PHP2Shell Campaign Rooted 25 Firewall Servers — and Reached a Government Network

In brief

• Attackers chained PHP2Shell with a Linux kernel bug to root 25 firewall servers, reach a US government network, and leave 22 shells parked.
• The campaign, disclosed by Israeli firm Dream on October 28, 2026, ran a funnel: roughly 19,000 internet-facing firewalls fingerprinted, 240 matching targets, 25 rooted across the US, Japan, Taiwan, and South Korea — three of them in a US government-affiliated environment.
• The chain pairs PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with Fragnesia (CVE-2026-46300, CVSS 7.8): the first gets unauthenticated remote code execution, the second turns it into root.
• Palo Alto Networks warned separately on October 29 that PHP2Shell is being actively exploited against its internet-exposed management interfaces, and CISA added the kernel flaw to its Known Exploited Vulnerabilities catalog with a federal fix deadline of October 31, 2026.
• The vendor question is unresolved: Dream did not name the firewall vendor in its report. Do not assume the Palo Alto advisory and the Dream campaign are the same incident — the timing suggests a link, but neither firm has confirmed one.

Last verified: October 29, 2026.

From “unexploitable in practice” to 25 rooted servers

When PHP2Shell broke in late October 2026, the early reaction from exploit developers was dismissive. One forum member, quoted in coverage of the disclosure, called it “unexploitable crap” in practice: turning the proof of concept into a reliable attack supposedly needed memory offsets from libphp.so that are unique to every build and impossible to brute-force. You could reproduce it on your own test bench, the argument went, but not against a real target you had never touched.

Dream’s campaign is the answer to that argument, and the answer is fingerprinting. The attackers did not guess offsets. They first found out exactly which software each target was running, then built an exploit tailored to that platform. Dream describes the recovered PHP2Shell implementation as “a custom, non-public build, not a copy of any known public exploit,” independently developed and tailored specifically for the targeted firewall platform. The vulnerability targets PHP’s session.upload_progress mechanism on the firewall’s appweb management server; the firewall operating system runs PHP 8.0.30 with a memory limit high enough to enable the memory-corruption stages of the attack.

That distinction matters for defenders. A flaw that is hard to exploit blind becomes straightforward once the attacker knows your exact version. Every internet-facing management interface that answers version questions is handing over the one piece of information that makes this chain work.

The funnel: 19,000 scanned, 240 targeted, 25 rooted

Dream’s timeline, as reported on October 28, 2026, reconstructs the operation step by step. The activity was observed on October 25, 2026, but the groundwork started earlier, and the government-network intrusions date to October 23–24.

First, the attacker used FOFA, a search engine for internet-connected devices, to identify approximately 19,000 internet-facing firewalls with exposed management interfaces worldwide. A custom version scanner then checked which of those devices were online and what operating system version they ran; about 5,000 responded with version information. Filtering to systems in the US, Japan, Taiwan, and South Korea running newer release branches on PHP 8.0.30 narrowed the list to 240 targets.

Those 240 went into an automated batch runner that exploited the PHP2Shell–Fragnesia chain, planted a PHP web shell in a publicly accessible directory on each firewall, verified root access, and logged each victim’s hostname and IP address to a CSV file. The end result: 25 rooted servers. Dream says the other 22 rooted firewalls beyond the government three remain parked with active web shells — compromised, quiet, and available for later use. The attacker, in Dream’s words, “still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional OS versions.” The funnel did not end when the count hit 25; it produced a target list for the next round.

The government-network hop: firewall to Active Directory

The most consequential part of the campaign is not the root count but where the attacker went next. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.

One of those servers crashed shortly after it was rooted on October 23, 2026, at 6:14 p.m. UTC and never came back online. A dedicated campaign rooted a second system on October 24 at 10:09 a.m. UTC. From that foothold, the attacker built a persistent channel into the internal network with a reverse SSH tunnel back to operator infrastructure — and through that tunnel compromised a third government server at 11:35 a.m. UTC, an internal firewall management server reachable only via the tunnel. That is the shape of the whole campaign in miniature: an exposed edge device becomes a doorway, and the doorway leads to the identity system inside.

From the management server, the attacker went after Active Directory: decrypting an LDAP service-account password, enumerating domain users and groups, spraying passwords against every user account using organization-themed passwords, and attempting to create backdoor Active Directory accounts. Dream is careful about what is not known: recovered artifacts confirm credential extraction and directory enumeration, but it remains unclear whether the attacker found valid credentials or successfully created backdoor accounts. The full extent of the compromise is, in Dream’s assessment, indeterminate. The persistent tunnel into the US government organization is, in Dream’s words, “likely still running.”

Readers should hold both halves of that sentence at once. This was a real intrusion into a government-affiliated network’s identity layer, and the public record does not yet say how far inside it got. Anyone repeating this story as “government Active Directory fully compromised” is going further than the evidence.

Who did it, and what the AI evidence actually shows

Dream attributes the activity to a suspected China-nexus threat actor. That attribution is explicitly not conclusive: Dream did not identify a specific threat actor, and its assessment rests on indicators rather than a name. The indicators cited in summaries of the report include targeting limited to the US, Japan, Taiwan, and South Korea — described by Dream as “the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater” — plus infrastructure in the UTC+8 time zone, use of the FOFA search engine, the Chinese-developed iox tunneling tool, DeepSeek and Kimi language-model configurations, and Chinese-language prompts in tooling logs.

The AI angle needs the same care. Dream’s evidence for AI-assisted development is specific: Anthropic’s Claude Code installed in the attack infrastructure, an AI-powered offensive-security platform called aiscan configured with DeepSeek and Kimi models, and code structure, commenting style, and consistency across nearly 40 scripts that suggest AI augmented the development process. That is evidence that AI tooling was present in the attacker’s workshop and that the output looks machine-assisted. It is not evidence that an AI autonomously ran the campaign, and it is not an attribution fingerprint on its own — Claude Code and the other tools are widely available. The honest summary is narrower and still important: the tooling that makes a 19,000-device funnel and 40-script post-exploitation kit cheap to build is now within reach of a small team, and this campaign shows what that team can do with it.

Palo Alto’s warning, and the vendor question you must not blur

On October 29, 2026, Palo Alto Networks warned that threat actors are actively exploiting the PHP2Shell vulnerabilities against publicly accessible management interfaces. Its advisory states the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet, that no special configuration is required to be affected, and that the issue strictly affects the management web interface — the HTTPS web UI and XML API service — reaching the dataplane interface only if a management profile is attached to it.

The advisory lists affected PAN-OS versions across the 10.2, 11.1, 11.2, 12.1, and 12.2 lines, with fixes already available for some builds and others carrying ETAs of October 29 or 30 at the time of writing. For versions without a fix yet, Palo Alto recommends routing management traffic through a dataplane port, replacing the certificate for inbound traffic management, decrypting inbound management traffic so the firewall can inspect it, and enabling threat prevention on inbound management services. Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received advance coverage via Threat ID 543004, released October 20 at 10:21 p.m. PT.

Here is the trap in this story, and it is worth stating plainly: Dream did not name the firewall vendor in its report. The Hacker News notes that the timing of the Palo Alto advisory, combined with the fact that other network security vendors have not reported malicious exploitation against their products, “suggests that these events may be related.” Suggests. Not confirms. The Hacker News has contacted both Dream and Palo Alto Networks for comment. Until one of them says so, treating the Dream campaign as a Palo Alto incident is an inference dressed up as a fact. The safe reading is that two things are true at once: a suspected China-nexus actor rooted 25 firewalls from an unnamed vendor’s platform, and Palo Alto’s management interfaces are under active PHP2Shell exploitation. Either fact alone justifies the same defensive action.

The deadline that is already here

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300, the Fragnesia kernel flaw, to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the fixes by October 31, 2026. CISA’s description of the chain is blunt: it “can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root.”

The upstream PHP patches landed October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For firewall vendors, the fix arrives as a vendor firmware or hotfix release, not as a PHP upgrade the customer applies directly — which is why the Palo Alto fix ETAs matter and why the first action is not “patch PHP” but “check your vendor’s advisory for your exact build.”

What to do now

If you run any firewall with a management interface reachable from the internet: take it off the internet today. Restrict management access to trusted internal IP addresses only, per Palo Alto’s best-practice guidance and every other vendor’s equivalent. This single change removes the entire funnel: no FOFA discovery, no version scan, no batch runner. It protects you whether or not your vendor has shipped a fix yet.

If you run PAN-OS: check your exact build against the Palo Alto advisory, apply the fixed release where available, and use the listed mitigations (management traffic via a dataplane port, certificate replacement, decryption, threat prevention on management services) for builds whose fixes are still dated October 29–30. Verify the advisory again before acting — fix ETAs in this incident have moved daily.

If you already found a web shell or an unexpected root-level change on an edge device: treat it as a full incident, not a patching task. Dream’s campaign shows the edge device is the doorway, not the destination: check for reverse SSH tunnels, review Active Directory for new or modified accounts, rotate the LDAP service-account password and any credentials the device could reach, and assume the attacker kept a target list. The 22 parked web shells in this campaign are the warning — a quiet shell today is a tunnel tomorrow.

If you are not a firewall admin: the lesson still applies to the devices in your life. Any management interface exposed to the internet — a router admin page, a NAS login, a camera console — is the same shape of risk at a smaller scale. Keep admin pages off the public internet, behind a VPN or an allow-list, and patch on the vendor’s schedule, not yours.

What remains unknown

Three questions are still open, and a careful reader should watch for them rather than accept any article that answers them early. First, the vendor: Dream has not named one, and the Palo Alto connection is unconfirmed. Second, the government-network outcome: whether valid credentials were obtained or backdoor Active Directory accounts were created is unknown. Third, the other 22: parked web shells on 22 rooted firewalls, plus a fingerprinted list of 19,000 targets, mean this campaign’s second act may not have happened yet. The next disclosure — a vendor name, a CISA update, or a second Dream report — will matter more than the first-day headlines.

Sources

• The Hacker News, “PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network,” October 28, 2026 — https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html (read in full Oct 29, 2026; Dream report via this coverage)
• The Hacker News, “Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces,” October 29, 2026 — https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html (read in full Oct 29, 2026; Palo Alto advisory + CISA KEV via this coverage)
• Pivot News, “Dream ties AI-assisted PHP2Shell attack to 25 rooted servers,” October 29, 2026 — https://pivotnews.ai/security/dream-ties-ai-assisted-php2shell-attack-to-25-rooted-servers (independent second coverage)
• GBHackers, “Hackers Exploit PHP2Shell Vulnerabilities to Gain Root Access on 25 Firewall Servers,” October 29, 2026 — https://gbhackers.com/hackers-exploit-php2shell-vulnerabilities/ (independent third coverage)

Related reading

• PHP2Shell Vulnerability: Patch Status, Vendor Fixes, What to Do — https://autechwire.com/php2shell-critical-php-vulnerability-explained/
• PHP2Shell Patch Lag: Millions of Scans as Vendors Race to Fix — https://autechwire.com/php2shell-patch-lag-millions-scans-palo-alto/
• CrowdStrike: AI Agents Ran Real Intrusions in Four Campaigns — https://autechwire.com/crowdstrike-ai-agents-autonomous-intrusions/
• ARTEX: The AI Pentesting Tool Used in the ConnectWise Hack — https://autechwire.com/artex-ai-pentesting-tool-connectwise-hack-explained/