{"schema_version":"0.10.0","id":"LR-2026-0280","record_version":2,"title":"AI-assisted exploitation of PHP2Shell and Fragnesia flaws to breach 25 servers across four countries","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":4.13},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-30","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: TechGig · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-30","history":[{"date":"2026-10-30","from_level":null,"to_level":"preliminary","reason":"1 report: TechGig · subject to change"}]},"sources_hash":"e6e38a7d22b42595ee4acb3ff5b3d8598e11b8470629786cacb58604f2b7734c"},"system":{"model_name":"Claude Code","model_version":null,"developer":"Anthropic","harness":"Claude Code and aiscan","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-29","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Attackers breached 25 servers in the US, Japan, Taiwan and South Korea, including systems tied to a US government-affiliated organisation, by exploiting PHP2Shell and a Linux flaw called Fragnesia.","tags":["ai-assisted-cyberattack","server-breach","government-linked-systems"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: Twenty-five servers across four countries were breached, including a US government-affiliated organisation whose internal network and credentials were exposed.","harm_class":["third_party_security","operational"],"affected_description":"25 servers across the United States, Japan, Taiwan and South Korea, including systems connected to a U.S. government-affiliated organisation","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://techgig.com/news/cybersecurity/hackers-breach-25-servers-us-government-linked-systems/135283805","publisher":"TechGig","date":"2026-10-29","type":"press","title":"Hackers breach 25 servers, US government-linked systems","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.adversarial_actor":"C","event.summary":"C","event.incident_class":"C","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"AI tools, including Anthropic's Claude Code and an AI-powered security platform called aiscan, may have played a role."}],"system.developer":[{"source_index":0,"quote":"AI tools, including Anthropic's Claude Code and an AI-powered security platform called aiscan, may have played a role."}],"system.harness":[{"source_index":0,"quote":"AI tools, including Anthropic's Claude Code and an AI-powered security platform called aiscan, may have played a role."}],"event.summary":[{"source_index":0,"quote":"Hackers breached 25 servers across four countries, including systems connected to a U.S. government-affiliated organisation, according to a report from Dream Research published Monday."}],"event.tags":[{"source_index":0,"quote":"Security researchers from Dream Research found evidence suggesting AI tools may have assisted in the cyberattack."}],"event.adversarial_actor":[{"source_index":0,"quote":"Hackers breached 25 servers across four countries, including systems connected to a U.S. government-affiliated organisation, according to a report from Dream Research published Monday."}],"event.incident_class":[{"source_index":0,"quote":"Hackers exploited critical security flaws to breach 25 servers, including systems linked to a U.S. government-affiliated organisation."}],"impact.affected_description":[{"source_index":0,"quote":"The attacks targeted servers in the United States, Japan, Taiwan, and South Korea."}],"impact.harm_class":[{"source_index":0,"quote":"U.S. government-affiliated environment exposed internal network and credentials."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"U.S. government-affiliated environment exposed internal network and credentials."}],"impact.severity_because":[{"source_index":0,"quote":"Hackers breached 25 servers across four countries, including systems connected to a U.S. government-affiliated organisation, according to a report from Dream Research published Monday."}],"context.country":[{"source_index":0,"quote":"The attacks targeted servers in the United States, Japan, Taiwan, and South Korea."}],"impact.severity":[{"source_index":0,"quote":"Hackers breached 25 servers across four countries, including systems connected to a U.S. government-affiliated organisation, according to a report from Dream Research published Monday."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-29"}]},"notes_on_gaps":"Single press source (TechGig), no primary disclosure, court filing or government evaluation. event.date_occurred, event.date_disclosed, event.detection_method, event.trigger, event.root_cause, event.failure_class, event.responsible_party, system.autonomy_level, system.deployment_context, system.permissions_scope, system.tools_granted, system.guardrails_present, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count and context.industry are not stated by any source and are omitted. The source's own agent_involved=true and autonomy classification are not supported by any sentence stating the AI acted autonomously or that a human monitored it; the source only says AI tools 'may have played a role', so event.agent_involved and system.autonomy_level are omitted. event.incident_class=security_compromise is graded from the source's statement that hackers exploited flaws to breach servers; the AI's role is unconfirmed. event.failure_class is null because no source states an agent mechanism. impact.severity=major rests on the stated breach of 25 servers across four countries including a government-affiliated organisation (many third parties); no dollar figure is given. context.country=unknown because the affected servers span four countries and no operator is identified. The '40 custom scripts' and DeepSeek/Kimi configuration are the source's inference of AI assistance, not a confirmed finding. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-30] system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Attackers used AI tools, including Claude Code and aiscan configured with DeepSeek and Kimi, to help breach 25 servers in the US, Japan, Taiwan and South Korea, including a US government-affiliated environment.","quote":"These tools were configured with Chinese AI models DeepSeek and Kimi, and researchers uncovered approximately 40 custom scripts whose consistent formatting suggested AI assistance.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Hackers exploited PHP2Shell and the Fragnesia Linux flaw to gain full control of vulnerable servers, breaching systems they were not authorised to access.","quote":"Attackers exploited PHP2Shell and Fragnesia vulnerabilities for system control.","source_index":0,"grade":"C"},{"step":"reached","text":"Twenty-five servers across four countries were breached, and a US government-affiliated environment exposed its internal network and credentials.","quote":"U.S. government-affiliated environment exposed internal network and credentials.","source_index":0,"grade":"C"},{"step":"caught","text":"Dream Research security researchers found evidence suggesting AI tools assisted, including about 40 custom scripts with consistent formatting.","quote":"Security researchers from Dream Research found evidence suggesting AI tools may have assisted in the cyberattack.","source_index":0,"grade":"C"},{"step":"done","text":"Administrators were told to patch PHP installations, since updating WordPress plugins alone may not fix the vulnerability.","quote":"Administrators of WordPress sites and online services using PHP should ensure their PHP installations are patched.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-30","source_urls":["https://techgig.com/news/cybersecurity/hackers-breach-25-servers-us-government-linked-systems/135283805"]}}