PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Original title: PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
Dream reports that activity observed on October 25, 2026, combined PHP2Shell, CVE-2026-109618 and CVE-2026-109619, with the Fragnesia Linux kernel flaw CVE-2026-46300 to gain root on 25 servers. Three were in a U.S. government-affiliated environment running an unnamed vendor’s firewall software with PHP 8.0.30. After rooting, the attacker opened a reverse SSH tunnel, targeted Active Directory, and attempted credential extraction, password spraying, and backdoor accounts. Dream says success of those identity attacks is unclear and links the tooling to suspected China-nexus operators using AI-assisted development.
Unconfirmed: The firewall vendor is unnamed, China-nexus attribution is Dream’s assessment, and valid credentials or backdoor accounts were not confirmed.
- About 19,000 exposed firewalls were identified and roughly 5,000 answered a version scan.
- Filtering produced 240 targets; the batch runner rooted 24, then a tunneled internal host made 25.
- Two government-linked systems were compromised on October 23 and October 24, 2026.
- Recovered code was a custom non-public PHP2Shell build for the firewall’s appweb server.
- Claude Code plus DeepSeek and Kimi API use was found in the attack infrastructure.
Impact: Root on firewalls and attempted Active Directory credential theft
| Product | Affected |
|---|---|
| PHP | PHP 8.0.30 on the targeted firewall OS |
| Linux kernel | — |
- 1.Remove internet exposure from firewall management interfaces.
- 2.Check rooted firewalls for planted PHP web shells and reverse SSH tunnels.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1110.003 Password SprayingT1021.004 SSH
- Products
- PHPLinux kernelClaude Code
- Organizations
- Dream
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.