Hackers combined PHP2Shell vulnerabilities with a Linux kernel exploit to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Dream researchers uncovered the campaign’s files on October 25, revealing a path from exposed firewall management interfaces to internal Active Directory services.

According to Dream’s investigation, the recovered material included custom exploits, target lists, attack logs, and roughly 40 scripts for activity after compromise. The affected firewall vendor has been notified, but its name and vulnerable software versions remain withheld for security reasons.

PHP2Shell Exploit Chain Gained Root

The attack paired PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege escalation flaw tracked as CVE-2026-46300. Dream described the PHP2Shell code as a custom, nonpublic implementation tailored to the targeted firewall platform, rather than a copy of a known public exploit.

PHP2Shell targeted PHP’s session.upload_progress feature within the firewall’s appweb management server. Through several stages, the attacker exhausted memory, leaked a memory address, and manipulated damaged memory structures to run commands as the restricted nobody user. Fragnesia then changed local authentication data, allowing the attacker to become root without a password.

The full chain reportedly installed a root webshell in under 15 minutes. Although the final request connected both exploits, earlier requests prepared memory for execution. Cyber Security News previously covered PHP2Shell exploitation and the underlying flaws, providing context for this campaign.

Using FOFA, the attacker identified about 19,000 internet-facing firewalls. Roughly 5,000 returned version information, and filtering by location and software version narrowed the list to 240 targets. The operation ultimately compromised 24 firewalls, leaving webshells on 22 without further recorded activity beyond that initial access.

Two firewalls linked to a US government-affiliated organization received closer attention. Configuration data exposed internal systems and network details. After the first firewall crashed, the attacker compromised the second on October 24 and established a reverse SSH tunnel forwarding eight internal ports. Startup settings allowed the tunnel to survive reboots.

At 11:35 UTC that day, the attacker used the same exploit chain through the tunnel against an internal firewall management server. This became the 25th compromised system and exposed centrally managed firewall settings and credentials.

PHP2Shell and Fragnesia root — Attack Path

From there, the attacker decrypted an LDAP service account password and listed Active Directory users and groups. Password spraying, backdoor account creation, and SAML signing key theft were attempted, but their success remains unknown. These limits matter when assessing Active Directory attack paths, rather than assuming full domain control.

Recovered systems contained Claude Code and an aiscan setup configured with DeepSeek and Kimi. Chinese-language prompts and UTC+8 timestamps supported Dream’s assessment of possible Chinese links. However, researchers found no direct proof that AI wrote the exploits, established no named actor attribution, and did not describe the campaign as fully autonomous.

Dream recommends deploying relevant patches under vendor guidance. The broader concern is stolen access: fixing the entry point does not establish whether credentials, webshells, or tunnels remain usable. Investigators must distinguish confirmed credential theft and directory access from the still unverified outcomes of the attacker’s later identity attacks.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers appeared first on Cyber Security News.