An attacker gained root access to 25 servers running a vendor’s firewall software, including three in a U.S. government-affiliated environment, according to findings by cybersecurity firm Dream reported by The Hacker News. The operation combined PHP vulnerabilities with a Linux kernel exploit, then used a compromised firewall to reach internal systems and target Active Directory.
The October 28 report describes activity observed on October 25, 2026, with recovered artifacts placing individual compromises on October 23 and 24. Dream said it notified the firewall vendor, whose name was not disclosed in the report.
The attack linked PHP2Shell—CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution without authentication—with Fragnesia, a local privilege escalation vulnerability tracked as CVE-2026-46300. The latter enabled the attacker to elevate access to root, giving it administrative control over the affected systems.
According to Dream, the recovered PHP2Shell implementation was a custom, non-public build tailored to the firewall platform. It targeted PHP’s session.upload_progress mechanism on the firewall’s appweb management server. The targeted software used PHP 8.0.30 with a high memory limit that enabled the exploit’s memory corruption stages. Those conditions matter: the findings do not establish that every internet-facing PHP installation was vulnerable to this implementation.
From exposed firewalls to internal accounts
Dream’s reconstruction describes a selection process that began with approximately 19,000 internet-facing firewalls whose management interfaces were exposed. A custom scanner obtained operating system version information from about 5,000 devices. Filtering for systems in the U.S., Japan, Taiwan and South Korea, and for newer release branches running PHP 8.0.30, narrowed the list to 240 targets.
An automated runner then executed the exploit chain, installed PHP web shells in publicly accessible directories and checked for root access. Dream attributed 24 rooted servers to that stage, with a subsequent internal compromise bringing the total to 25.
One government-affiliated system crashed shortly after being rooted on October 23 and did not return online, according to the reconstruction. The attacker used another compromised system to establish a reverse SSH tunnel—a connection back to its infrastructure that provided a persistent route into the internal network. A third government-affiliated server, an internal firewall management server reachable only through that tunnel, was compromised on October 24.
Dream said recovered artifacts confirmed credential extraction and directory enumeration. The reported Active Directory activity included decrypting an LDAP service account password, listing users and trying organization-themed passwords across user accounts. The attacker also attempted to create backdoor accounts. Whether those password attempts yielded valid credentials or the account creation succeeded remains unclear, leaving the full extent of the compromise unresolved.
Dream reported active web shells on the other 22 rooted firewalls and assessed that the government environment’s tunnel was likely still running.
AI involvement and attribution remain assessments
Evidence suggesting AI assistance included Claude Code installed in the attack infrastructure, FOFA API keys, and the offensive security platform aiscan configured with DeepSeek and Kimi models. Dream also cited similarities in structure and commenting across nearly 40 scripts. These observations suggest AI-supported development; they do not establish which actions AI performed.
Dream characterized the actor as potentially linked to China, citing the geographic targeting. That attribution remains an assessment.
Separately, CISA’s Known Exploited Vulnerabilities catalog added both PHP2Shell flaws on October 26, with an October 29 action deadline. Both entries call for vendor-directed mitigations and forensic triage, evaluation of internet exposure, and discontinuing use if mitigations are unavailable. The catalog establishes known exploitation of the PHP flaws; it does not independently confirm Dream’s account of this operation.
