PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

The activity, observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers. Three of these systems were in a U.S. government-affiliated environment, marking a significant breach of sensitive infrastructure.

"The affected devices run specific versions of a large vendor's firewall software," cybersecurity firm Dream reported. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."

Exploit Chain Details

The attack combines two critical vulnerabilities: PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) and Fragnesia (CVE-2026-46300, CVSS 7.8). The PHP2Shell vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server.

The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack. This custom weaponization allowed the attacker to successfully compromise systems across multiple countries.

AI-Assisted Operation

Evidence points to the use of AI tools in the attack infrastructure, including Anthropic's Claude Code, FOFA API keys, and aiscan configured with large language models from DeepSeek and Kimi. The code structure and consistency across nearly 40 scripts suggest AI augmentation in the development process.

The operation began with the attacker using FOFA to identify approximately 19,000 internet-facing firewalls worldwide. After filtering targets, they focused on 240 systems running PHP 8.0.30 in the U.S., Japan, Taiwan, and South Korea.

Attack Sequence

The attacker used an automated batch runner to exploit the PHP2Shell-Fragnesia chain, planting a PHP web shell on accessible directories. This process compromised 24 servers initially, with two belonging to a U.S. government-affiliated organization.

One government server crashed after being rooted on October 23, while a second was successfully compromised on October 24. The attacker established a persistent channel via reverse SSH tunnel and later compromised a third internal firewall management server on October 25, bringing the total to 25 rooted systems.

Once inside, the attacker targeted Active Directory to decrypt LDAP service account passwords, enumerate users, and attempt password spraying. The operation also sought to create backdoor Active Directory accounts, though it remains unclear if these efforts succeeded.

Strategic Implications

Since the U.S., Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts, Dream analysts noted.

The 22 other rooted firewalls remain compromised with active web shells, and the persistent tunnel into the US government organization is likely still operational. The attacker maintains access to 19,000 fingerprinted targets for future exploitation as they develop profiles for additional OS versions.

This disclosure comes as PHP2Shell vulnerabilities have seen limited exploitation in the wild, with threat actors highlighting the challenges in converting proof-of-concept code into reliable attack vectors against real targets.