Attackers chain PHP2Shell flaws to root 25 firewall servers
Original title: Hackers Exploit PHP2Shell Vulnerabilities to Gain Root Access on 25 Firewall Servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
Dream researchers say attackers chained PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with kernel flaw Fragnesia, CVE-2026-46300, to gain root on 25 firewall servers. Found on October 25, the operation moved from exposed management interfaces to credential theft, SSH tunnels, and Active Directory reconnaissance. Three systems were associated with a US government-affiliated environment. The firewall vendor and versions were withheld after the vendor was notified.
Unconfirmed: Dream suggests a Chinese nexus from language, timestamps, and tools but named no actor; broader domain compromise was not confirmed.
- FOFA found about 19,000 exposed firewalls; filtering narrowed the list to 240 targets.
- Automated attacks first rooted 24 firewalls and installed 103-byte PHP webshells.
- A later compromise of an internal management server brought the total to 25.
- The attacker decrypted an LDAP service account password and enumerated domain users.
- Password spraying, backdoor accounts, and SAML key extraction were not confirmed successful.
Impact: Unauthenticated command execution, then root, on firewalls
- 1.Restrict exposure of firewall management interfaces.
- 2.Investigate downstream identity access after a perimeter compromise.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1021.004 SSHT1090 ProxyT1110.003 Password Spraying
- Malware
- Fragnesia
- Organizations
- Dream
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
Hackers chained PHP2Shell vulnerabilities with a Linux kernel privilege escalation flaw to gain root access on 25 servers, including three systems associated with a United States government-affiliated environment, according to Dream researchers. Discovered on October 25, the operation progressed from exposed firewall management interfaces to credential theft, persistent tunneling, and Active Directory reconnaissance.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.