PHP2Shell chain roots 25 firewalls and reaches U.S. network

Cybersecurity firm Dream has described an attack chain that rooted 25 firewall servers by combining the PHP2Shell flaws with a Linux kernel privilege-escalation vulnerability. Three of the compromised systems were in a U.S. government-affiliated environment. Dream observed the activity on October 25, 2026, and said the operation targeted devices running specific versions of an unnamed major vendor’s firewall software.

The chain uses PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS scores of 9.2 that can enable unauthenticated remote code execution. It also uses Fragnesia, CVE-2026-46300, a Linux kernel local privilege-escalation flaw with a CVSS score of 7.8. Dream said the recovered PHP2Shell implementation was a custom, non-public build tailored to the affected firewall platform rather than a copy of a known public exploit.

From exposed interfaces to root access

The exploit targeted PHP’s session.upload_progress mechanism on the firewall’s appweb management server. The affected firewall OS uses PHP 8.0.30 with a high memory limit, a condition Dream said enabled the memory-corruption stages. The attacker first used FOFA to identify about 19,000 internet-facing firewalls with exposed management interfaces worldwide.

A custom scanner obtained operating-system version information from about 5,000 responding devices. The operator then focused on systems in the United States, Japan, Taiwan and South Korea, selecting newer release branches running PHP 8.0.30. That filtering produced 240 targets. The importance of tailored exploitation is reinforced by PHP2Shell activity before public disclosure documenting PHP2Shell activity before public disclosure, while this operation shows a bespoke chain being applied at scale.

An automated batch runner used the PHP2Shell-Fragnesia combination, placed a PHP web shell in a publicly accessible firewall directory, checked for root access and recorded hostnames and IP addresses in a CSV file. The process initially rooted 24 servers. One U.S. government-affiliated system crashed after being rooted on October 23 at 6:14 p.m. UTC and did not return online.

Internal access and identity targeting

The attacker successfully rooted a second government-affiliated system on October 24 at 10:09 a.m. UTC, then established a reverse SSH tunnel from the compromised firewall to the operator’s infrastructure. At 11:35 a.m. UTC, a third government server was compromised through that tunnel; it was an internal firewall management server not otherwise externally reachable. The total rose to 25 rooted servers.

Dream found evidence that the attacker targeted Active Directory after gaining access. The activity included attempts to decrypt an LDAP service account password, enumerate users, spray organization-themed passwords against accounts, and create backdoor Active Directory accounts. It remains unclear whether valid credentials were obtained or backdoor accounts were created, so the full extent of the compromise is not known.

Evidence of AI-assisted development

Dream linked the operation to suspected China-nexus activity and said artifacts in the infrastructure included Anthropic’s Claude Code, API keys for FOFA, and aiscan, an AI-powered offensive-security platform configured with DeepSeek and Kimi large language models. The structure, comments and consistency of nearly 40 scripts also suggested that AI assisted the development process.

Dream said 22 other rooted firewalls remain parked with active web shells, while the tunnel into the U.S. government organization may still be running. For businesses, the immediate implication is to limit exposure of firewall management interfaces, apply relevant fixes, and investigate affected systems for web shells, reverse SSH tunnels and suspicious Active Directory activity.