Cybersecurity firm GreyNoise said it has seen at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619, colloquially known as “PHP2Shell.” The bugs were added to a U.S. government catalog of exploited vulnerabilities this week, and federal agencies were given until Thursday to install patches. Another cybersecurity company, Dream, released a lengthy report detailing what it claims is a campaign by a Chinese threat actor involving the compromise of U.S. government-affiliated servers using the PHP2Shell exploit chained with another exploit of a large, unnamed vendor’s firewall software.
Kfir Fleischer, Dream’s vice president of cyber research, told Recorded Future News that the attacker used PHP2Shell to execute commands on the firewall but it wasn’t enough to achieve full control, so they chained it with another vulnerability — CVE-2026-46300. The vulnerability, which affects Linux, was added to the same U.S. catalog of exploited bugs on Wednesday. “We recovered a custom PHP2Shell implementation tailored to the targeted firewall platform, version-specific profiles, exploitation logs and post-exploitation scripts,” Fleischer said. “The recovered logs record successful exploitation, including verification of root access by executing the id command through the installed webshell.”
