PHP 취약점 악용 사이버 공격…미국 정부 관련 시스템 등 서버 25대 장악 정황 - 전국매일신문 - 전국의 생생한 뉴스를 ‘한눈에’

PHP 취약점 악용 사이버 공격…미국 정부 관련 시스템 등 서버 25대 장악 정황 - 전국매일신문 - 전국의 생생한 뉴스를 ‘한눈에’

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/jeonmae/news-articleview-html, snapshot 20261102T094333Z. Copied byte for byte; every file's sha256 is in captures/20261102T094333Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Korean regional-newspaper report (Jeonmae, 29 October) on Dream Research's report: attacks on firewalls in Korea, the United States, Japan and Taiwan on 23 and 24 October; the attacker scanned about 19,000 firewalls worldwide, chose 240 devices in the four countries, chained PHP2Shell on the firewall management servers with a Linux privilege-escalation flaw to gain top administrator rights on 24 firewalls, and left web shells on 22 of them; at a US government-related organisation two firewalls and then one internal management server were attacked, making 25 in all, with the extent of data leakage and further compromise unconfirmed and no Korean damage yet established. It adds signs hinting at Chinese links (target selection, a Chinese asset-search engine and a China-developed network tool, a time zone matching China Standard Time, Chinese-language prompts in an AI platform's logs) and that traces of an AI coding tool and settings for Chinese models were found, while Dream says there is no evidence AI wrote the attack code and the operation does not appear to have run autonomously end to end.

> 다만 AI가 공격 코드를 직접 작성했다는 증거는 확보되지 않았으며, 공격 전 과정이 AI를 통해 자율적으로 진행된 것으로 보이지는 않는다고 드림 리서치는 설명했다.

_Curator's translation:_ "However, no evidence has been obtained that AI wrote the attack code directly, and the whole attack does not appear to have been carried out autonomously through AI, Dream Research explained."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP 취약점 악용 사이버 공격…미국 정부 관련 시스템 등 서버 25대 장악 정황 - 전국매일신문 - 전국의 생생한 뉴스를 ‘한눈에’". Selected mechanically, not read by a person.

Capture notes

Language ko. A fourth relay of Dream Research's report (primary), not independent of cur36-innovatopia-dream-chain, cur37-orcarouter-dream-25-servers and cur38-taiwannews-dream-25; the chain's mechanics are not copied. Nothing in the page addresses an AI or hides text from a reader; it names AI tools found in the attacker's environment as part of the report.