain root access to firewall systems.<\/p>\n<p>The campaign affected servers across the United States, Japan, Taiwan, and South Korea, including three systems associated with a U.S. government-affiliated environment. Researchers recovered evidence of<a href=\"https:\/\/www.hexnode.com\/blogs\/what-is-lightweight-directory-access-protocol-ldap\/\"> LDAP<\/a> credential extraction and Active Directory enumeration, raising concerns about the consequences of compromised network-management infrastructure.<\/p>\n<h2>How did attackers compromise 25 servers?<\/h2>\n<p>Dream Research uncovered the campaign on October 25, 2026, after recovering exploitation logs, custom tools, and approximately 40 post-exploitation scripts.<\/p>\n<p>The investigation reconstructed the following sequence:<\/p>\n<ul>\n<li><strong>Initial reconnaissance:<\/strong> Attackers identified approximately 19,000 internet-facing firewalls, fingerprinted around 5,000 responding devices, and narrowed the list to 240 targets based on location and software versions.<\/li>\n<li><strong>October 23:<\/strong> An automated exploitation campaign compromised 24 firewalls. One government-affiliated firewall crashed shortly after exploitation.<\/li>\n<li><strong>October 24:<\/strong> Attackers compromised another government-affiliated firewall and established a persistent reverse SSH tunnel into its internal network.<\/li>\n<li><strong>Internal compromise<\/strong>: Attackers used the reverse SSH tunnel to compromise an internal firewall management server, increasing the total to 25 rooted systems: 24 perimeter firewalls and one management server.<\/li>\n<\/ul>\n<p>The affected firewall vendor and software versions remain undisclosed. Dream Research stated that it notified the vendor.<\/p>\n<div class=\"next_blog\"><div class=\"post-next\"><div class=\"hex_blog_box_parent\"><div class=\"blog_warp_next\"><div class=\"next_blog_thumb\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-vulnerability.jpeg?format=webp)\"><\/div><div class=\"next_post_content\"><div class=\"center_box\"><h4>PHP2Shell Vulnerability: Critical PHP Flaws Trigger Global Security Alert<\/h4><p>Explore PHP2Shell vulnerabilities, exploitation attempts, affected systems, and security updates.<\/p><\/div><\/div><\/div><a class=\"hex_blog_box_link hn-cta__blogs--blog-box\" href=\"https:\/\/www.hexnode.com\/threat-watch\/php2shell-vulnerability-critical-php-rce\/\" aria-label=\"PHP2Shell Vulnerability: Critical PHP Flaws Trigger Global Security Alert\"><\/a><\/div><\/div><\/div>\n<h2>How did PHP2Shell and Fragnesia enable root access?<\/h2>\n<p>The attackers combined PHP2Shell remote code execution with Fragnesia kernel privilege escalation in an automated <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-exploit-chain\/\">exploit chain<\/a> that could establish root access through a single unauthenticated HTTP request.<\/p>\n<ul>\n<li><strong>PHP2Shell (CVE-2026-109618 and CVE-2026-109619):<\/strong> A custom exploit targeted PHP&#8217;s session upload-progress processing, manipulating memory to achieve remote code execution under the restricted nobody account.<\/li>\n<li><strong>Fragnesia (CVE-2026-46300):<\/strong> Attackers exploited a Linux kernel <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-vulnerability-in-cybersecurity\/\">vulnerability<\/a> in the XFRM ESP-in-TCP subsystem to overwrite PAM authentication rules, enabling passwordless privilege escalation to root.<\/li>\n<\/ul>\n<p>The combined attack enabled root access without valid credentials. Attackers subsequently deployed webshells and persistence mechanisms to maintain control over compromised systems.<\/p>\n<p>Dream Research reported that the complete exploitation chain could establish persistent root access in under 15 minutes.<\/p>\n<h2>How did the attackers target Active Directory?<\/h2>\n<p>After compromising the firewall management infrastructure, the attackers shifted their attention to the organization&#8217;s identity systems.<\/p>\n<p>They established a reverse SSH tunnel that provided access to internal resources, including domain controllers and authentication infrastructure.<\/p>\n<p>Recovered artifacts confirmed LDAP credential extraction and Active Directory enumeration, while additional scripts revealed attempts to compromise accounts and authentication infrastructure.<\/p>\n<ul>\n<li><strong>Credential extraction:<\/strong> Attackers decrypted an LDAP service-account password from the compromised management server.<\/li>\n<li><strong>Directory enumeration:<\/strong> LDAP queries exposed Active Directory user and group information.<\/li>\n<li><strong>Password spraying:<\/strong> Attackers attempted authentication using organization-themed passwords across domain accounts.<\/li>\n<li><strong>Backdoor attempts:<\/strong> Scripts attempted to create unauthorized user and machine accounts.<\/li>\n<li><strong>Identity-provider targeting:<\/strong> Attackers attempted to extract <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-security-assertion-markup-language-saml\/\">SAML<\/a> signing keys and probe Keycloak authentication.<\/li>\n<\/ul>\n<p>However, researchers could not confirm whether password spraying, backdoor account creation, or SAML key extraction succeeded.<\/p>\n<h2>What does the attack mean for enterprise security?<\/h2>\n<p>The incident demonstrates how attackers can use compromised network-management systems to reach internal identity infrastructure.<\/p>\n<table style=\"width: 74.7186%; height: 168px;\">\n<thead>\n<tr style=\"height: 24px;\">\n<th style=\"width: 45.8046%; text-align: left; height: 24px;\"><strong>Observed activity<\/strong><\/th>\n<th style=\"width: 53.0686%; text-align: left; height: 24px;\"><strong>Enterprise security concern<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"height: 24px;\">\n<td style=\"width: 45.8046%; height: 24px;\">PHP2Shell exploitation<\/td>\n<td style=\"width: 53.0686%; height: 24px;\">Unauthorized server access<\/td>\n<\/tr>\n<tr style=\"height: 24px;\">\n<td style=\"width: 45.8046%; height: 24px;\">Kernel privilege escalation<\/td>\n<td style=\"width: 53.0686%; height: 24px;\">Root-level system control<\/td>\n<\/tr>\n<tr style=\"height: 48px;\">\n<td style=\"width: 45.8046%; height: 48px;\">Reverse SSH tunneling<\/td>\n<td style=\"width: 53.0686%; height: 48px;\">Persistent access to internal services through a compromised firewall<\/td>\n<\/tr>\n<tr style=\"height: 24px;\">\n<td style=\"width: 45.8046%; height: 24px;\">LDAP credential extraction<\/td>\n<td style=\"width: 53.0686%; height: 24px;\">Compromised service-account credentials<\/td>\n<\/tr>\n<tr style=\"height: 24px;\">\n<td style=\"width: 45.8046%; height: 24px;\">Active Directory enumeration<\/td>\n<td style=\"width: 53.0686%; height: 24px;\">Exposure of users, groups, and identity structure<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Patching the initial vulnerability remains essential, but it cannot, on its own, eliminate persistence mechanisms or reverse credential exposure that occurred before remediation.<\/p>\n<h2>What should IT teams investigate?<\/h2>\n<p>Organizations operating PHP-based firewall management systems should investigate possible downstream compromise, particularly where those systems can access identity infrastructure.<\/p>\n<ul>\n<li><strong>Inspect compromised systems:<\/strong> Look for unauthorized webshells, modified PAM configurations, persistent services, and unusual SSH tunnels.<\/li>\n<li><strong>Review identity activity:<\/strong> Investigate LDAP queries, password-spraying attempts, unexpected account creation, and privileged authentication.<\/li>\n<li><strong>Secure exposed credentials:<\/strong> Rotate confirmed compromised service-account passwords and affected cryptographic keys after assessing their use and dependencies.<\/li>\n<li><strong>Apply vendor fixes:<\/strong> Update vulnerable PHP and kernel components using supported vendor releases, and rebuild compromised systems where necessary.<\/li>\n<\/ul>\n<h2>How can Hexnode IdP support identity security?<\/h2>\n<p>The PHP2Shell attack extended beyond server compromise, with attackers extracting LDAP credentials and enumerating Active Directory. This shift toward identity infrastructure highlights the need to secure authentication and restrict access to enterprise applications, particularly when credentials may have been exposed.<\/p>\n<p><a href=\"https:\/\/www.hexnode.com\/idp\/\">Hexnode IdP<\/a> can support these efforts through:<\/p>\n<ul>\n<li><strong>Multi-factor authentication:<\/strong> Add verification requirements to supported application sign-ins.<\/li>\n<li><strong>Conditional access:<\/strong> Control access to supported applications using configured identity and contextual access policies.<\/li>\n<li><strong>Application assignments:<\/strong> Control which users and groups can access configured applications.<\/li>\n<li><strong>Authentication visibility:<\/strong> Review sign-in activity to investigate unexpected access attempts.<\/li>\n<\/ul>\n<p>These controls help strengthen application access security but do not directly detect LDAP credential theft, investigate compromised firewalls, or establish whether attackers successfully accessed Active Directory accounts.<\/p>\n<section id='resource-single'>\n                    <div class='resource-box'>\n                        <div class='resource-box__image-section'>\n                            <div class='resource-box__image-wrap'>\n                                <img decoding=\"async\" src=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/hexnode-idp-infosheet.webp?format=webp\" class=\"resource-box__image\" alt=\"hexnode idp infosheet\" loading=\"lazy\" srcset=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/hexnode-idp-infosheet.webp?format=webp 960w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/hexnode-idp-infosheet-300x225.webp?format=webp 300w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/hexnode-idp-infosheet-768x576.webp?format=webp 768w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/hexnode-idp-infosheet-133x100.webp?format=webp 133w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" title=\"hexnode idp infosheet\" \/>\n                            <\/div>\n                        <\/div>\n                        <div class='resource-box__content-section'>\n                            <h5 class='resource-box__content-subheading'>\n                            Featured resource\n                            <\/h5>\n                            <h4 class='resource-box__content-heading'>\n                            Hexnode IdP Info sheet\n                            <\/h4>\n                            <p class='resource-box__contents'>\n                            Explore Hexnode IdP's unified identity management, SSO, MFA, device trust, and automated user provisioning.\n                            <\/p>\n                            <a class='resource-box__content-link hn-cta__blogs--resource-box' href='https:\/\/www.hexnode.com\/resources\/hexnode-idp-info-sheet\/'>\n                            DOWNLOAD\n                            <svg xmlns='http:\/\/www.w3.org\/2000\/svg' width='20' height='20' viewBox='0 0 20 20'>\n                            <g id='arrow' transform='translate(-309 -191)' opacity='0'>\n                                <rect id='base' width='20' height='20' transform='translate(309 191)' fill='none'\/>\n                                <path id='arrow-2' data-name='arrow' d='M13.093.5,6.8,6.8.5.5' transform='translate(315 207.594) rotate(-90)' fill='none' stroke='#0549d1' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.2'\/>\n                            <\/g>\n                            <\/svg>\n\n                            <\/a>\n                        <\/div>\n                    <\/div>\n                <\/section>\n<h2>What does this attack reveal about identity exposure?<\/h2>\n<p>The PHP2Shell Active Directory breach demonstrates how attackers can move beyond an initially vulnerable server to target connected enterprise identity systems.<\/p>\n<p>Dream Research confirmed credential extraction and directory enumeration, but the full outcome of the attackers&#8217; subsequent identity-focused operations remains unknown.<\/p>\n<p>Organizations must therefore investigate both the original infrastructure compromise and any downstream credential exposure rather than treating patch installation as the end of incident response.<\/p>\n<h3>Conlusion<\/h3>\n<p>The PHP2Shell Active Directory breach highlights how attackers can turn an initial server compromise into a broader threat to enterprise identity infrastructure. With confirmed LDAP credential extraction and directory enumeration, organizations must look beyond patching vulnerable systems. Investigating downstream access, securing exposed credentials, and reviewing authentication activity are essential to address the attack&#8217;s full impact.<\/p>\n<div class=\"signup_box\"><div class=\"signup_wrap_img\"><div class=\"signup-bg\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/Hexnode-MDM-free-trial.jpg?format=webp)\"><\/div><\/div><div class=\"signup_wrap\"><h5>Strengthen enterprise access security with Hexnode IdP <\/h5><p>Secure application access with MFA, conditional policies, and identity management.<\/p><a href=\"https:\/\/www.hexnode.com\/idp\/signup\/\" class=\"hn-cta__blogs--signup-stripe\" target=\"_blank\"> SIGN UP NOW<\/a><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>A newly reported PHP2Shell Active Directory breach has revealed how attackers used critical PHP vulnerabilities&#8230;<\/p>\n","protected":false},"author":5,"featured_media":2441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[12,13],"class_list":["post-2417","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zero-day","category-identity-abuse","product_category-identity-provider","tab_group-vulnerabilities"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PHP2Shell Active Directory Breach: 25 Servers Compromised<\/title>\n<meta name=\"description\" content=\"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PHP2Shell Active Directory Breach: 25 Servers Compromised\" \/>\n<meta property=\"og:description\" content=\"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/\" \/>\n<meta property=\"og:site_name\" content=\"Hexnode Threat Watch\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hexnode\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-29T05:00:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-30T03:06:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1340\" \/>\n\t<meta property=\"og:image:height\" content=\"700\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sophia Hart\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:site\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sophia Hart\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/\"},\"author\":{\"name\":\"Sophia Hart\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\"},\"headline\":\"PHP2Shell Active Directory Breach: 25 Servers Compromised\",\"datePublished\":\"2026-10-29T05:00:15+00:00\",\"dateModified\":\"2026-10-30T03:06:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/\"},\"wordCount\":937,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-active-directory-breach.jpeg?format=webp\",\"articleSection\":[\"Zero-Day\",\"Identity Abuse\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/\",\"name\":\"PHP2Shell Active Directory Breach: 25 Servers Compromised\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-active-directory-breach.jpeg?format=webp\",\"datePublished\":\"2026-10-29T05:00:15+00:00\",\"dateModified\":\"2026-10-30T03:06:44+00:00\",\"description\":\"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-active-directory-breach.jpeg?format=webp\",\"contentUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-active-directory-breach.jpeg?format=webp\",\"width\":1340,\"height\":700,\"caption\":\"php2shell active directory breach\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/php2shell-active-directory-breach\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PHP2Shell Active Directory Breach: 25 Servers Compromised\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"name\":\"Hexnode Threat Watch\",\"description\":\"Latest cyber threats, smarter enterprise response.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"alternateName\":\"Threat Watch\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\",\"name\":\"Hexnode\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"contentUrl\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"width\":100,\"height\":100,\"caption\":\"Hexnode\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Hexnode\\\/\",\"https:\\\/\\\/x.com\\\/thehexnode\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hexnode\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\",\"name\":\"Sophia Hart\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"caption\":\"Sophia Hart\"},\"description\":\"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/author\\\/sophia-hart\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PHP2Shell Active Directory Breach: 25 Servers Compromised","description":"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/","og_locale":"en_US","og_type":"article","og_title":"PHP2Shell Active Directory Breach: 25 Servers Compromised","og_description":"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.","og_url":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/","og_site_name":"Hexnode Threat Watch","article_publisher":"https:\/\/www.facebook.com\/Hexnode\/","article_published_time":"2026-10-29T05:00:15+00:00","article_modified_time":"2026-10-30T03:06:44+00:00","og_image":[{"width":1340,"height":700,"url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp","type":"image\/jpeg"}],"author":"Sophia Hart","twitter_card":"summary_large_image","twitter_creator":"@thehexnode","twitter_site":"@thehexnode","twitter_misc":{"Written by":"Sophia Hart","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#article","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/"},"author":{"name":"Sophia Hart","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430"},"headline":"PHP2Shell Active Directory Breach: 25 Servers Compromised","datePublished":"2026-10-29T05:00:15+00:00","dateModified":"2026-10-30T03:06:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/"},"wordCount":937,"commentCount":0,"publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp","articleSection":["Zero-Day","Identity Abuse"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/","url":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/","name":"PHP2Shell Active Directory Breach: 25 Servers Compromised","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#primaryimage"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp","datePublished":"2026-10-29T05:00:15+00:00","dateModified":"2026-10-30T03:06:44+00:00","description":"Explore the PHP2Shell Active Directory breach, 25 compromised servers, kernel privilege escalation, and confirmed LDAP credential exposure.","breadcrumb":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#primaryimage","url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp","contentUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/php2shell-active-directory-breach.jpeg?format=webp","width":1340,"height":700,"caption":"php2shell active directory breach"},{"@type":"BreadcrumbList","@id":"https:\/\/www.hexnode.com\/threat-watch\/php2shell-active-directory-breach\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hexnode.com\/threat-watch\/"},{"@type":"ListItem","position":2,"name":"PHP2Shell Active Directory Breach: 25 Servers Compromised"}]},{"@type":"WebSite","@id":"https:\/\/www.hexnode.com\/threat-watch\/#website","url":"https:\/\/www.hexnode.com\/threat-watch\/","name":"Hexnode Threat Watch","description":"Latest cyber threats, smarter enterprise response.","publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"alternateName":"Threat Watch","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hexnode.com\/threat-watch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization","name":"Hexnode","url":"https:\/\/www.hexnode.com\/threat-watch\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/","url":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","contentUrl":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","width":100,"height":100,"caption":"Hexnode"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hexnode\/","https:\/\/x.com\/thehexnode","https:\/\/www.linkedin.com\/company\/hexnode"]},{"@type":"Person","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430","name":"Sophia Hart","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","caption":"Sophia Hart"},"description":"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.","url":"https:\/\/www.hexnode.com\/threat-watch\/author\/sophia-hart\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/comments?post=2417"}],"version-history":[{"count":2,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2417\/revisions"}],"predecessor-version":[{"id":2423,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2417\/revisions\/2423"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media\/2441"}],"wp:attachment":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media?parent=2417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/categories?post=2417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}