The attacker rooted 25 servers across four countries on October 25, 2026, combining PHP2Shell exploits with a Linux kernel privilege-escalation bug to move from exposed firewall management interfaces into internal networks — including three systems tied to a U.S. government‑affiliated environment.
How the attackers chained PHP2Shell (CVE-2026-109618 / CVE-2026-109619) with Fragnesia (CVE-2026-46300)
Cybersecurity firm Dream said the operation paired two distinct vulnerability classes to achieve full system compromise. The initial foothold exploited PHP2Shell — two unauthenticated remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619 — against a firewall vendor's management server. Dream explained: "The vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack."
After remotely executing code, the attacker used Fragnesia, a Linux kernel local privilege escalation tracked as CVE-2026-46300, to gain root. Dream characterized the kernel exploit as the second stage in the chain that allowed the operator to plant persistent artifacts and verify root access on compromised hosts.
Evidence of custom tooling and AI-assisted development
Dream found that the PHP2Shell implementation was not a copy of public proof‑of‑concept code. "The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell," the company said. The exploit was tailored specifically to the targeted firewall platform and relied on offsets and conditions unique to that build.
Artifacts indicate clear use of automation and AI augmentation: Anthropic's Claude Code was found installed in the attacker infrastructure; API keys for FOFA were present; and an AI-powered offensive security platform called aiscan was configured to use large language models from DeepSeek and Kimi. Dream also noted that "the code structure, commenting style, and consistency across nearly 40 scripts suggest the use of AI to augment the development process."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOperational timeline, scale, and what happened inside the U.S. government‑affiliated network
- Reconnaissance and fingerprinting: Dream says the attacker used FOFA to identify about 19,000 internet-facing firewalls with exposed management interfaces worldwide. A custom version scanner queried those devices and about 5,000 responded with version information.
- Target narrowing: The attacker filtered devices to those in the U.S., Japan, Taiwan, and South Korea that matched PHP 8.0.30, yielding roughly 240 targets.
- Mass exploitation and initial rootings: An automated batch runner exploited the PHP2Shell–Fragnesia chain, planted PHP web shells, verified root, and logged results to CSV. That process gained root on 24 servers.
- Government-affiliated compromise: Two compromised systems were tied to a U.S. government-affiliated organization. One crashed shortly after being rooted on October 23, 2026, at 18:14 UTC and never came back online; the attacker rooted a second at 10:09 UTC on October 24. The operator then built a persistent reverse SSH tunnel from the compromised firewall back to its infrastructure, and at 11:35 UTC a third internal firewall management server — reachable only via the tunnel — was compromised. The total reached 25 rooted servers.
- Post‑exploitation: Dream recovered artifacts showing the attacker "launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration." The attacker attempted to decrypt an LDAP service account password, enumerate users, spray organization‑themed passwords against accounts, and attempted to create backdoor Active Directory accounts; Dream said it is unclear whether those attempts succeeded.
What this means for technologists, government network owners, and vendors
- Technologists and security teams: The operation shows how exposed management interfaces and specific PHP/runtime combinations (here, PHP 8.0.30 with a high memory limit) can be weaponized end‑to‑end. Teams should assume an exploit chain that reaches root can be followed by Active Directory enumeration and credential extraction.
- Government network owners: Dream observed that the attacker established a persistent reverse SSH tunnel into the U.S. government‑affiliated organization and that "the persistent tunnel into the US government organization is likely still running." That suggests a continuing access risk even after initial remediation steps.
- Vendors and procurement leaders: Dream reported the affected devices "run specific versions of a large vendor's firewall software," and that the vendor name was not disclosed. Dream said it notified the entity, indicating vendor coordination occurred but the vendor remains unnamed in the disclosure.
Remaining operational risk and indicators to watch
Dream warned the attacker retains a set of tools and unfinished work that make follow‑on operations plausible. "The 22 other rooted firewalls remain parked with active web shells," the company said, and the attacker still "has 19,000 fingerprinted targets they can revisit as they develop profiles for additional OS versions." Dream also linked the campaign to a suspected China‑nexus actor, noting the targeted countries — the U.S., Japan, Taiwan, and South Korea — are "the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater."
Not all observers accept the exploit ease. A forum participant using the handle c0d3x told Flare that PHP2Shell is "unexploitable crap" in practice without access to target-specific libphp.so offsets or the target filesystem — underscoring why Dream found a custom, tailored implementation rather than a generic public exploit.
Dream's reporting leaves the most consequential questions open: whether credential theft yielded valid logins, whether backdoor AD accounts were successfully created, and whether the persistent tunnel remains active. For defenders and owners of exposed management interfaces, the immediate, attributable fact is stark — a tailored PHP2Shell–Fragnesia chain rooted 25 systems and produced a persistent pathway into at least one U.S. government‑affiliated environment.
