PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network

Israeli security company Dream published an analysis on October 26, 2026, detailing a campaign that obtained root access on 25 servers by chaining two vulnerabilities in PHP2Shell with a Linux kernel flaw. The artifacts were recovered on October 25, and exploitation activity continued until October 24.

The compromised infrastructure consisted of 24 perimeter firewalls from the same unnamed manufacturer together with one internal management server. Targets were located in the United States, Japan, Taiwan, and South Korea. Three of the 25 devices belonged to a US government-linked environment: two firewalls and the management server.

The attack chain started with CVE-2026-109618 and CVE-2026-109619, which allowed remote code execution as the lowest-privilege web server user. These flaws were then combined with CVE-2026-46300, named Fragnesia, a CVSS 7.8 vulnerability in the Linux kernel network subsystem that permitted changes to authentication configuration and privilege escalation to root.

Dream described a large-scale scanning effort that identified approximately 19,000 firewalls via the Chinese search engine FOFA, of which 5,000 responded. From these, 240 devices were selected based on country and PHP version, resulting in 24 successful compromises during batch exploitation. In 22 cases the attacker deployed a root-privileged webshell and did not return.

Within the government-linked environment, the report details an eight-port reverse SSH tunnel that provided access to domain controllers and VPN infrastructure. The attacker decrypted the password of an LDAP service account, enumerated Active Directory users and groups, performed password spraying, and attempted to create backdoor accounts.

Dream did not attribute the operation to any named group or country but listed indicators of Chinese origin, including target selection, use of FOFA, activity timestamps in UTC+8, and Chinese-language instructions in the logs of the offensive platform. That platform contained Claude Code installed along with configured models DeepSeek and Kimi, although Dream found no direct evidence that AI generated the exploit code.

Both PHP2Shell vulnerabilities were added to the CISA catalog on October 26 with a remediation deadline of October 29 for US federal agencies. The kernel patch for Fragnesia had been released in May. The case highlights that the affected firewalls ran embedded PHP versions 8.0.30 and 7.4.33, which bypassed standard package inventory processes. Operators are advised to verify whether management interfaces are exposed to the internet, the vector Dream identified as the initial entry point.