PHP2Shell chain reaches U.S. government-affiliated network
PHP2Shell was combined with a Linux privilege escalation flaw to obtain root access, the highest level of system control, on 25 servers across the U.S., Japan, Taiwan and South Korea. Israeli cybersecurity firm Dream said the affected systems included three servers in a U.S. government-affiliated environment. The firm observed the activity on October 25, 2026, and assessed that a suspected China-linked threat actor conducted the operation with assistance from artificial intelligence tools.
The affected devices ran particular versions of an unnamed large vendor's firewall software. A firewall controls which network traffic is permitted to enter or leave an organisation. Dream said it notified the vendor, but did not disclose its identity. After compromising the firewalls, the attacker moved toward Active Directory, Microsoft's system for managing an organisation's users, computers and access permissions. Recovered artifacts showed attempts to extract credentials and enumerate the directory, meaning the attacker listed accounts and other available identity information.
The attack joined three vulnerabilities. PHP2Shell consists of CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under the Common Vulnerability Scoring System, a scale for indicating a security flaw's severity. The two PHP flaws can permit unauthenticated remote code execution, allowing an outsider to run commands without first signing in. Fragnesia, tracked as CVE-2026-46300 and rated 7.8, is a local privilege escalation flaw in the Linux kernel, the central part of the operating system. It was used to turn initial access into root control.
Dream found that the PHP2Shell component was a custom, non-public implementation rather than a copy of a known public exploit. Although it followed the same underlying technique, it appeared to have been developed independently and adapted to the targeted firewall platform. It attacked PHP's session.upload_progress feature on the firewall's appweb management server. The operating system used PHP 8.0.30 with a high memory limit, which enabled the exploit's memory corruption stages, where software is made to mishandle data held in memory.
The recovered operation began with exploit development in a laboratory environment. The attacker then used FOFA to identify about 19,000 internet-facing firewalls whose management interfaces were exposed. A custom scanner checked which devices were online and which operating system versions they ran, receiving version information from about 5,000. The list was narrowed to systems in the U.S., Japan, Taiwan and South Korea, then to newer release branches using PHP 8.0.30. That produced 240 targets.
An automated batch tool ran the PHP2Shell and Fragnesia chain against those targets. It placed a PHP web shell, a malicious file that accepts remote commands, inside a publicly accessible firewall directory. The tool checked for root access and recorded each target's hostname and IP address in a CSV file. This automated stage rooted 24 servers. Two belonged to a U.S. government-affiliated organisation. One crashed shortly after compromise at 6:14 p.m. UTC on October 23, 2026, and did not return online. A focused follow-up campaign rooted the second system at 10:09 a.m. UTC on October 24.
The attacker used that second firewall to establish persistent access to the internal network through a reverse SSH tunnel. This is an encrypted connection initiated by the compromised system back to infrastructure controlled by the operator. At 11:35 a.m. UTC, the same approach compromised a third government server, an internal firewall management system that could be reached only through the tunnel. That brought the total number of rooted servers to 25.
From there, the operation targeted Active Directory. It attempted to decrypt an LDAP service account password, with LDAP being a protocol used to access directory information, and then listed users. The attacker also performed password spraying, trying a small set of organisation-themed passwords across every user account, and attempted to create backdoor Active Directory accounts. Dream could not determine whether valid credentials were obtained or whether those additional accounts were successfully created, so the full scope of the breach remains unknown.
Evidence of AI-assisted development included Anthropic's Claude Code installed in the attack infrastructure, API keys for FOFA and an offensive security platform called aiscan. That platform was configured with large language models from DeepSeek and Kimi. Dream also pointed to the structure, comments and consistent style across almost 40 scripts as signs that AI augmented the development process. These findings indicate assistance with tooling, but do not by themselves establish that the operation was autonomous.
Dream linked the suspected China nexus to the deliberate focus on the U.S., Japan, Taiwan and South Korea, describing them as major intelligence targets for Chinese state-aligned operations in the Pacific. The attribution remains an assessment rather than a confirmed identity. Dream further assessed that 22 other compromised firewalls remained parked with active web shells, that the persistent connection into the U.S. organisation was likely still running, and that the operator retained details of roughly 19,000 systems that could be revisited as support for more operating system versions was developed.
Public exploitation of PHP2Shell had otherwise been limited. According to reporting attributed to Flare, an XSS forum member said public proof-of-concept code was difficult to turn into a dependable attack because real targets require offsets from libphp.so, a PHP library file, and those offsets differ between builds. The forum member said reproduction was practical on a test system or where the target file system was already accessible, but not readily against arbitrary systems. The custom build described by Dream appears to have addressed that obstacle for the specific firewall platform.
For organisations reviewing exposed management systems and broader infrastructure risk, AEU-I provides security-first IT, infrastructure and consulting. The incident demonstrates why administrative interfaces should not be left publicly reachable without a clear operational need, and why a compromised perimeter device must be treated as a possible route into identity systems rather than as an isolated appliance problem.