Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems
Do Son 
The attack path | Image: Dream Research
TL;DR
Security researchers uncovered an espionage campaign that used a custom PHP2Shell exploit to gain root access on 25 firewall servers across the Pacific region. By pairing this PHP2Shell exploit Fragnesia privilege escalation chain into a single unauthenticated request, the attacker breached a U.S. government-affiliated network. From there, the intruder pivoted to an internal management server and extracted Active Directory credentials.
What Happened in the Operation
On October 25, 2026, Dream researchers uncovered attack logs, target lists, and roughly 40 post-exploitation scripts belonging to an active intrusion campaign. To protect unpatched users, the researchers withheld the name of the affected firewall vendor after notifying the company. Specifically, the attacker developed a custom weaponization of the PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) and combined it with the Fragnesia Linux kernel flaw (CVE-2026-46300).
“The attacker developed two separate exploits and chained them together to achieve root access on any firewall running specific versions of a large vendor’s firewall software in a single HTTP request without any credentials,” Dream researchers wrote. First, the PHP2Shell exploit targeted PHP 8.0.30 on the firewall’s appweb management server by flooding it with 383MB of multipart POST requests. After leaking the memory address of libphp.so via a cookie header and triggering a second 500MB out-of-memory state, the attacker forged a HashTable entry to run commands as the restricted nobody user.
Kernel Escalation and Lab Calibration
Because SELinux blocks the nobody user from changing system files, the attacker chained in the Fragnesia kernel flaw within the XFRM ESP-in-TCP subsystem. This second stage used page-cache writes to overwrite the 774-byte /etc/pam.d/su file with pam_permit.so, allowing root access without a password in under 15 minutes. Notably, investigators recovered 11 JSON version profile files showing that the operator had extracted firmware libraries and tuned heap offsets in a virtual lab before launching the attack.
Who Is Behind the Activity
While Dream researchers did not link the intrusion to a named group, multiple technical clues point to a Chinese-nexus operator with medium-to-high confidence. For instance, the attacker used the Chinese search engine FOFA to scan 19,000 exposed firewalls worldwide before filtering the list down to 240 devices in the United States, Japan, Taiwan, and South Korea. Furthermore, server logs ran on China Standard Time (UTC+8) and included the Chinese-developed iox tunneling tool.
Investigators also found artificial intelligence tools installed on the attacker’s infrastructure. Specifically, the server hosted Claude Code alongside an offensive security platform called aiscan configured with Chinese language models DeepSeek and Kimi. “While we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development,” the report noted.
Impact and the U.S. Government Pivot
On October 23, an automated batch script launched the PHP2Shell exploit Fragnesia chain against the 240 filtered targets, rooting 24 perimeter firewalls and planting a 103-byte PHP webshell on each. For 22 of those servers, the attacker simply parked the webshells for future access. However, two rooted firewalls belonged to a U.S. government-affiliated organization using Common Access Card (CAC) authentication.
Although the first government firewall crashed under 900MB of exploit traffic, the attacker manually rooted the second firewall on October 24 at 10:09 UTC. Within 90 minutes, the intruder established an eight-port reverse SSH tunnel and used the same PHP2Shell exploit to root an internal firewall management server, bringing the total to 25 compromised machines. Next, the attacker used the root master key to decrypt the LDAP service account password, mapped all Active Directory users and groups, and ran an unlimited password spray because the domain had its lockout threshold set to zero. The operator also attempted to create backdoor accounts and extract SAML signing keys from a Keycloak server.
How Organizations Can Stay Protected
“The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure,” Dream researchers warned. To defend against this PHP2Shell exploit campaign, network administrators must immediately remove firewall management interfaces from the public internet and place them behind strict VPN or jump-host controls. In addition, security teams should apply vendor firmware patches for CVE-2026-109618, CVE-2026-109619, and CVE-2026-46300 as soon as they become available. Finally, Active Directory administrators must enforce account lockout policies, rotate LDAP service credentials, and inspect perimeter devices for unauthorized systemd services, rc.local hooks, or modified /etc/pam.d/su files.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
