A suspected China-nexus operation used the newly disclosed PHP2Shell vulnerabilities to obtain root access to internet-facing firewalls, maintain persistence with webshells and penetrate a U.S. government-affiliated environment, according to research from Dream reported by SecurityWeek. Dream said it has not tied the activity to a named threat group, so the China link remains an assessment rather than a confirmed attribution.
The attackers reportedly used the PHP flaws, CVE-2026-109618 and CVE-2026-109619, to gain unauthenticated remote code execution before chaining them with the Linux kernel privilege-escalation vulnerability CVE-2026-46300, which researchers call “Fragnesia.” Dream said the operation identified roughly 19,000 internet-facing firewalls through the FOFA asset-search service, narrowed the pool to about 240 systems in the U.S., Japan, Taiwan and South Korea, and exploited 25 devices on Oct. 23 and 24.
Root-level access was established on 24 firewalls, where the operators installed a PHP webshell, although Dream observed no follow-on activity on 22 of them. On two systems associated with a U.S. government-affiliated organization, the attackers went further: they deployed a reverse SSH tunnel, compromised an internal firewall-management server and accessed the configurations, credentials and settings for the firewalls managed by the organization.
The intrusion then extended into the environment’s identity infrastructure. Dream said the attackers decrypted an LDAP service-account password, enumerated domain users and groups, conducted password-spraying attempts and tried to create backdoor Active Directory accounts. The report described an automated exploitation tool and noted that one targeted firewall crashed after the first attack wave; the operators sent 240 probes over two hours while waiting for it to recover, then successfully attacked another system during a second wave.
PHP2Shell presents a particularly serious risk because both flaws affect PHP installations serving web requests and can enable remote code execution before authentication. The PHP development team rated both vulnerabilities 9.2 critical under CVSS v4.0 and released fixes on Oct. 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the official PHP security advisory. The advisory describes CVE-2026-109618 as an out-of-memory corruption issue and CVE-2026-109619 as a stale internal request-state issue.
CISA added both PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 26, confirming exploitation in the wild and underscoring the urgency for federal agencies and other operators. Administrators should inventory PHP on web servers and appliances, update to a fixed supported release, restart PHP workers and review firewall and management-server logs for unexpected webshells, reverse SSH connections, new accounts, password spraying and access to LDAP credentials. Patching PHP alone may not remove an attacker who already obtained root access, making forensic review and credential rotation necessary where compromise is suspected.
