1. Description
PHP2Shell has evolved from vulnerability disclosure and early exploitation attempts into a more concerning reported intrusion involving exposed firewall management interfaces.
In a report published on October 28, 2026, The Hacker News described findings from cybersecurity firm Dream, which investigated an operation observed on October 23–25. The attacker reportedly chained PHP2Shell vulnerabilities with a Linux kernel privilege-escalation vulnerability to obtain root access to 25 servers.
The affected systems ran a particular vendor's firewall software. The vendor and exact product versions were not publicly disclosed, as the company had been notified.
Dream reported that three compromised systems belonged to a U.S. government-affiliated environment. After gaining access to an exposed firewall, the attacker established a reverse SSH tunnel and used it to reach an internal firewall management server.
The investigation also found evidence of automated target discovery, custom exploit development, web-shell deployment, and attempts to access Active Directory. The activity demonstrates how vulnerabilities in security appliances can create a pathway into an organization's internal identity infrastructure.
The suspected China-nexus attribution remains an assessment based on the operation's targeting and other contextual evidence. Dream did not publicly attribute the activity to a named threat actor.
2. Technical Description
The attack combined two separate vulnerability stages.
PHP2Shell: Remote Code Execution
PHP2Shell refers to two critical PHP vulnerabilities:
CVE-2026-109618 — a vulnerability associated with memory corruption and potential unauthenticated remote code execution.
CVE-2026-109619 — a separate vulnerability associated with PHP request-state handling and potential unauthenticated remote code execution.
Both were reported with CVSS scores of 9.2.
In this incident, the exploit reportedly targeted PHP's session.upload_progress mechanism on an exposed firewall management server. The affected firewall operating system used PHP 8.0.30 with a memory configuration that enabled the exploit's memory-corruption stages.
Dream stated that the recovered exploit was a custom, non-public implementation tailored to the target platform, rather than a direct copy of a known public proof of concept.
Fragnesia: Linux Kernel Privilege Escalation
The second vulnerability was CVE-2026-46300, known as Fragnesia, which was reported with a CVSS score of 7.8.
The attacker chained this local privilege-escalation flaw with PHP2Shell to move from code execution within the web-service context to root-level access on affected Linux-based firewall systems.
The combination is particularly significant because remote code execution and local privilege escalation serve different purposes: the first provides an initial execution opportunity, while the second can elevate privileges and increase control over the compromised device.
3. Attack Overview
The reported attack chain unfolded as follows:
Internet-wide reconnaissance: The operator used FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces.
Device fingerprinting: A custom scanner identified responsive systems and collected operating-system version information from approximately 5,000 devices.
Target selection: Filtering for selected geographic locations and systems running PHP 8.0.30 reduced the candidate list to 240 targets.
Automated exploitation: A batch runner attempted to exploit the PHP2Shell vulnerability chain and obtain root access.
Web-shell deployment: The attacker placed PHP web shells on compromised systems and recorded hostnames, IP addresses, and results.
Internal network access: A reverse SSH tunnel connected a compromised firewall to the operator's infrastructure, providing a path toward an internal firewall management server.
Identity infrastructure targeting: The attacker extracted an LDAP service-account password, enumerated Active Directory users, and attempted password spraying and backdoor account creation.
Dream reported that 25 servers were rooted across four countries. It also reported that 22 compromised firewalls remained with active web shells when the investigation was described.
The recovered evidence did not establish that the password-spraying attempts succeeded or that the attempted backdoor accounts were successfully created.
4. Technical Analysis
4.1 Automated reconnaissance at scale
The operator began with a large pool of internet-facing firewall management interfaces. FOFA was used to identify approximately 19,000 devices, while a custom scanner collected additional information about responsive systems.
The target-selection process then narrowed the list to 240 systems in the United States, Japan, Taiwan, and South Korea that matched the required software characteristics.
This staged approach allowed the attacker to focus exploitation attempts on devices believed to be compatible with the custom exploit chain, rather than indiscriminately attacking every discovered host.
Security implication: Internet-facing management interfaces create opportunities for attackers to identify and profile vulnerable appliances at scale. Restricting administrative access can significantly reduce exposure to this type of reconnaissance.
4.2 Chaining remote code execution with privilege escalation
PHP2Shell reportedly provided the initial execution path through the firewall's PHP-based management service. The Fragnesia vulnerability was then used to elevate privileges to root.
Dream described the recovered exploit as custom-developed for the target platform. This is important because exploit reliability can depend on software builds, memory layouts, runtime configurations, and platform-specific behavior.
The reported operation demonstrates the risk of combining an exposed application-layer weakness with a separate kernel vulnerability. Addressing only one part of an exploit chain may leave other security weaknesses available to an attacker.
4.3 Persistent access through web shells
The automated runner reportedly placed PHP web shells in publicly accessible directories on compromised firewalls. These shells provided a means to maintain and reuse access after the initial exploitation.
Dream reported that 24 perimeter firewalls were rooted, with web shells remaining on 22 of those systems. One of the initially compromised government-affiliated systems crashed shortly after exploitation and did not return online. The attacker subsequently compromised another system in the same environment.
The continued presence of web shells increases the risk that a system remains compromised even after the original vulnerability has been patched.
4.4 Reverse SSH tunneling and internal network access
A compromised firewall was used to establish a reverse SSH tunnel connecting the internal environment to infrastructure controlled by the operator.
This provided a route to an internal firewall management server that was not directly reachable from the public internet. The attacker reportedly compromised that third government-affiliated server using the same exploit chain.
The incident illustrates how a perimeter appliance can become a pivot point into a network that relies on it for security and connectivity.
Security implication: Firewall management interfaces should be isolated from general network traffic, and outbound connections from security appliances should be monitored for unexpected SSH tunnels or other persistent channels.
4.5 Active Directory and credential-related activity
After obtaining root access, the operator turned toward identity infrastructure.
Dream reported evidence of:
Extraction and decryption of an LDAP service-account password.
Enumeration of Active Directory users and groups.
Password-spraying attempts using organization-themed password guesses.
Attempts to create backdoor accounts within Active Directory.
The report did not establish whether the password-spraying attempts resulted in valid credentials or whether the backdoor accounts were successfully created.
Nevertheless, the observed activity highlights how compromise of a network appliance can extend beyond the device itself and expose credentials or internal directory services.
4.6 AI-assisted development indicators
The investigation uncovered Claude Code installed in the attack infrastructure, together with API keys associated with FOFA and an AI-powered offensive security platform called aiscan. The platform was configured to use large language models from DeepSeek and Kimi.
Researchers also identified similarities in code structure, comments, and formatting across approximately 40 scripts, which suggested AI-assisted development.
However, these artifacts do not establish that AI wrote the custom exploit or autonomously performed the intrusion. The available evidence supports the presence of AI-related tools and a possible role in development, not definitive proof of AI-generated exploitation.
4.7 Attribution and investigation limitations
Dream characterized the activity as potentially associated with a China-nexus operation based on the selected targets and broader strategic context.
The firm did not publicly identify a specific threat actor. The affected firewall vendor was also withheld, and the investigation did not establish the full extent of the potential compromise.
The findings should therefore be described as a reported intrusion and a suspected state-aligned operation, rather than definitive attribution to a named group.
5. Indicators of Compromise (IOCs)
The public reporting does not provide a complete, verified IOC list suitable for direct deployment in detection systems.
The following technical identifiers are relevant to vulnerability and activity tracking:
Vulnerability identifiers
CVE-2026-109618— PHP2Shell.CVE-2026-109619— PHP2Shell.CVE-2026-46300— Fragnesia Linux kernel privilege-escalation vulnerability.
Observed artifact types and behaviors
PHP web shells on compromised firewall devices.
Unexpected reverse SSH tunnels from perimeter appliances.
Unusual access to LDAP and Active Directory services.
Unexpected web-shell files in publicly accessible directories.
These are investigation leads, not unique IOCs. No IP addresses, file hashes, or exact web-shell paths are included here because they were not verified from the cited public reporting.
6. Potential Impact
Successful exploitation of the reported attack chain can create serious security risks:
Firewall compromise: Root access may allow attackers to manipulate a critical network security appliance.
Persistent unauthorized access: Web shells and reverse SSH tunnels can provide continued access after initial exploitation.
Internal network exposure: Compromised perimeter devices can create pathways to internal management systems and identity infrastructure.
Credential compromise: Access to LDAP service-account credentials can increase the risk of further unauthorized access.
Active Directory targeting: Enumeration, password spraying, and attempted backdoor creation may support broader compromise if successful.
Operational disruption: Exploitation or subsequent changes to firewall systems can affect connectivity, availability, and security enforcement.
Expanded attack surface: Large-scale fingerprinting allows attackers to prioritize vulnerable systems and repeat attempts against exposed devices.
The reported compromise of 25 servers demonstrates the potential scale of the operation, but it does not mean that 25 separate organizations were compromised. The full extent of downstream access and data exposure remains uncertain.
7. Recommendations
Immediate Actions
Identify vulnerable appliances: Inventory internet-facing firewalls and management systems, including the embedded PHP versions and operating-system builds.
Apply vendor-approved remediation: Follow the affected firewall vendor's security guidance and verify that the relevant PHP and kernel vulnerabilities are addressed.
Restrict management interfaces: Remove direct public access wherever possible and limit administration to trusted management networks or approved access gateways.
Hunt for web shells: Inspect exposed directories and application paths for unexpected PHP files, particularly on security appliances.
Investigate reverse SSH tunnels: Review firewall logs, process telemetry, and outbound network records for unexpected persistent SSH connections.
Audit identity infrastructure: Review LDAP and Active Directory authentication events, service-account use, password-spraying indicators, and unexpected account creation.
Rotate potentially exposed credentials: Reset affected service-account passwords and review associated privileges if credential exposure is suspected or confirmed.
Preserve evidence: Collect relevant logs and forensic data before rebuilding compromised appliances or removing suspicious files.
Preventive Measures
Minimize exposed management services: Place administrative interfaces behind VPNs, zero-trust access controls, or dedicated management networks.
Maintain appliance patching procedures: Track vendor advisories and ensure embedded components are included in vulnerability management.
Harden service accounts: Apply least privilege, restrict interactive use where appropriate, and rotate credentials according to organizational policy.
Strengthen network segmentation: Limit communication between perimeter appliances, management networks, directory services, and sensitive internal systems.
Monitor outbound appliance traffic: Alert on unusual SSH connections, unexpected DNS activity, and communication with unapproved external infrastructure.
Deploy centralized logging: Correlate firewall, endpoint, network, and identity telemetry to detect movement from a perimeter device into internal systems.
Validate AI-assisted threat claims: Treat AI-related artifacts as supporting evidence rather than proof of autonomous attacks or specific threat-actor attribution.
Test incident-response procedures: Include compromised firewalls, credential exposure, web shells, and reverse tunnels in response exercises.
8. Conclusion
The reported PHP2Shell-Fragnesia operation demonstrates how attackers can combine remote code execution, kernel privilege escalation, automated reconnaissance, and persistent access to compromise critical network infrastructure.
The reported compromise of 25 servers, including three systems in a U.S. government-affiliated environment, highlights the risks associated with exposed firewall management interfaces. The subsequent use of a reverse SSH tunnel and attempts to access Active Directory show how a perimeter compromise can develop into a broader identity-security incident.
Although AI-related tools were present in the attack infrastructure, the evidence does not establish that AI independently executed the operation or generated the exploit. Attribution to a China-nexus actor also remains an assessment rather than a confirmed identification.
Organizations should prioritize remediation of affected appliances, restriction of management access, investigation of web shells and reverse tunnels, and auditing of credentials and identity infrastructure. Security appliances must be treated as high-value assets whose compromise can threaten the wider enterprise.