Dream Reports China-Nexus Hackers Used PHP2Shell to Root Firewalls
Summary
Dream reports an unattributed China-nexus operation chained PHP2Shell and Fragnesia to root firewalls, then accessed a management server to obtain firewall configurations and credentials and target Active Directory.
Key points
- Dream says attackers used FOFA to identify 19,000 internet-facing firewalls from one vendor, narrowed potential targets to 240, and exploited 25 on October 23–24.
- The attackers chained PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Linux kernel privilege-escalation flaw Fragnesia, CVE-2026-46300.
- A PHP root webshell was reportedly installed on 24 firewalls; Dream observed no further post-exploitation activity on 22.
- On two servers in a US government-affiliated environment, attackers reportedly established access; one firewall crashed shortly after exploitation.
- Attackers used a reverse SSH tunnel to reach an internal firewall-management server and access configurations, credentials, and settings for the organization’s managed firewalls.
- From the management server, attackers reportedly accessed and decrypted an LDAP service-account password, enumerated domain users and groups, password-sprayed, and attempted to create Active Directory backdoor accounts.
- Dream did not identify a specific threat actor; it assessed the activity as potentially part of a Chinese-nexus operation.
Article Details
- Attack Vectors
- The attackers exploited two PHP2Shell vulnerabilities on internet-facing firewalls, chaining them with the Fragnesia Linux kernel privilege-escalation vulnerability to gain root access.
- They deployed PHP root webshells on 24 firewalls for persistent access.
- On a US government-affiliated environment's firewall, they established a reverse SSH tunnel and used it to target an internal firewall management server with the same exploit chain.
- After accessing the management server, they accessed and decrypted an LDAP service account password, enumerated domain users and groups, conducted password-spraying attacks, and attempted to create Active Directory backdoor accounts.
MITRE ATT&CK
T1021.004 · SSHThe attackers used a reverse SSH tunnel as part of their access to the firewall management environment.T1068 · Exploitation for Privilege EscalationThey chained the Fragnesia Linux kernel privilege-escalation vulnerability to gain root access.T1069.002 · Domain GroupsAfter accessing the management server, they enumerated domain groups.T1087.002 · Domain AccountAfter accessing the management server, they enumerated users in the domain.T1110.003 · Password SprayingThey conducted password-spraying attacks after accessing and decrypting an LDAP service account password.T1136.002 · Domain AccountThey attempted to create backdoor accounts in Active Directory.T1190 · Exploit Public-Facing ApplicationThe attackers exploited PHP2Shell vulnerabilities on internet-facing firewalls.T1505.003 · Web ShellThey deployed PHP root webshells on 24 firewalls for persistent access.T1572 · Protocol TunnelingThey used a reverse SSH tunnel to maintain access to a firewall and reach an internal management server.
CVE
CVE-2026-109618The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.CVE-2026-109619The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.CVE-2026-46300The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.
Products
Linux kernelThe hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.Microsoft Active Directoryenumerate users and groups in the domain, perform password spraying attacks, and attempt to create Active Directory backdoor accounts, among others.
Tools
Countries
ChinaA China-linked threat actor has been exploiting the PHP2Shell vulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports.JapanAfter discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.South KoreaAfter discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.TaiwanAfter discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.United StatesAfter discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.