AI-assisted PHP2Shell attack roots 25 servers including US government systems

Cybersecurity researchers at Dream have disclosed a sophisticated, AI-assisted cyber operation observed on October 25, 2026. A suspected China-nexus threat actor leveraged the PHP2Shell vulnerability chain to compromise 25 servers, including three within a U.S. government-affiliated environment.

What happened

The attack targeted internet-facing firewalls running specific versions of a large vendor’s software, though the vendor’s name was not publicly disclosed. Dream notified the affected entity. The intrusion began with the exploitation of two distinct vulnerabilities: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and Fragnesia (CVE-2026-46300). PHP2Shell allows unauthenticated remote code execution with a CVSS score of 9.2, while Fragnesia is a Linux kernel local privilege escalation flaw with a score of 7.8.

The attacker did not use public exploit code. Instead, they deployed a custom, non-public build tailored specifically for the targeted firewall platform. This custom implementation targeted the PHP session.upload_progress mechanism on the firewall’s appweb management server. The operating system ran PHP 8.0.30 with a high memory limit, which facilitated the memory corruption stages required for the attack. Once initial access was gained, the Fragnesia kernel exploit was used to escalate privileges to root.

After rooting the systems, the attacker focused on three servers in the U.S. government-affiliated network. They established a persistent reverse SSH tunnel from a compromised firewall to their infrastructure, allowing them to reach an internal management server that was not directly exposed to the internet. The attacker then moved laterally to target Active Directory, attempting to decrypt LDAP service account passwords, enumerate users, and perform password spraying. It remains unclear if valid credentials were successfully extracted or if backdoor accounts were created.

How it works

The operation relied heavily on artificial intelligence to augment the development and execution of the attack. Forensic artifacts revealed the installation of Anthropic’s Claude Code within the attack infrastructure. Additionally, the attacker used API keys for FOFA, a search engine for internet-connected devices, and an AI-powered offensive security platform called aiscan. This platform was configured with large language models from DeepSeek and Kimi. The consistency in code structure and commenting style across nearly 40 scripts suggests that AI tools were used to generate and refine the exploit code.

The attack followed a systematic funnel. First, the attacker used FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces. A custom version scanner then checked these devices, with about 5,000 responding with version information. The attacker filtered this list by geography, focusing on the U.S., Japan, Taiwan, and South Korea, and further narrowed it to systems running PHP 8.0.30. This process yielded 240 high-value targets.

An automated batch runner then executed the PHP2Shell-Fragnesia exploit chain against these 240 targets. The script planted a PHP web shell, verified root access, and logged successful compromises. This automation allowed the attacker to root 24 servers efficiently before manually pivoting to the specific government-affiliated targets for deeper infiltration.

Key details

• The attack combined PHP2Shell (CVE-2026-109618/109619) for remote code execution and Fragnesia (CVE-2026-46300) for privilege escalation.
• AI tools including Claude Code, aiscan, DeepSeek, and Kimi were used to develop and manage the custom exploit scripts.
• Approximately 19,000 firewalls were scanned, resulting in 25 rooted servers across the U.S., Japan, Taiwan, and South Korea.
• The attacker established a persistent reverse SSH tunnel to access an internal firewall management server not directly exposed to the internet.
• Post-exploitation activities included Active Directory enumeration, LDAP password decryption attempts, and password spraying.
• The custom exploit targeted PHP 8.0.30’s session.upload_progress mechanism, leveraging high memory limits for memory corruption.

Why it matters

This incident highlights the growing role of AI in lowering the barrier to entry for complex exploit development. While PHP2Shell has been considered difficult to exploit in the wild due to the need for specific memory offsets from libphp.so, AI assistance allowed the attacker to create a reliable, custom weaponization tailored to a specific build. This challenges the assumption that obscure or difficult-to-exploit vulnerabilities provide sufficient safety through obscurity or complexity.

For software engineers and security leads, the breach underscores the risk of exposed management interfaces. Even if a device is a perimeter security tool like a firewall, its management layer can become an entry point into critical identity infrastructure such as Active Directory. The ability of the attacker to pivot from a rooted firewall to internal servers via a reverse tunnel demonstrates that perimeter defenses alone are insufficient without robust internal segmentation and monitoring.

What you can do

• Audit all internet-facing management interfaces and ensure they are not exposed to the public internet unless absolutely necessary.
• Verify that your firewall and server operating systems are not running PHP 8.0.30 or other versions vulnerable to CVE-2026-109618 and CVE-2026-109619.
• Apply patches for the Fragnesia kernel vulnerability (CVE-2026-46300) to prevent local privilege escalation if initial access is gained.
• Monitor for unusual outbound SSH connections, particularly reverse tunnels, which may indicate a compromised host communicating with external infrastructure.
• Review Active Directory logs for signs of LDAP service account decryption attempts, user enumeration, or password spraying attacks.
• Implement strict network segmentation to prevent compromised perimeter devices from accessing internal management servers and identity systems.