Hackers chain PHP2Shell exploits with Fragnesia bug to root firewalls

Hackers chained PHP2Shell exploits, tracked as CVE-2026-109618 and CVE-2026-109619, with the Fragnesia Linux kernel privilege escalation bug, tracked as CVE-2026-46300, to gain root access on 25 firewalls on October 23 and October 24, 2026, including servers in a US government-affiliated environment.

Dream has tied the activity to no named threat group and regards the Chinese link as an assessment rather than confirmed attribution. Dream names South Korea, Taiwan, Japan and the US as central espionage targets for Chinese state-aligned activity across the Pacific theater. The researcher links those targeted countries to Chinese state-aligned Pacific theater operations and says the targeting pattern indicates potential nation-state adversary efforts.

Researchers say the PHP2Shell exploit uses PHP’s session.upload_progress mechanism, which tracks the progress of file uploads, on the firewall’s appweb management server. The firewall operating system runs PHP 8.0.30 with a high memory limit, and that memory limit enabled the memory corruption stages of the attack. Dream researchers described the recovered PHP2Shell implementation as a custom build developed independently for the targeted firewall platform, not a copy of public PHP2Shell exploits, and said it was tailored to the firewall platform. They also said the operation began with lab-based exploit development, with artifacts indicating lab development preceded persistent access to the US government organization’s internal Active Directory domain, and a forum member, c0d3x, said real targets require unique offsets from libphp.so that cannot be brute-forced.

The attackers used FOFA, a Chinese internet asset search engine used to find exposed firewalls, to identify 19,000 internet-facing firewalls. They narrowed the pool to about 240 systems in the US, Japan, Taiwan and South Korea, filtering by location and newer PHP releases to reduce the target list. Dream observed PHP root webshells on 24 of the exploited firewalls, so persistent PHP webshells were dropped on most of the compromised devices, and there was no follow-on activity on 22 of them, with most compromised firewalls remaining idle after initial access. “The attacker monitored [the first firewall] with 240 automated probes over two hours, waiting for it to recover,” Dream said.

SecurityWeek reports that two servers in a US government-affiliated environment saw further hacker activity after initial exploitation, meaning those servers were progressed beyond initial access. The Hacker News says three systems in a US government-affiliated environment were compromised. One rooted server crashed soon after the initial exploitation on October 23, 2026; the first compromised server failed after exploitation and did not recover. A second attack wave on October 24, 2026, resulted in another successful system compromise after the first server crashed.

The attackers deployed a reverse SSH tunnel — a connection that lets a compromised system reach out to an attacker-controlled system — to maintain access to the firewall and reach the internal network. Through the tunnel, they targeted an internal firewall management server using the PHP2Shell-Fragnesia exploit chain, and the internal management server was reached only via the persistent tunnel. Through that management server, the intruders obtained the configurations, credentials and settings for all firewalls managed by the organization, decrypted an LDAP service account password using the compromised management server, and enumerated users and groups in the domain after the credential decryption. They attempted to create backdoor Active Directory accounts as part of an effort to establish persistent access.

The attackers performed password spraying attacks using organization-themed passwords against every user account, using passwords themed to the organization across all user accounts. Dream says it is unclear whether the actor obtained valid credentials or created backdoor accounts, and Dream states the full extent of the compromise remains indeterminate, so the total scope of the breach is undetermined.

Researchers found evidence that Anthropic’s Claude Code was installed in the attack infrastructure. API keys for FOFA and the AI-powered offensive security platform aiscan were present, configured with LLMs from DeepSeek and Kimi. Nearly 40 scripts show a consistent code structure and commenting style, which Dream researchers attribute to AI augmentation of development. The API keys and LLM configurations point to AI-assisted offensive tooling.

Dream says the 22 firewalls besides the government targets remain parked with active web shells. The researcher says the tunnel giving persistent access to the US government organization is probably still running. The attacker retains access to the 19,000 fingerprinted targets for future profiling of additional operating system versions, so the attacker can revisit the original FOFA results as new OS profiles are developed. Dream notified the entity affected by the attack; the Israeli company informed the affected organization of the intrusion, and a large vendor’s firewall software runs on the affected devices in specific versions, though the vendor name was not disclosed.

The PHP development team assigned a 9.2 CVSS v4.0 rating to both PHP2Shell flaws, giving both vulnerabilities the same critical CVSS v4.0 score. The team released fixes on Oct. 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 26 after the agency confirmed exploitation in the wild.

SparTech Software advises security teams to install fixed PHP versions, restart PHP workers, inventory PHP on web servers and appliances, and review firewall and management-server logs. The company says patching PHP alone may not remove an attacker who already obtained root access because patch-only remediation is insufficient once root access has been obtained. Defenders should conduct forensic review and rotate credentials where compromise is suspected.