Dream Reports PHP2Shell Attack Rooted 25 Servers, Including U.S. Government-Affiliated Systems
Summary
Dream says a suspected China-linked actor used custom PHP2Shell and Linux kernel privilege-escalation exploits to root 25 firewall servers across four countries, including three in a U.S. government-affiliated environment; the full compromise remains unclear.
Key points
- Dream says it observed the activity on October 25, 2026, and linked it to a suspected China-nexus actor; attribution is not conclusive.
- The custom PHP2Shell exploit reportedly targets PHP’s session.upload_progress mechanism on a firewall management server running PHP 8.0.30, and was combined with the Linux kernel exploit CVE-2026-46300.
- Dream reports that 25 servers were rooted across the U.S., Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment.
- Recovered artifacts reportedly show credential extraction and Active Directory enumeration, but it remains unclear whether valid credentials were obtained or backdoor accounts created.
- Dream says 22 other rooted firewalls had active web shells and that a persistent tunnel into the U.S. government-affiliated organization was likely still running.
- Evidence cited for AI-assisted development includes Claude Code in the attack infrastructure, an aiscan setup using DeepSeek and Kimi models, and patterns across nearly 40 scripts.
Article Details
- Victim Organization
- Not disclosed; a U.S. government-affiliated organization was affected
- Victim Domain
- Unknown
- Incident Type
- Exploitation of PHP2Shell vulnerabilities combined with a Linux kernel privilege-escalation exploit to gain root access and persistent access to internal Active Directory infrastructure
- Incident Date
- 2026-10-25
- Data Types Exposed
- Credentials (extraction was confirmed; whether valid credentials were obtained or used is unclear)
- Operational Impact
- Researchers reported that 25 servers were rooted, including three in a U.S. government-affiliated environment. The other 22 rooted firewalls reportedly remained with active web shells. A persistent tunnel into the government-affiliated organization was considered likely to still be running. The full extent of the compromise remained indeterminate.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
CVE
Products
Linux kernelThe name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel -Microsoft Active Directoryfirewall software," cybersecurity firm Dream said. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."PHPThe name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel -
Tools
aiscanalong with the presence of API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.Claude CodeThe links to AI-assisted tooling stem from evidence pointing to the installation of Anthropic's Claude Code in the attack infrastructure, along with the presence of API keys for FOFA and an AI-powered offensive securityDeepSeekAI-powered offensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.FOFAof Anthropic's Claude Code in the attack infrastructure, along with the presence of API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models (LLMs)Kimioffensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.
Countries
JapanThe custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.South KoreaThe custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.TaiwanThe custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.United StatesPHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment.