Massive Cyber Attack on US Government Systems Exploits PHP Vulnerability

The attack, which is believed to be linked to a Chinese hacking group, used a combination of AI tools and automated code to breach the servers. The attackers exploited a vulnerability in the PHP remote code execution vulnerability, PHP2Shell, and then used a chain of Linux kernel vulnerabilities to gain root access. The attack targeted firewalls in South Korea, Japan, Taiwan, and the US, and compromised 24 firewalls, including some in South Korea. The attackers used AI tools to create and automate the attack, significantly shortening the attack cycle from reconnaissance to firewall bypass and exploit combination. The attack has raised concerns about the use of AI in cyber warfare and the potential for automated attacks to outpace defenders.