Reports say PHP2Shell bugs were exploited, including on firewalls
Original title: Limited reports of PHP bug exploitation emerge
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
GreyNoise said it observed at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619, called PHP2Shell. The bugs were added to a US exploited-vulnerability catalog, and federal agencies were told to patch by Thursday. Dream claims a Chinese actor chained PHP2Shell with Linux flaw CVE-2026-46300 against an unnamed vendor's firewalls, hitting 24 devices on October 23-24, including two it calls US government-affiliated. CISA declined to comment.
Unconfirmed: Dream's Chinese attribution and the servers' government affiliation are the firm's claims; the firewall vendor is unnamed.
- Dream says logs showed root access through a webshell using the id command.
- Scanning narrowed about 19,000 firewalls to a target list of 240.
- Twenty-two firewalls only had webshells planted for later access.
- Dream cites Chinese-language tools plus DeepSeek, Kimi and Claude code.
- CVE-2026-46300, affecting Linux, was added to the catalog Wednesday.
Impact: Command execution and claimed root access on firewalls
| Product | Affected |
|---|---|
| PHP | — |
| Linux | — |
| unnamed firewall software | — |
- 1.Install patches for CVE-2026-109618 and CVE-2026-109619; federal agencies were told to do so by Thursday.
- 2.Replace end-of-life devices that still use the affected PHP code.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web Shell
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
4 min read at therecord.mediaOne cyber firm listed a half-dozen exploitations of the PHP2Shell bugs, and another identified a well targeted, suspected Chinese campaign that breached U. S. "government affiliated" servers.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.