A suspected China-nexus threat actor used AI tooling to chain two PHP and Linux kernel vulnerabilities into a campaign that rooted 25 servers across four countries, including three systems inside a U.S. government-affiliated environment, researchers at Dream disclosed this week.
The activity, first observed on October 25, 2026, combined PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with Fragnesia (CVE-2026-46300, CVSS 7.8), a Linux kernel privilege escalation flaw. The attacker gained root access, planted web shells on 24 of the 25 systems, and built a persistent reverse SSH tunnel into the U.S. organization's internal network.
The stakes are plain. The attacker reached Active Directory, attempted credential extraction and user enumeration, and tried to create backdoor accounts. Dream says it is unclear whether those attempts succeeded, so the full scope of the compromise remains unknown. The persistent tunnel into the U.S. government organization is likely still running.
How the attack unfolded
Dream traced the operation from a lab environment through to a live intrusion. The attacker began by using FOFA, an internet scanning service, to find roughly 19,000 firewalls with exposed management interfaces worldwide. A custom version scanner narrowed that list to about 5,000 devices that responded with operating system details.
From there the attacker filtered by geography, keeping systems in the U.S., Japan, Taiwan, and South Korea, and by software branch, keeping only newer releases running PHP 8.0.30. That left 240 targets. A batch runner then exploited the PHP2Shell-Fragnesia chain, planted a PHP web shell in a publicly accessible directory, verified root access, and logged hostnames and IP addresses to a CSV file. Twenty-four servers fell in this pass.
Two of the compromised systems belonged to a U.S. government-affiliated organization. One crashed on October 23, 2026, at 6:14 p.m. UTC and never came back online. The attacker ran a dedicated follow-up campaign and rooted a second system on October 24 at 10:09 a.m. UTC. That system became the entry point for a reverse SSH tunnel into the internal network. A third server, an internal firewall management host reachable only through the tunnel, was compromised at 11:35 a.m. UTC the same day, bringing the total to 25 rooted servers.
AI tooling in the tradecraft
The AI link rests on artifacts, not speculation. Dream found Anthropic's Claude Code installed on the attacker's infrastructure, along with API keys for FOFA and an offensive security platform called aiscan configured with models from DeepSeek and Kimi. The code structure, commenting style, and consistency across nearly 40 scripts point to AI-assisted development, according to the firm.
The recovered exploit is a custom build, not a copy of any known public PHP2Shell exploit. Dream says it follows the same underlying concept but was independently developed and tailored for the targeted firewall platform. It targets PHP's session.upload_progress mechanism on the firewall's appweb management server, and the firewall OS ships PHP 8.0.30 with a high memory limit that enables the memory corruption stages.
The affected vendor's name was not disclosed, though Dream says it notified the entity. The affected devices run specific versions of a large vendor's firewall software. The Fragnesia vulnerability itself is a Linux kernel local privilege escalation tracked as CVE-2026-46300 with a CVSS score of 7.8. On its own it requires local access, which is why pairing it with PHP2Shell matters: PHP2Shell delivers the initial remote code execution, and Fragnesia escalates that foothold to root. Neither flaw is exotic on its own. The damage came from chaining them against a known, internet-facing management plane.
What the attacker did next
Once inside, the attacker moved against Active Directory. Dream's recovered artifacts confirm credential extraction and directory enumeration. The operation attempted to decrypt the LDAP service account password, enumerate users, and spray passwords against every account using organization-themed passwords. It also tried to create backdoor Active Directory accounts.
It is not clear whether the attacker found valid credentials or successfully created backdoor accounts. The full extent of the compromise remains indeterminate.
Dream draws a geopolitical read from the target list. The U.S., Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, the firm said. That pattern, in Dream's view, indicates potential nation-state adversary efforts rather than ordinary criminal activity.
Why the PHP2Shell chain mattered here
PHP2Shell drew attention earlier this month when CISA confirmed active exploitation. Yet a member of the XSS forum, posting as c0d3x, dismissed it as "unexploitable crap," arguing that real exploitation requires offsets from libphp.so that are unique to every build and impossible to brute-force. That assessment held for most targets.
This campaign shows the exception. The attacker did not rely on a public exploit. Instead they built a custom version scanner, filtered 19,000 firewalls down to 240 matching targets, and tailored the exploit to the specific firewall platform. The offsets problem disappears when the attacker knows the exact build they are hitting.
What defenders should take from it
The chain started with an exposed management interface. Twenty-two of the rooted firewalls remain parked with active web shells, and the persistent tunnel into the U.S. government organization is likely still running. The attacker still holds a fingerprinted list of 19,000 targets they can revisit as they develop profiles for additional OS versions.
The lesson is operational, not theoretical. Patching CVE-2026-109618, CVE-2026-109619, and CVE-2026-46300 closes this specific chain, but the campaign's real enabler was an internet-facing management plane on a firewall. Organizations running the affected vendor's firewall software should check for PHP web shells in publicly accessible directories, review Active Directory for unauthorized accounts, and look for reverse SSH tunnels originating from firewall hosts.
The disclosure lands in a month Dream and others have called "Black October" for cybersecurity, with multiple major breaches and critical vulnerabilities reported across the industry. Whether this specific intrusion produced lasting damage inside the U.S. government organization is still unknown, and Dream's assessment that the tunnel is likely still running is, at this point, an educated guess rather than a confirmed fact.
Read the full Dream report at Dream Group. For related coverage of PHP2Shell exploitation, see The Hacker News. Internal coverage of cybersecurity threats is available under cybersecurity.