AI-assisted PHP2Shell exploit roots 25 servers, including U.S. government-affiliated firewalls

Cybersecurity firm Dream reported that on October 25, 2026 a suspected China-nexus threat actor leveraged a combination of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege-escalation flaw (CVE-2026-46300) to obtain root access on 25 servers across the United States, Japan, Taiwan and South Korea. The attack focused on firewalls running a specific version of a large vendor’s software, exploiting PHP's session.upload_progress mechanism on the device's management server.

"The affected devices run specific versions of a large vendor's firewall software," Dream said. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."

Dream’s analysis indicates the exploit was a custom, non-public build tailored to the firewall platform, and that AI tools such as Anthropic's Claude Code, DeepSeek and Kimi were used to develop and automate the attack scripts. The threat actor scanned roughly 19,000 internet-facing firewalls with FOFA, identified about 5,000 responsive devices, and narrowed the list to 240 targets matching the vulnerable PHP version. An automated batch runner deployed the PHP2Shell-Fragnesia chain, planted web shells, and logged compromised hosts, resulting in root access on 24 servers.

Two of the compromised systems belonged to a U.S. government-affiliated organization. After one server crashed, the attacker established a persistent reverse SSH tunnel to a second firewall and later accessed a third internal firewall through that tunnel, bringing the total to 25 rooted servers. The operation included attempts to decrypt LDAP service account passwords, enumerate users, and spray organization-specific passwords to create backdoor Active Directory accounts, though the success of these attempts remains unclear.

"Since the U.S., Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts," Dream noted.

The researchers warned that the remaining 22 firewalls with active web shells could still be exploited, and the persistent tunnel into the U.S. government network may still be operational, leaving a large pool of fingerprinted targets for future campaigns.