Researchers have uncovered a major cyber intrusion traced to a suspected China-linked threat actor that leveraged the newly disclosed PHP2Shell vulnerabilities alongside a Linux kernel escalation flaw to root 25 servers—including several tied to U.S. government-affiliated networks.
What happened
The incident, observed on October 25, 2026, began with exploitation of two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, jointly known as PHP2Shell, which allow unauthenticated remote code execution, and a Linux kernel local privilege escalation vulnerability dubbed Fragnesia (CVE-2026-46300). Dream, the Israeli cybersecurity firm tracking the attack, reports that the attackers used these tools to take over firewall systems running PHP 8.0.30 and launch a multistage compromise. Three of those systems were part of U.S. government-affiliated infrastructure.
Targets were internet-facing firewalls from a major vendor, whose name hasn’t been disclosed. The attackers focused on devices running a specific build of the firewall’s management server software—versions with PHP 8.0.30 and liberal memory limits that facilitated memory corruption in the session.upload_progress component. Once access was gained, the intruders moved laterally toward internal Active Directory domains, extracting credentials and performing directory enumeration.
Attack chain and scale
The threat actor used AI-assisted tooling extensively. Installed tools included Anthropic’s Claude Code, API access to FOFA, and offensive platforms built on large language models DeepSeek and Kimi. Researchers also pointed out consistent code patterns, commenting style, and scripts—nearly 40 in total—suggesting AI-guided development.
Execution moved swiftly. Using FOFA, the attackers identified about 19,000 firewall devices exposed to the internet. A version scanner narrowed those down to 5,000, then further to 240 that matched the PHP 8.0.30 variant. An automated runner deployed the PHP2Shell-Fragnesia exploit chain, installed web shells, confirmed root access, and logged details to a target list.
On October 23 and 24, 2026, two U.S. government-affiliated servers were compromised. One crashed irrecoverably. Following that, on October 24 at 10:09 a.m. UTC, another was rooted. On October 24 at 11:35 a.m. UTC, the attackers made use of a reverse SSH tunnel to take over an internal firewall only reachable via the already compromised systems. Altogether, 25 servers in the U.S., Japan, Taiwan, and South Korea were rooted.
The attackers then focused on Active Directory elements. Their objectives included decrypting LDAP service account passwords, enumerating users, and performing password spraying using organization-themed password lists. They also attempted to create backdoor accounts. However, it remains unknown whether these efforts succeeded—there’s no evidence currently that valid credentials were harvested or backdoor accounts created.
Implications & ongoing risk
Because the United States, Japan, Taiwan, and South Korea are often in the crosshairs of Chinese state-aligned cyber operations, researchers regard this campaign as aligning with nation-state intelligence priorities. Exposed management interfaces, especially on critical infrastructure like firewalls, are giving attackers a highly consequential entry point—bridging from internet-facing assets into identity infrastructure.
Of the 25 rooted firewalls, 22 still have active web shells. For the U.S. government-affiliated environment, a persistent reverse SSH tunnel remains in place, and threat actors appear to retain access to a fingerprinted pool of 19,000 potential targets. These remain exploitable, especially as attackers develop profiles of different OS versions.
Despite PHP2Shell’s high severity (CVSS 9.2), it had seen limited real-world exploitation before this incident. Its weaponization required custom builds fitted to specific environments, especially unique versions of libphp.so, reducing its universal applicability. Analysts noted public criticism that, until now, the PoC attacks lacked broad target reach because builds differ greatly across deployments.
For defenders, this incident is a stark reminder: management interfaces exposed to the internet pose extreme risk. Proper versioning, patching, and vigilant configuration are crucial. Any firewall, especially those running software like PHP 8.0.30, should be audited immediately.
What this means: this operation signals both the growing sophistication of attacks chain-linking remote RCE and local kernel vulnerabilities, and the increasing role of AI tools in orchestrating large-scale intrusion campaigns. Going forward, defenders will need to anticipate automated fingerprinting, OS version profiling, and the blending of real-time AI in exploit development. Systems with exposed management layers must assume they are prime targets—and treat every interface as a possible Achilles’ heel.
