Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers

Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the WildOn October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.The attacker then launched attacks against Active Directory.

The recovered artifacts confirm credential extraction and directory enumeration.The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure.

For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible.The research below was conducted with proactive threat hunting using Dream’s autonomous cyber research product, Hero.DiscoveryDream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain (CVE-2026-109618/CVE-2026-109619) paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), target lists, exploitation logs, and approximately 40 custom post-exploitation scripts.This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.The discovered artifacts revealed an operation that began with exploit development in a lab environment and ended with persistent access to a US government organization's internal Active Directory domain.AI Usage in AttackWe also observed some evidence of AI-assisted tooling in the attack infrastructure:Claude Code had been installedAn AI-powered offensive security platform called aiscan was configured with Chinese LLMs DeepSeek and KimiAPI keys for the Chinese reconnaissance platform FOFA were presentWhile we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development. That said, this operation does not appear to be a fully autonomous nation-state attack.The Exploit: Two Vulnerabilities Chained Into One RequestThe attacker developed two separate exploits and chained them together to achieve root access on any firewall running specific versions of a large vendor’s firewall software in a single HTTP request without any credentials.PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — Remote Code ExecutionThe implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell.

When PHP's cleanup handler walks the HashTable, it calls the forged destructor — executing arbitrary commands as the nobody user.Fragnesia (CVE-2026-46300) — Kernel Privilege EscalationGetting code execution as nobody isn't enough since SELinux confines httpd_t from modifying system files. In order to complete the root, the attacker chained in a second exploit: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem.Fragnesia uses page-cache writes to overwrite /etc/pam.d/su — replacing its authentication rules with pam_permit.so (accept all).

Because the PAM file is only 774 bytes, the exploit uses a per-byte splicing variant to write it precisely. After the overwrite, su root succeeds without a password.Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes.The Lab: Version Profiling at ScaleThe exploit is not a single fire-and-forget payload.

It requires precise memory offsets that differ between firewall OS versions — the address of zval_ptr_dtor, the address of zif_system, HashTable structure sizes, and memory geometry parameters that control the heap layout during each stage.Among the recovered artifacts, we found 11 JSON version profile files — one for each firewall OS version that had been tested: Firewall VersionRelease branchPHPProfilesNotes RedactedOlder branch7.4.332 provisionalPHP 7.4 — RCE as nobody verified in lab, but full chain not calibrated (base build plus one hotfix variant) RedactedNewer branches8.0.301 calibrated, 8 provisionalOne base profile fully lab-tested; the others inherit its geometry or share offsets with neighboring builds Each profile contains the exact offsets extracted from the libphp.so binary of that version — with SHA256 hashes of each library, ELF build IDs, and precise memory geometry parameters (chunk sizes, fill counts, drain counts, spray offsets) tuned through lab testing.The difference between "calibrated" and "provisional" profiles is notable — calibrated means the attacker tested the exploit against a running VM of that version and confirmed the memory geometry works. Provisional means they calculated offsets from the binary but haven't verified on a live instance.The Campaign Funnel: From 19,000 Discovered to 25 ExploitedFigure 1: Operational timeline of the campaign, from setup on October 8 through exploitation, the pivot into the internal network, and post-exploitation on October 24.With the exploit ready and profiles for 9 exploitable versions, the attacker launched a targeting campaign that followed a clear funnel:Stage 1: Global Discovery (19,000 targets)Using FOFA — a Chinese internet asset search engine similar to Shodan — the attacker identified approximately 19,000 internet-facing firewalls from the targeted vendor worldwide. These were devices with management interfaces exposed to the internet, discoverable through certificate fingerprints and HTTP response signatures.Stage 2: Version Fingerprinting (5,000 alive)A custom version scanner ran with 200 concurrent threads against all 19,000 targets, identifying which devices were actually online and what OS version they were running. Approximately 5,000 responded with version information.Stage 3: Geographic and Version Filtering (240 targets)From the 5,000 alive devices, the attacker filtered to servers located in only United States, Japan, Taiwan, and South Korea.

They then further filtered to versions matching their exploit profiles (the newer release branches running PHP 8.0.30).

This produced a final target list of 240 firewalls.Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts.Stage 4: Automated Exploitation (24 rooted)The 240 targets were fed into an automated batch runner that exploited them five at a time, with an 1800-second (30-minute) timeout per target.