Real-world hacking exploiting a PHP vulnerability actually happened... "25 firewalls in four countries, including South Korea, breached"

[Financial News] Indications have emerged that real cyberattacks took place after a serious security vulnerability in PHP, a programming language widely used on websites around the world, was disclosed. In particular, evidence was found suggesting that top-level administrator privileges were stolen on 25 servers across four countries, including South Korea, the United States, Japan and Taiwan.
The attack showed signs of using artificial intelligence (AI), including Claude, DeepSeek and Kimi, and the hacker reportedly established a way to access the server remotely in just 15 minutes.
With evidence emerging of real-world hacking that exploited the PHP vulnerability, experts are urging public institutions and internet sites in South Korea, among others, to urgently install security updates on servers running PHP.

The research team at Israeli cybersecurity company Dream published a report on its website on the 26th (local time), detailing a hacking case in which 25 firewalls in South Korea, the United States, Japan and Taiwan were compromised by exploiting a PHP vulnerability. The hacker chained two software vulnerabilities in the firewalls to gain the highest system privileges without authentication.
Tools that used Anthropic’s Claude Code and Chinese-made artificial intelligence (AI) models were also found in the attack infrastructure. However, no evidence was found that AI actually wrote attack code or directly carried out the hacking.

Dream Research said, “The hacker examined about 19,000 firewalls belonging to a particular company that were exposed to the internet worldwide, then analyzed whether they were operational and which software versions they were running, and selected 240 as targets.” Signs of compromise were found on 25 in total: 24 firewalls and one internal firewall management server. South Korea was also among the target countries. However, the names of affected organizations or companies in South Korea and the scale of the damage have not been disclosed.
The attack used two vulnerabilities called PHP2Shell and Fragnesia. The first was used to execute commands remotely, while the second enabled the attacker to obtain the highest system administrator privileges. The researchers said it took the attacker less than 15 minutes to break in without credentials and establish a persistent channel for remote access.

The Dream research team said the attack moved on to target internal information systems after an external firewall was compromised. The report explained, “The hacker took control of a firewall in an environment related to the U.S. government, then created a channel into the internal network and also infiltrated the central firewall management server.” The hacker then collected information on users and groups within the organization and extracted account passwords. Further attacks, including password guessing and the creation of unauthorized accounts, were also attempted, but it was not confirmed whether those attempts succeeded.

Signs of AI use were also found. The research team said, “Anthropic’s coding tool Claude Code was installed in the attack environment, and DeepSeek and Kimi models from China were connected to AI-based attack tools,” adding, “The Dream research team found indications of possible AI-assisted development in the structure and comments of around 40 custom scripts.”
However, the team stressed that there was no direct evidence AI had actually written exploit code or tools for subsequent intrusion.
Security experts in South Korea stressed, “Security officials at major companies or institutions should check management interfaces exposed to the internet and update vulnerable software, while also reviewing account information and records of unusual access to internal networks, given the possibility that a breach has already occurred.” The experts also advised that, particularly because South Korea was among the targets, it was necessary to separately check whether there had been any damage in the country.
[email protected] Lee Gu-sun Reporter