Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Original title: Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
Dream researchers say artifacts show an operation that rooted 25 firewall servers in the United States, Japan, Taiwan, and South Korea, including three in a US government-affiliated environment. The attacker chained a custom PHP2Shell remote-code-execution build (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia kernel privilege escalation (CVE-2026-46300) against undisclosed versions of a large vendor’s firewall software. After root, artifacts show credential extraction and Active Directory enumeration. Dream withheld the vendor and versions and says the vendor was notified.
Unconfirmed: Chinese origin and AI-assisted development are Dream’s inference; the vendor, versions, and named victim are withheld.
- The chain needs no credentials and ends in a persistent root webshell in under 15 minutes.
- Recovered material includes target lists, exploitation logs, and about 40 post-exploitation scripts.
- The firewall OS uses PHP 8.0.30; 11 version-profile files were found, with details redacted.
- Infrastructure included Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys.
- Dream says there is no direct evidence the AI tools wrote the exploit or scripts.
Impact: Unauthenticated root on firewalls and Active Directory credential access
| Product | Affected |
|---|---|
| firewall software | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
11 min read at dreamgroup.com
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.
By 882542F3884314B · dreamgroup.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.