Cybersecurity researchers have detailed an AI-assisted campaign that combined PHP2Shell exploitation with a Linux kernel privilege escalation to gain root on 25 servers and pivot into an internal network tied to a U.S. government-affiliated environment. The activity was observed in late October 2026 and, according to the Israeli firm Dream, demonstrates a tailored, multi-stage intrusion that fused custom exploit development with automated reconnaissance at scale.
Attack overview
Dream attributes the operation to a suspected China-linked actor and says the campaign brought together two distinct vulnerability sets: PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) enabling unauthenticated remote code execution, and a kernel local privilege escalation dubbed Fragnesia (CVE-2026-46300, CVSS 7.8). The vendor of the affected firewall platform was not disclosed; Dream notified the affected organization. The firm recovered artifacts indicating credential extraction and Active Directory enumeration following the initial compromises.
The exploit chain and timeline
- Initial reconnaissance: The attackers used FOFA to discover about 19,000 internet-facing firewalls with exposed management interfaces worldwide.
- Version discovery: A custom scanner probed those devices; roughly 5,000 provided version information. The operator filtered to systems in the U.S., Japan, Taiwan, and South Korea that were running PHP 8.0.30 with a high memory limit, yielding about 240 targets.
- Automated exploitation: A batch runner automated a PHP2Shell-Fragnesia chain, planted PHP web shells in publicly accessible firewall directories, verified root access, and logged hostnames and IPs to a CSV. This process initially rooted 24 servers.
- Government-affiliated environment: Two compromised systems belonged to a U.S. government-affiliated organization. One crashed after being rooted on October 23, 2026; the attacker successfully rooted a second on October 24, 2026, and used it to create a persistent reverse SSH tunnel back to the operator infrastructure. Through that tunnel, a third internal firewall management server was reached and compromised on October 24, bringing the total rooted servers to 25.
- Post-compromise activity: The attacker targeted Active Directory to decrypt an LDAP service account password, enumerate user accounts, and perform password-spraying attempts using organization-themed passwords. There were also attempts to create backdoor AD accounts. Dream notes it remains unclear whether valid credentials were obtained or backdoors were successfully created.
AI assistance and tooling evidence
Dream’s analysis points to AI-assisted development and operational tooling: the deployment included Anthropic’s Claude Code, API keys for FOFA, and an aiscan offensive security platform configured with large language models from DeepSeek and Kimi. Researchers observed consistent code structure, commenting style, and homogeneity across nearly 40 scripts, which they interpret as indicators that AI augmented exploit and tooling development rather than the attackers copying a public exploit verbatim. Dream also reported the PHP2Shell implementation they recovered was a custom, non-public build tailored to the target firewall platform rather than a direct reuse of known public PoCs.
Technical notes from the disclosure
- The PHP2Shell component targets PHP’s session.upload_progress mechanism on the firewall’s appweb management server; the firewall OS used PHP 8.0.30 with a high memory limit that facilitated the memory corruption stages of the attack.
- Dream describes the kernel escalation—CVE-2026-46300, “Fragnesia”—as part of the chain enabling privilege escalation to root.
- The disclosure remarks that, despite public discussion of PHP2Shell, converting public proof-of-concept code into reliable attacks against real targets has been challenging because exploiting real targets typically requires offsets from libphp.so unique to each build; Dream’s observation of a custom exploit underscores an attacker effort to overcome those hurdles.
Scope, implications, and open questions
Dream found rooted firewalls across the U.S., Japan, Taiwan, and South Korea, and notes 22 of the rooted devices still had active web shells at the time of reporting. The firm warns the attacker retains the broader fingerprinted set of 19,000 targets for future campaigns as they develop profiles for additional OS versions. Given the geographic focus on the four countries and the targeting of identity infrastructure, Dream characterizes the operation as potentially consistent with nation-state-aligned activity, though attribution remains framed as suspected. The full extent of the compromise is indeterminate because it is unclear whether the Active Directory attempts yielded valid credentials or persistent backdoors.
What remains uncertain
Several key points remain unresolved in Dream’s disclosure: the affected firewall vendor was not named; it is unclear whether the attacker successfully harvested valid credentials or established long-term persistence inside the targeted organization beyond the observed reverse SSH tunnel; and the long-term status of the persistent tunnel into the U.S. government-affiliated environment is unknown. Dream’s artifacts indicate lab-based exploit development preceded the operation, but the precise provenance of the custom toolset and the degree of human versus AI involvement in decision-making are not fully established.
Licensed under CC BY-ND 4.0 International