Cybersecurity researchers have uncovered a sophisticated attack chain where hackers combined PHP2Shell vulnerabilities with a specific Linux kernel flaw to obtain root access on 25 servers globally. The compromised systems include those within the United States, Japan, Taiwan, and South Korea, notably involving three servers linked to a US government-affiliated organization. This campaign was brought to light by Dream researchers on October 25 who detailed the attack’s progression from exposed firewall interfaces to internal Active Directory services.
Details of the Cyber Attack
The investigation by Dream revealed a trove of malicious files, including custom exploits, target lists, and attack logs, along with approximately 40 post-compromise scripts. Although the affected firewall vendor has been alerted, the specific software versions and vendor name remain undisclosed for security considerations.
The attack method employed PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, in conjunction with Fragnesia, a Linux kernel privilege escalation vulnerability (CVE-2026-46300). Dream’s analysis describes PHP2Shell as a custom-built tool specifically designed for the targeted firewall framework, differing from known public exploits.
Technical Exploitation Process
The PHP2Shell exploit targeted a specific PHP feature within the firewall’s management server, allowing attackers to manipulate memory and execute commands under restricted user privileges. Following this, the Fragnesia exploit modified authentication data, enabling root access sans password.
This chain of exploits reportedly installed a root webshell swiftly within a 15-minute window. Initial requests laid the groundwork for execution, connecting the two vulnerabilities. Cyber Security News has previously highlighted the mechanisms behind PHP2Shell, offering context to this malicious campaign.
Impact and Wider Consequences
Utilizing the FOFA search engine, the attackers identified nearly 19,000 internet-facing firewalls, narrowing these down to 240 targets. Of these, 24 firewalls were compromised, with 22 left with webshells but no further activity recorded. Two firewalls, associated with a US government environment, revealed internal systems and network configurations. When one firewall failed, the attacker swiftly compromised another, establishing a persistent SSH tunnel.
Subsequent exploitation exposed centralized firewall settings and credentials. Further, the attacker decrypted LDAP passwords and attempted additional attacks such as password spraying and account creation. However, the success of these attempts remains unverified.
Recovered systems contained tools like Claude Code and aiscan, featuring Chinese-language prompts and timestamps, suggesting potential Chinese involvement. Despite these indicators, no definitive actor attribution was made, nor were the exploits proven to be AI-generated.
Dream advocates for prompt patch deployment as directed by vendors. They also stress the importance of addressing stolen credentials and webshells, as fixing entry vulnerabilities does not guarantee security against subsequent attacks. As AI accelerates the pace of cyber threats, defenses must be prepared to counteract at comparable speeds.
