Chained PHP2Shell exploit rooted 25 servers including US government systems

A full attack operation recovered

Security researchers at Dream say they have recovered the artifacts of a complete attack operation that rooted 25 internet-facing firewall servers across the United States, Japan, Taiwan and South Korea, including three machines in a US government-affiliated environment. According to Dream's report, the attacker paired a custom build of the PHP2Shell exploit with a Linux kernel privilege-escalation flaw to take full control of exposed firewalls without credentials, then moved into the target organisation's Active Directory domain.

The research, carried out with Dream's autonomous cyber-research product Hero, is based on artifacts uncovered on October 25. The haul included target lists, exploitation logs, roughly 40 custom post-exploitation scripts and 11 JSON files holding per-version exploit parameters. Dream says the affected devices run specific versions of a large firewall vendor's software; the vendor has been notified and is not being named.

One HTTP request, two exploits

According to the report, the attacker chained two vulnerabilities — CVE-2026-109618 and CVE-2026-109619, together described as PHP2Shell — against the PHP 8.0.30 runtime used by the firewall's appweb management server. The technique abuses PHP's session.upload_progress mechanism in four stages. Crafted multipart uploads totalling around 383MB exhaust memory and push the allocator into a predictable state; a forged session identifier then triggers an out-of-bounds read that leaks the base address of libphp.so through the server's Set-Cookie response; a second round of memory pressure near 500MB leaves a stale internal session reference; and a final request plants a forged PHP HashTable entry whose destructor callback points to zif_system, so PHP's cleanup routine executes an attacker-chosen shell command as the nobody user.

Code execution as nobody is still confined by SELinux, so a second flaw was chained in: CVE-2026-46300, which Dream calls Fragnesia, a kernel bug in the XFRM ESP-in-TCP subsystem. It uses page-cache writes to overwrite /etc/pam.d/su — a file of only 774 bytes, written byte by byte with a splicing technique — swapping in an authentication rule that accepts everyone, after which su root succeeds without a password. Dream says both exploits fire within a single final HTTP request, and the whole sequence, from unauthenticated HTTPS connection to a persistent root webshell, completed in under 15 minutes.

Version profiles for eleven builds

The exploit cannot simply be fired at any target. It depends on memory offsets that vary between firewall OS versions — the address of zif_system, HashTable structure sizes and heap-spraying parameters — so the attacker maintained 11 JSON profiles containing offsets extracted from each version's libphp.so binary, along with SHA256 hashes and ELF build IDs. One PHP 8.0.30 profile was fully calibrated against a live virtual machine; eight more were provisional, with offsets derived from binaries but unverified on running instances. Two provisional profiles for an older PHP 7.4.33 branch achieved code execution in the lab, but the full chain was never calibrated there. Nine exploitable versions went into the campaign.

From 19,000 devices to 25 compromised servers

Dream describes a clear targeting funnel. Using FOFA, a Chinese internet-asset search engine comparable to Shodan, the attacker identified roughly 19,000 internet-facing firewalls from the targeted vendor. A custom scanner running 200 concurrent threads found about 5,000 of them alive and fingerprinted their versions. Filtering by geography — the US, Japan, Taiwan and South Korea — and by exploit compatibility cut the list to 240 targets, of which 25 were ultimately exploited.

Once root was achieved, the attacker concentrated on three servers in the US government-affiliated environment. Recovered artifacts confirm credential extraction and Active Directory enumeration, and Dream says the operation ended with persistent access to the organisation's internal AD domain. The timeline in the report runs from lab setup on October 8 to exploitation and post-exploitation activity on October 24.

Signs of AI-assisted tooling

The attack infrastructure showed Claude Code installed, an AI-powered offensive security platform called aiscan configured with the Chinese models DeepSeek and Kimi, and FOFA API keys. Dream is careful with its conclusion: there is no direct evidence that the AI tools wrote the exploit or the post-exploitation scripts, but code structure, commenting style and consistency across roughly 40 scripts point to AI-assisted development. The company adds that the operation does not look like a fully autonomous nation-state attack.

Why it matters

The incident shows how an exposed management interface can become a doorway to an organisation's identity layer: one unauthenticated request, no stolen credentials at the front door, and a root shell within minutes that pivots straight to Active Directory. For defenders, particularly in government environments, Dream's lesson is that finding vulnerable systems is only the starting point — the harder work is understanding and containing the access a successful compromise makes possible. The artifacts also offer an early, concrete glimpse of offensive tooling built with AI assistance, even when the operation itself remains human-directed.