PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Security firm Dream has uncovered an apparent AI-assisted campaign by a suspected China-nexus actor that chained the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with the Fragnesia Linux kernel privilege-escalation bug (CVE-2026-46300, CVSS 7.8) to gain root on exposed firewall management interfaces. On October 25, 2026, the attacker used this custom exploit chain to compromise 25 devices across the US, Japan, Taiwan, and South Korea, including three servers tied to a US government-affiliated network, where they went on to probe Active Directory for credentials and attempted to plant backdoor accounts. Investigators found signs that tools like Claude Code and AI-driven scanning platforms helped automate reconnaissance and exploit development against roughly 19,000 fingerprinted internet-facing firewalls, though it remains unclear whether the credential-harvesting effort ultimately succeeded. The unnamed vendor has reportedly been notified, but dozens of rooted devices and a persistent tunnel into the US organization may still be active.