Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Snoops 'likely still' have access to US government-affiliated network.

The short version

• The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea.
• The attackers also honed in on US government-affiliated firewalls.
• The attackers rooted the first US government-affiliated firewall on October 23, but the device crashed shortly afterward, possibly due to around 900 MB of exploit traffic.

What happened

According to Dream, it remained unresponsive despite 240 automated checks over two hours. They successfully exploited the second firewall a day later, on October 24.

Why it matters

The compromised firewalls ran vulnerable versions of Palo Alto Networks' PAN-OS.

Summary by Nerd News Network. Read the full article at The Register — Networks via the links above and below.