Suspected Chinese attackers root 25 servers with PHP2Shell chain

Dream Group said in an October 26 report that suspected Chinese attackers chained a custom PHP2Shell exploit with a Linux kernel privilege-escalation bug and rooted 25 servers, including Palo Alto Networks firewalls at US government-affiliated organizations. The attackers began exploiting the servers on October 23 and targeted organizations in the US, Japan, Taiwan, and South Korea. Dream warned that the attackers "likely still" have persistent remote access to the compromised networks.

The chain combines two PHP bugs, CVE-2026-109618 and CVE-2026-109619, which have CVSS scores of 9.2 and allow remote code execution without authentication. It also uses Fragnesia, CVE-2026-46300, a local privilege-escalation flaw in the XFRM ESP-in-TCP subsystem of the Linux kernel that scores 7.8. Palo Alto Networks Unit 42 researchers separately confirmed the attacker tooling and supported Dream's results. The PHP Foundation fixed the PHP flaws in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Attack chain

The first US government-affiliated firewall was rooted on October 23 at 6:14 p.m. UTC, then crashed, possibly from roughly 900 MB of exploit traffic, and stayed down through 240 checks over the next two hours. A second firewall fell on October 24 at 10:09 a.m. UTC, and within hours the attacker tunneled into the internal network and used the same PHP2Shell exploit to compromise a third server at 11:35 a.m. UTC, launching an Active Directory campaign. The total exploit chain from a single unauthenticated HTTPS request to a persistent root web shell takes under 15 minutes, Dream said.

With root access, the attackers decrypted the LDAP service account password and hardcoded it into later scripts, enumerated users and groups through LDAP, sprayed passwords against every account, and tried to create backdoor Active Directory accounts and extract SAML signing keys. Dream could not determine whether the password spray succeeded or the backdoor accounts and SAML keys were created or extracted because those results stayed on the management server's local filesystem.

CISA response and patching

CISA added both PHP CVEs to its Known Exploited Vulnerabilities catalog and told federal agencies to patch, upgrade, or shut down affected systems. The agency added Fragnesia to the catalog on Wednesday. CISA and the FBI both declined to comment on the campaign. Wiz researchers said on October 27 that they had seen a limited number of exploitation attempts and no public proof of concept for complete exploitation against an arbitrary target. Perplexity's Adel Karimi posted on X on October 24 that he had confirmed remote code execution with memory disclosure on honeypots.

Wiz also said its telemetry showed a 67 percent drop in daily exposed vulnerable systems in the days after disclosure, and the share of vulnerable internet-exposed machines still running PHP 7.3 or earlier fell from 8.3 percent to 5.7 percent over five days. The number of significantly affected organizations fell by about 47.9 percent.

CISA urged organizations to inventory PHP installations, including embedded components, deploy a web application firewall, and monitor for signs such as PHP worker processes launching shells or downloading tools.

Attacker infrastructure

The attackers' infrastructure included Anthropic's Claude Code, an AI offensive security tool called aiscan configured with DeepSeek and Kimi models, and API keys for the FOFA reconnaissance service. Dream said the operator used FOFA to locate roughly 19,000 internet-facing Palo Alto Networks firewalls. A custom version scanner probed the roughly 19,000 hosts and about 5,000 responded with version data; the attacker then filtered that list by country and PHP version to get 240 targets, and automated batch exploitation yielded 24 root shells. The 25th rooted machine was a third government server compromised later through the reverse SSH tunnel, according to the same source.

Administrators should close firewall management interfaces to the internet, apply vendor firmware updates for PAN-OS, and hunt for PHP web shells and unexpected outbound SSH connections from management interfaces.