PHP2Shell Chain Roots 25 Firewalls and Breaches a US Government Network

A week ago PHP2Shell was a patch-race story: two critical PHP bugs, an emergency release, and the usual argument about how fast you can update every box. On October 26 the Israeli security firm Dream turned it into something sharper — a live intrusion in which a suspected China-nexus operator chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, most of them internet-facing firewalls, and pivot into the Active Directory domain of a US government-affiliated organization. The attacker's toolkit included Claude Code and a Chinese scanner wired to the DeepSeek and Kimi models. This is the shape of the thing defenders have been bracing for: a public RCE, weaponized within days, driven by an operator who works at machine speed.

Developing story — first published 17:34 CET (16:34 UTC), October 28, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-109618 · CVE-2026-109619 (PHP2Shell) chained with CVE-2026-46300 (Linux kernel LPE, "Fragnesia")
Product / affected versions	PHP web SAPIs · < 8.2.35 · < 8.3.36 · < 8.4.27 · < 8.5.12; the breached firewalls ran PHP 8.0.30 (end-of-life). Firewall vendor not disclosed
Fixed in	PHP 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 (released 2026-10-21); source backports for 7.4 · 8.0 · 8.1
CVSS	109618: 9.8 critical (NVD CVSS 3.1) · 9.2 critical (PHP CNA 4.0); 109619: 8.1 high (NVD 3.1) · 9.2 (PHP CNA 4.0); 46300: 7.8 high
Exploited in the wild	Yes · CISA KEV; Dream observed a campaign rooting 25 servers on 2026-10-23/24
CISA KEV	Both added 2026-10-26; federal due date 2026-10-29 (BOD 26-04, forensic triage required). CVE-2026-46300 not listed (catalog 2026.10.27)
Public PoC	Yes · the "PHP2Shell" tool is public; per Sansec, public PoCs need extra conditions against a default install
Official advisory	PHP security releases · Dream research report

What PHP2Shell did this time

Dream's account reads like an operations log because it is one. Setup began October 8; exploitation and the pivot ran through October 24. The operator pulled roughly 19,000 candidate firewalls from the Chinese scanning service FOFA, filtered to about 5,000 live hosts and then 240 targets, and ran automated batch exploitation — five concurrent sessions, a 1,800-second timeout each. PHP2Shell landed on the firewall's appweb server (PHP 8.0.30) through the session.upload_progress path; each success planted a 103-byte PHP root webshell and confirmed root with id. Twenty-four firewalls fell across the United States, Japan, Taiwan, and South Korea; 22 were left "owned and parked" with webshells.

The kernel exploit is what made this more than a web-shell spree. Dream reports the operator used a Linux kernel local privilege-escalation flaw it nicknames "Fragnesia" (CVE-2026-46300, CVSS 7.8) to overwrite /etc/pam.d/su with pam_permit.so — turning su into a no-questions-asked root switch. From a rooted firewall the operator stood up an eight-port reverse SSH tunnel with a SOCKS5 proxy, persisted through a systemd service and an rc.local hook, and used it to reach the internal firewall management server.

That management server is where it stopped being an appliance problem. Its configuration exposed domain controllers, a Keycloak SSO server, a GitLab instance, VPN gateways, and an Active Directory domain. Dream confirms the operator decrypted an LDAP service-account password and enumerated every user and group; it reports — but could not confirm success of — a password spray against an environment with lockoutThreshold=0, backdoor user and machine-account creation abusing the default MachineAccountQuota, and attempts to extract SAML signing keys from a Keycloak server configured with validate-idp-certificate: no.

The AI angle is real but bounded, and Dream is careful about it: Claude Code was installed, a scanner called aiscan was configured with DeepSeek and Kimi, and the structure and commenting across roughly 40 scripts "suggest AI-assisted development." But Dream states plainly there is "no direct evidence" the models wrote the exploit or ran the attack. The China-nexus read rests on circumstantial signals — US/Japan/Taiwan/South Korea targeting, FOFA, the iox tunneling tool, UTC+8 timestamps, and Chinese-language prompts in the aiscan logs — and Dream does not name a threat actor. Tom's Guide summarized the same caution in its headline: AI tools "may have helped." Treat the AI here as a force multiplier for a human operator, not an autonomous attacker.

Who is exposed to the PHP2Shell chain

The entry bug is in PHP itself, but the damage lands wherever PHP runs on an internet-facing path — and the breached boxes were firewalls bundling an end-of-life interpreter. PHP 8.0 reached end of life in November 2023; 8.0.30 gets no project binary release, only a source backport that appliance vendors have to pick up and ship. That is the structural problem: the organizations rooted here almost certainly could not apt upgrade their way out, because the vulnerable PHP was inside a vendor's firmware.

Check what you actually run:

• PHP version, everywhere: php -v on hosts, but also inside every CMS, control panel, and appliance. session.upload_progress is on by default — php -i | grep -i upload_progress shows it.
• Edge appliances: inventory any internet-facing device with a web admin interface and ask the vendor which PHP branch its firmware bundles and whether it has shipped the fix.
• The pivot targets: if a rooted appliance could reach a domain controller, Keycloak, GitLab, or a management plane, that path is the breach — not the webshell.

Remediation

CISA added both PHP2Shell CVEs to the KEV catalog on October 26 with a federal due date of October 29 and a forensic-triage requirement under BOD 26-04 — a three-day clock because the flaw is being used to break into real networks right now. The step-by-step runbook (per-platform patch commands, EOL backports, and config stopgaps) lives in our PHP2Shell CVE write-up; the free php2shell-check.sh tells you in seconds whether a host is vulnerable. The campaign-specific actions:

1. Patch — PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. For EOL branches (7.4/8.0/8.1), apply the source backport or press your appliance vendor for patched firmware. An EOL interpreter on an internet-facing firewall is the exact failure mode Dream documented.
2. Can't patch the appliance today? A web application firewall in front of the admin interface buys time, and taking the management plane off the public internet removes the attack surface entirely. CISA's guidance is blunt: patch or shut it down.
3. Hunt for this chain — not just the entry. Look for a 103-byte PHP file in a web-reachable directory; /etc/pam.d/su modified to load pam_permit.so; unexpected systemd units or rc.local entries starting an SSH tunnel; SOCKS5/reverse-SSH egress from an appliance that should never dial out (T1572, tunneling); PHP worker processes spawning shells (T1505.003, web shell; T1190, exploit public-facing app). On the AD side: LDAP service-account use from the firewall management host, bulk user/group enumeration, password-spray bursts, and new machine accounts (T1136, create account).
4. Eradicate and verify after patching. Rotate the LDAP service-account password and anything reachable from it, revoke attacker-created AD accounts, pull HA-replication, TLS, and device-authentication private keys that lived on a rooted firewall, and rebuild — a box with an overwritten pam.d and a parked webshell is not cleaned, it is reinstalled.

What is not known yet

• The firewall vendor and affected firmware versions are not disclosed. Dream notified the vendor; until there is a named advisory, the device-level fix is "ask your vendor."
• Whether the AD compromise succeeded. Dream confirms LDAP-password decryption and domain enumeration, but marks the password spray, backdoor-account creation, and SAML-key extraction as attempted, outcome unknown.
• The kernel CVE mapping. The LPE is reported by Dream as "Fragnesia" / CVE-2026-46300; the public NVD record for that ID describes a kernel network-stack fragment-handling bug and is not KEV-listed. Confirm against your kernel vendor before relying on the exact identifier.
• Attribution. The China-nexus read is Dream's, drawn from circumstantial indicators; no named actor, and no confirmed government involvement.

The lesson sits in the pivot, and so does the defensive answer. The webshell on the firewall was effectively invisible — it is an appliance running an interpreter you can't instrument, and the victim's first real evidence was behavior, not an endpoint log: a tunnel dialing out, an LDAP service account authenticating from a device that never touches AD, enumeration and spray bursts crossing the wire. Zero Hunt's traffic engine is built for exactly that blind spot — a deep-learning model with four inference heads (suspicious traffic, malware, attack type, application fingerprint) trained on billions of PCAP sequences, running on the on-premise appliance GPU, flagging the SOCKS5 tunnel and the out-of-place service-account auth while the pivot is happening, not in the next morning's SIEM digest. And because attackers now chain a public RCE to a kernel LPE to a domain breach faster than a quarterly test can react, the honest defensive posture is to run the same chain against yourself first: Zero Hunt is an autonomous AI red team that fingerprints the exact appliance and PHP build on your perimeter, writes a per-target exploit, and — with a human approving every step that matters — proves whether that firewall reaches your domain controller before someone else's operator does.