Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Original title: Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
Dream found campaign files on October 25 showing a nonpublic PHP2Shell implementation against firewall management servers, followed by the Fragnesia Linux kernel flaw to become root. Attackers scanned about 19,000 internet-facing firewalls, compromised 24, and used a reverse SSH tunnel to reach a 25th internal management server. They decrypted an LDAP password and listed Active Directory users and groups. Later identity attacks were attempted, but success is unknown, and the firewall vendor and versions were withheld.
Unconfirmed: The firewall vendor, versions, later Active Directory outcomes, Chinese links, and any AI role remain unconfirmed.
- PHP2Shell abused session.upload_progress in the appweb server to run as nobody.
- Fragnesia changed local authentication data so the attacker became root without a password.
- Webshells remained on 22 firewalls with no further recorded activity after access.
- On October 24 a tunnel forwarded eight internal ports and survived reboots.
- Hosts contained Claude Code and aiscan with DeepSeek and Kimi; no named actor.
Impact: Root access, webshells, and exposure of directory credentials
| Product | Affected |
|---|---|
| firewall management platform | — |
| Linux kernel | — |
- 1.Deploy relevant firewall and kernel patches under vendor guidance.
- 2.Hunt for root webshells, reverse SSH tunnels, and reused stolen credentials.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1110.003 Password Spraying
- Products
- appwebLinux kernelClaude Code
- Organizations
- Dream
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
Hackers combined PHP2Shell vulnerabilities with a Linux kernel exploit to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Dream researchers uncovered the campaign’s files on October 25, revealing a path from exposed firewall management interfaces to internal Active Directory services. […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.