Limited reports of PHP bug exploitation emerge

Multiple cybersecurity firms are reporting the successful exploitation of two recently announced PHP vulnerabilities, including one allegation of a breach involving U.S. government-affiliated servers. The bugs, known as "PHP2Shell," were added to a U.S. government catalog of exploited vulnerabilities this week, with federal agencies given until Thursday to install patches.

Cybersecurity firm GreyNoise said it has observed at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619. Another company, Dream, released a detailed report claiming a Chinese threat actor compromised U.S. government-affiliated servers using the PHP2Shell exploit combined with another vulnerability targeting firewall software.

Exploit Chain Details

According to Dream's report, the attacker used PHP2Shell to execute commands on the firewall but needed additional access, so they chained it with CVE-2026-46300, a Linux vulnerability also added to the U.S. catalog this week. "We recovered a custom PHP2Shell implementation tailored to the targeted firewall platform, version-specific profiles, exploitation logs and post-exploitation scripts," said Kfir Fleischer, Dream's vice president of cyber research.

Sophisticated Targeting

Dream researchers found evidence of 24 compromised firewalls that allowed the hacker to extract credentials and enumerate directories. The attacks primarily occurred between October 23 and 24. The researchers attributed the campaign to a Chinese actor based on language, tools, and AI models used, including Chinese platforms like FOFA, DeepSeek and Kimi.

The attackers used FOFA, a Chinese internet asset search engine, to identify about 19,000 internet-facing firewalls, narrowing this down to 5,000 and then filtering for servers in the United States, Japan, Taiwan and South Korea. Further refinement based on exploit profiles resulted in a target list of 240 firewalls.

For 22 of the 24 attacked firewalls, the hackers only planted webshells for later access. "While running mass exploitation on all targets related to the above geo-locations, which also had the relevant firewall version, they found 2 government-related servers among the breached firewalls, which they focused their efforts on," Fleischer explained.

Government Breach

The report indicates that two servers associated with one target appeared to belong to a U.S. government-affiliated environment. One firewall crashed and never came back online, while the other was repeatedly targeted. The PHP2Shell exploit chain was non-public and customized specifically for these targets.

Once inside, the attacker "zeroed in on three specific servers in a U.S. government-affiliated environment." Dream researchers believe the hackers likely maintain persistent remote access to the organization's internal network and possess a complete organizational blueprint through Active Directory data, account credentials, private keys, and network topology.

"If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure," Dream stated. The report noted a "clear-cut focus" on government targets, demonstrating significant preparation and capability beyond simple opportunistic exploitation.

Expert Analysis

Expel cybersecurity expert Marcus Hutchins, who has been tracking PHP2Shell exploitation attempts, said the report appears to be tracking a Chinese threat actor known for targeting edge devices. He noted that chaining PHP2Shell with a kernel privilege escalation exploit was expected to achieve full system control.

Viakoo's John Gallagher warned that the same methodology could be used across many other device types beyond firewalls. "For any end-of-life devices using PHP2Shell, time is of the essence to get them replaced and off the network," he said. Several experts believe this campaign represents how PHP2Shell will be used in future attacks.