Exploiting the PHP2Shell vulnerabilities, a suspected threat actor linked to China appears to have conducted an AI-assisted intrusion, resulting in the compromise of 25 servers, including those associated with U.S. government entities.
Dream researchers have published findings regarding an attack that occurred on October 25, 2026. This operation involved an assailant combining the PHP2Shell vulnerability with a kernel privilege escalation exploit to achieve root access.
According to Dream, researchers observed that suspected Chinese attackers developed a custom PHP2Shell exploit and subsequently rooted twenty-five servers. These compromised systems included Palo Alto Networks firewalls that were connected to organizations affiliated with the U.S. government. The surveillance activities commenced on October 23, targeting various entities across the United States, Japan, Taiwan, and South Korea, with a particular focus on government-affiliated firewalls.
"Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign - all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet," stated the Israeli AI cybersecurity startup in its report. Furthermore, Dream observed that the attackers "likely still" maintain remote access to the networks of the organizations they infiltrated.
The initial compromise of the first U.S. government-affiliated firewall took place on October 23; however, this device subsequently failed, possibly due to approximately 900 MB of exploit traffic. Dream reported that the device remained unresponsive even after 240 automated checks conducted over a two-hour span. The second firewall was successfully exploited a day later, on October 24. These compromised firewalls were running outdated versions of Palo Alto Networks' PAN-OS. Palo Alto Networks' Unit 42 researchers independently validated the attacker's tools and concurred with the findings reported by Dream, noting that Dream had been collaborating with the vendor on the investigations.
To gain entry to the firewalls, the attackers constructed a bespoke exploit sequence incorporating PHP2Shell and a flaw in the Fragnesia kernel, and they executed roughly 40 custom post-exploitation scripts after gaining presence within the targeted organizations. The entire attack sequence was completed in under fifteen minutes.
PHP2Shell, which encompasses CVE-2026-109618 and CVE-2026-109619, became publicly known early last week, accompanied by widespread apprehension that these bugs could be exploited to disrupt a significant portion of the internet. Even with "hundreds" of proof-of-concept repositories for PHP2Shell available on GitHub, concrete reports of successful attacks did not emerge until Saturday. Both identified bugs possess a CVSS score of 9.2 and can be utilized without requiring authentication to execute code on vulnerable PHP servers. The specific PHP2Shell exploit recovered by Dream was not a replication of any publicly documented exploit; the researchers commented that it "appears to have been independently developed and tailored specifically for the targeted firewall platform."
The adversaries integrated PHP2Shell with Fragnesia (CVE-2026-46300), which represents a high-severity local privilege-escalation vulnerability situated within the Linux kernel's XFRM ESP-in-TCP subsystem. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this Linux kernel bug to its registry of Known Exploited Vulnerabilities on Wednesday. Both CISA and the Federal Bureau of Investigation declined to provide any statements.
These malicious actors devised a four-stage PHP2Shell exploit that allowed them to run commands without authentication on vulnerable Palo Alto Networks firewalls. Following this, they leveraged Fragnesia to elevate their privileges and attain root status. The targets included PAN-OS versions 12.1 and 12.2, which utilize PHP 8.0.30, a version possessing a high memory limit that facilitated the memory-corruption stages of the exploit. The Dream team documented that "The total chain - from unauthenticated HTTPS connection to persistent root webshell - completes in under 15 minutes."
The mechanism involves several steps: Initially, the servers are subjected to numerous crafted multipart POST requests designed to corrupt PHP's memory and establish a predictable memory layout. Subsequently, a second request fabricates the length of the stale session ID from the memory corruption phase of the assault, thereby compelling an out-of-bounds read that reveals the base address of libphp.so within the active process. The attackers then deplete PHP's memory once more to force mod_data=NULL, thereby generating a stale reference that they can manipulate in the final phase to execute commands as the nobody user. They then employ Fragnesia to escalate to root and install a web shell in a publicly accessible directory on the firewall. After gaining entry through the compromised firewalls, the attackers surveyed the Active Directory environment, obtaining sensitive data and user credentials. With root access secured, the attackers also possessed the master key necessary to decrypt the LDAP service account password, which they embedded into every subsequent script. Additionally, they queried LDAP to enumerate every user and group within the domain and subsequently performed password spraying against every user account. Attempts were also made by the attackers to generate backdoor AD accounts and extract SAML signing keys, although Dream does not confirm the success of these actions. The researchers observed, "The attack results - whether the password spray found valid credentials, whether the backdoor accounts were created, whether SAML keys were extracted - stayed on the management server's local filesystem and were not among the artifacts we recovered."
The investigation also uncovered evidence indicating the utilization of AI tools by the attackers, though the researchers clarified that the operation was not entirely autonomous. The researchers discovered the presence of Anthropic's Claude Code, an AI-powered offensive security platform named aiscan configured with Chinese models such as DeepSeek and Kimi, alongside API keys for the FOFA reconnaissance service. FOFA functions as a Chinese internet asset search engine, comparable to Shodan. The attackers employed this service to identify approximately 19,000 internet-facing Palo Alto Networks firewalls globally. Dream cautioned, "The persistent tunnel into the US government organization is likely still running," adding, "And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional PAN-OS versions."
This incident underscores the increasing sophistication of threat actors who are integrating advanced computational aids into their operational toolkits. The use of AI tools, combined with the chaining of multiple zero-day or high-severity vulnerabilities, demonstrates a shift toward highly automated and targeted infrastructure compromise methodologies against critical enterprise platforms.
Why it matters
This incident highlights the severe risk posed by chaining multiple vulnerabilities, like PHP2Shell and Fragnesia, against critical infrastructure. Operators must urgently review exposure to these specific vulnerabilities, especially on internet-facing management interfaces. The use of AI in this attack signals an evolving threat landscape requiring advanced defensive measures.
