PHP2Shell Attack Roots 25 Firewalls and Breaches a US Government Network

A suspected China-linked hacking operation used the PHP2Shell vulnerabilities to take full control of 25 systems in the United States, Japan, Taiwan and South Korea, including three servers belonging to a US government-affiliated organization. The attacker chained PHP2Shell with a Linux kernel flaw called Fragnesia to get root access on firewalls, planted web shells, then used one firewall as a bridge into the victim's internal network and its Active Directory.

The findings come from Israeli cybersecurity firm Dream, which recovered the attacker's own tools and logs. Dream says the operation appears to have been built with help from AI coding tools, including traces of Anthropic's Claude Code and an offensive security platform configured with Chinese AI models.

This is the first detailed, real-world case of PHP2Shell being turned into a working attack against a specific product, a week after PHP rushed out emergency patches. Below is what happened, how the exploit chain worked, why the "firewall as the way in" detail matters, what the AI angle really shows and what defenders should check today.

PHP2Shell attack: the key facts

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They can allow unauthenticated remote code execution: an attacker who can reach a vulnerable PHP application can run commands on the server without logging in.

The disclosure was messy. The bugs were under embargo, with public details planned for October 22, but they leaked online two days early, and the "PHP2Shell" name comes from an exploit tool shown in leaked screenshots rather than from PHP itself. PHP shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, with a remediation deadline of October 29 for federal agencies.

Two details from the patch rollout matter for this story:

• Older branches got no official release. PHP 8.1 and older are end of life. PHP published only minimal source patches for 7.4, 8.0 and 8.1, with no official tarballs or binaries, leaving distributions and vendors to package their own fixes.

• The common workaround isn't enough. Disabling session.upload_progress.enabled blocks only one confirmed path for one of the two bugs. PHP's own advisory says CVE-2026-109618 is a separate path that the setting doesn't block. Patching is the real fix.

The disclosure triggered millions of hacking attempts and took government and company websites offline in Japan, Europe and elsewhere, prompting rare public warnings from Japan's Prime Minister and the FBI. ByteMuni has covered how to patch PHP2Shell on PHP web servers and the PHP2Shell RCE flaws in detail.

What is Fragnesia?

Fragnesia, tracked as CVE-2026-46300 (CVSS 7.8), is a Linux kernel local privilege escalation flaw in the XFRM ESP-in-TCP networking code. It lets a local attacker corrupt the kernel page cache and gain root access. It was found by William Bowling of the V12 security team and disclosed in May 2026, and major distributions including Debian, Ubuntu, Red Hat, SUSE and Amazon Linux have shipped patches. A public proof-of-concept exists.

On its own, a local privilege escalation bug needs an attacker to already be on the machine. That's exactly what PHP2Shell provides. Chained together, the two flaws go from "no access" to "root" in one automated run.

How the PHP2Shell firewall attack unfolded

Dream reconstructed the operation from artifacts the attacker left behind. Here's the sequence, as reported by The Hacker News and SecurityWeek.

1. Find the targets. The attacker used FOFA, a Chinese search engine that indexes internet-connected devices, to find about 19,000 firewalls with exposed management interfaces from one vendor.

2. Fingerprint the versions. A custom scanner checked which devices were online and which operating system version they ran. About 5,000 responded with version information.

3. Filter by country and build. The attacker kept only devices in the US, Japan, Taiwan and South Korea running newer release branches with PHP 8.0.30. That left 240 targets.

4. Exploit in bulk. An automated batch runner fired the PHP2Shell and Fragnesia chain at the list, planted a PHP web shell in a publicly accessible directory, checked for root access and logged each victim's hostname and IP address to a CSV file.

5. Go after the government network. Two of the rooted systems belonged to a US government-affiliated organization. The first was rooted on October 23 at 18:14 UTC, then crashed and never came back, even though the attacker sent 240 automated probes over two hours waiting for it to recover. The second had timed out during the batch run, so the attacker launched a dedicated attack and rooted it on October 24 at 10:09 UTC.

6. Tunnel inside. From the second firewall, the attacker built a reverse SSH tunnel back to their own infrastructure. At 11:35 UTC, they used the same exploit chain through the tunnel to root an internal firewall management server that wasn't reachable from the internet. That brought the total to 25 rooted systems.

7. Attack the identity system. The attacker decrypted the password of an LDAP service account, enumerated users and groups in Active Directory, sprayed organization-themed passwords against every user account and tried to create backdoor accounts.

It's not yet known whether the attacker obtained valid credentials or created working backdoor accounts, so the full extent of the compromise is unclear. Dream says it notified the affected entity but hasn't named the firewall vendor. The Hacker News reports that Dream observed the activity on October 25, while Dream's own timeline places the intrusions on October 23 and 24.

How the exploit worked

Dream says the PHP2Shell exploit it recovered was "a custom, non-public build, not a copy of any known public exploit." It follows the same idea as the public research but was developed independently and tailored to this specific firewall platform.

According to Dream, the exploit targets PHP's session.upload_progress mechanism on the firewall's appweb management server. The firewall's operating system runs PHP 8.0.30 with a high memory limit, which makes the memory corruption stages of the attack possible.

That's important for two reasons:

• PHP 8.0 is end of life. PHP 8.0 reached end of life in November 2023, and PHP2Shell's official fixes cover only 8.2 and newer. A device vendor that embeds PHP 8.0 has to build its own patch. Until it does, customers can't fix the bug themselves.

• Weaponizing PHP2Shell is hard, which makes this case stand out. Many criminals have struggled to turn the public proof-of-concept into a reliable attack. Threat intelligence firm Flare quoted a member of the XSS cybercrime forum calling it "unexploitable crap", because real targets need memory offsets from libphp.so that are unique to each build. A fixed appliance image solves that problem for the attacker: every firewall running the same build has the same offsets. Mass-produced devices turn a hard bug into a repeatable one.

Why "the firewall became the way in" is the real story

Firewalls sit at the edge of a network to keep attackers out. In this campaign, they were the entry point.

Edge devices are attractive targets for three reasons. They're exposed to the internet by design. They often run old software components, like PHP 8.0 here, that customers can't update directly. And they usually can't run the endpoint detection tools that would spot a web shell on a normal server.

The internal management server is the bigger prize. It holds the configuration and credentials of every firewall the organization manages. Dream warns that by taking it over, the attacker likely gained access to the settings and authentication data for the rest of the organization's firewall fleet.

Dream summed up the lesson: "The operation illustrates how an exposed management interface can become a path into an organization's identity infrastructure." It also warned that the 22 other rooted firewalls remain parked with active web shells, the tunnel into the US government organization is likely still running, and the attacker still has 19,000 fingerprinted devices to revisit as they build exploits for other software versions.

The China link and the AI angle

Why researchers suspect China. Dream hasn't attributed the operation to a named group, but several clues point to a China-nexus actor. The attacker used FOFA, a Chinese device search engine. The attack systems were set to China Standard Time, Korea JoongAng Daily reported. And the target list was limited to the US, Japan, Taiwan and South Korea, which Dream describes as the four primary strategic intelligence targets for Chinese state-aligned cyber operations in the Pacific. That's strong circumstantial evidence, not proof. Time zones and tools can be faked, and attribution usually takes much longer than a week.

What the AI evidence shows. Dream found Anthropic's Claude Code installed on the attack infrastructure, along with API keys for FOFA and for aiscan, an AI-powered offensive security platform configured with models from DeepSeek and Kimi. It also says the code structure, commenting style and consistency across nearly 40 scripts suggest AI helped write the tooling.

It's worth being precise about what that means. The evidence shows AI tools were present and likely used to write and organize code. It doesn't show that an AI found the vulnerability or ran the attack on its own. The hard parts, a custom exploit for a specific firewall build, still look like the work of skilled operators. What AI seems to have done is speed up everything around them: scanning scripts, the batch runner, logging and the post-exploitation tooling.

That fits a pattern security experts have been warning about all year: AI makes attacks faster and cheaper to build and run at scale. It's the same reason we argued in our guide to how agentic AI works that tool-using agents need hard limits. The same capabilities that let a developer automate a refund workflow let an attacker automate a 240-target exploitation run.

Was South Korea affected?

South Korean outlets including KBS and Korea JoongAng Daily highlighted the story because Korea was one of the four target countries. According to Korea JoongAng Daily, it hasn't been confirmed whether any Korean systems were among the 25 compromised, or how much data, if any, was stolen. What's confirmed is that Korean firewalls were on the attacker's 240-device target list.

What defenders should do now

If you run firewalls, VPN gateways or other network appliances, here's a practical checklist.

1. Find out what your appliances run. Ask your vendor directly whether your firewall, VPN or management server includes PHP, which version, and whether it's affected by CVE-2026-109618 or CVE-2026-109619. Don't assume "it's a firewall, so it's not PHP".

2. Take management interfaces off the internet. This campaign started with 19,000 exposed management interfaces. Put management behind a VPN or a dedicated management network, and restrict access to known administrator IP addresses.

3. Patch PHP and the kernel together. Install vendor firmware that fixes both PHP2Shell and Fragnesia. On your own Linux servers, update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, and apply your distribution's kernel update for CVE-2026-46300. If you're still on PHP 8.0 or 8.1, plan a move to a supported branch.

4. Hunt for web shells. Look for unexpected .php files in web-accessible directories on appliances and servers, especially files created after October 20. Ask your vendor for an integrity-check procedure if you can't inspect the file system yourself.

5. Watch for reverse tunnels. Alert on outbound SSH or unusual long-lived connections from firewalls and management servers. A firewall should rarely, if ever, start an SSH session to the internet.

6. Check Active Directory. Rotate the passwords of LDAP service accounts used by network appliances. Review Windows security logs for signs of password spraying, such as failed logons (event ID 4625) and failed Kerberos pre-authentication (event ID 4771) spread across many accounts, and for unexpected new accounts (event ID 4720).

7. Treat the management server as tier zero. If a central firewall manager holds credentials for your whole fleet, protect it like a domain controller: no internet reachability, strict access, multi-factor authentication and close monitoring.

If you run PHP in containers, our guide to PHP2Shell Docker updates and rollout checks covers image rebuilds and verification.

My take

The most important line in this story isn't about China or AI. It's "PHP 8.0.30". A security appliance, sold to protect government networks, was running a PHP branch that went out of support years ago. When PHP2Shell arrived, there was no official fix for that branch, so every customer had to wait for the vendor.

This is the hidden supply-chain problem with appliances. You can't run apt upgrade on most firewalls. You inherit whatever the vendor bundled, and you depend on them to notice and fix it. Attackers know that, which is why edge devices keep showing up in serious intrusions.

The AI detail is real but easy to overstate. Claude Code and aiscan didn't invent this attack. They helped someone who already knew what they were doing build and run it faster across 240 targets. That's the realistic near-term threat from AI in cybersecurity: not robots discovering zero-days on their own, but skilled teams doing more, faster and at larger scale. The defense is the same as it always was, applied with more urgency: keep management interfaces private, patch quickly and watch your identity systems.

The bottom line

A suspected China-linked attacker turned PHP2Shell into a working, custom exploit for one vendor's firewalls, chained it with the Fragnesia Linux kernel flaw and rooted 25 systems in the US, Japan, Taiwan and South Korea. Inside a US government-affiliated network, one compromised firewall became a tunnel to an internal management server and Active Directory.

If you manage network appliances, the actions are clear: find out whether your devices embed vulnerable PHP, take management interfaces off the internet, apply vendor patches for both flaws, hunt for web shells and reverse tunnels, and check your directory for signs of password spraying. More coverage is in ByteMuni's cyber security section.

This is a developing story. Details are as reported by Dream, The Hacker News, SecurityWeek, Korea JoongAng Daily and KBS up to October 29, 2026.

Sources

• PHP2Shell attack roots 25 servers, breaches US government-affiliated network — The Hacker News, Oct 28, 2026

• China-linked hackers exploit PHP2Shell to root firewalls — SecurityWeek, Oct 28, 2026

• Chinese 'fingerprints' found on PHP firewall hack — Korea JoongAng Daily, Oct 29, 2026

• PHP cyberattack breaches 25 firewalls linked to S. Korea, US, Japan — KBS World, Oct 29, 2026

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what to do now — Strobes

• php2shell needs the PHP patch, not just session.upload_progress=0 — lilting.ch

• Linux kernel bug Fragnesia allows local root access attacks — Security Affairs