PHP2Shell Attack: How 25 Servers Were Rooted, Including a U.S. Government Network

A week after the PHP2Shell flaws were announced, researchers published a detailed look at one attacker using them for real. On October 25, 2026, the Israeli security firm Dream reported that an attacker had rooted 25 servers in the United States, Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated network, by chaining PHP2Shell with a Linux kernel flaw.

The machines were not ordinary websites. Most of them were internet-facing firewalls: devices bought to protect a network, whose web management page ran an old version of PHP. This post explains what happened, what is confirmed and what is not, and what to check on your own network.

What happened, in plain English

1. The attacker went looking. Using a search engine for internet-connected devices, they found about 19,000 internet-facing firewalls. About 5,000 answered with version information, and 240 matched the countries and versions the attacker wanted.
2. PHP2Shell got them in. The firewalls' web management page ran PHP 8.0.30. The attacker used the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to run their own code on the device, without logging in, as a low-privilege user.
3. A kernel flaw made them root. A Linux kernel flaw called Fragnesia (CVE-2026-46300) let them rewrite a login setting so that switching to the administrator account needed no password. Dream says the whole chain, from first connection to a permanent root foothold, took under 15 minutes.
4. They stayed. The attacker left tiny hidden web pages that run commands as root, and built a reverse SSH tunnel back to their own servers, set to restart whenever the device rebooted.
5. They moved inside. On the government-affiliated network, they reached a firewall management server, pulled a service account password out of the device's configuration, listed every user and group in the organization's directory (Active Directory), and tried passwords against every account. They also tried to create backdoor accounts and to extract the signing key of the organization's single sign-on system.

What is confirmed, and what is not

Dream's report is careful about the limits of what it recovered, and so are we:

• Confirmed: 25 servers rooted; three systems in the U.S. government-affiliated environment; the full chain of PHP2Shell, then Fragnesia, then persistence; the directory listing, the decrypted service account password and the tunnel into the internal network.
• Not known: whether the password attack found working passwords, whether the backdoor accounts were created and whether the signing key was stolen. Those results stayed on the attacker's side and were not among the artifacts Dream recovered.
• Attribution: Dream did not name the attacker. It lists indicators that point to a China-nexus operation: the targeted countries, Chinese-language tools and prompts, Chinese AI models, and timestamps in China's time zone.
• AI involvement: AI coding tools, including Claude Code, were installed on the attacker's infrastructure, and an offensive AI platform was set up with the DeepSeek and Kimi models. Dream says it has no direct evidence that AI wrote the exploit or the scripts; the style and consistency of about 40 scripts suggest it.
• The vendor: Dream did not name the firewall vendor or the affected versions. It says the vendor has been notified.

Why a firewall was running old PHP

PHP 8.0 reached its end of life in November 2023. The PHP project no longer fixes it, so the October 2026 PHP2Shell patches do not exist for it. A device like this only gets fixed when its manufacturer ships an update with a newer PHP inside.

That is the uncomfortable lesson. Many network devices, routers, NAS boxes and appliances carry their own copy of PHP, a web server and a Linux kernel. You cannot update those pieces yourself, you often cannot see their versions, and they sit on the edge of your network with a management page.

How serious is it?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists both flaws in its catalog of vulnerabilities attackers are actively using:

What to check this week

• Find every device whose management page faces the internet. Firewalls, VPN gateways, routers, storage boxes. Management pages should be reachable only from inside your network or over a VPN.
• Update appliances, not just servers. Check each vendor's site for an update that addresses PHP2Shell, and install it. If a device no longer gets updates, plan to replace it.
• Patch your Linux servers' kernels for Fragnesia, and restart them so the new kernel is running.
• Update PHP on your own servers to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The details are in our PHP2Shell post.
• Turn on account lockout in your directory. The government network had none, which is what made trying passwords against every account possible.
• Get service account passwords out of device configurations where you can, and change any that were stored on an exposed device.
• Watch outbound connections. A firewall that opens a long-lived SSH connection to an unknown server is a red flag.

If nobody owns these checks today, that is the gap to close. We wrote about it in Who is patching your servers?.

PHP2Shell attack questions people are asking

Which firewall vendor was affected?

Dream did not name the vendor or the affected versions, and says the vendor was notified. Check your own vendor's security advisories for PHP2Shell.

Was the U.S. government hacked?

Dream describes three systems in a U.S. government-affiliated environment, not a named agency. It confirmed access to the internal network and directory, but not whether stolen passwords worked.

Did AI carry out the attack?

AI tools were installed on the attacker's infrastructure, and the scripts look AI-assisted, but Dream says it has no direct evidence that AI wrote the exploit.

I updated PHP on my web server. Am I safe?

Your web server is, once PHP is updated and restarted. Devices with their own built-in PHP, like firewalls and appliances, need their manufacturer's update.

What is Fragnesia?

A Linux kernel flaw (CVE-2026-46300) that lets a program already running on the machine become root. Here it turned a low-privilege foothold from PHP2Shell into full control.

The bigger lesson

The devices bought to protect a network were the way in. Anything with a management page on the internet is part of your attack surface, whether you think of it as a server or not, and it needs an owner who updates it.

If you want your edge devices, servers and access reviewed, see our security review and hardening service, or get a tech quote.

Sources: Dream - Chained PHP2Shell exploit roots 25 servers; The Hacker News - PHP2Shell attack roots 25 servers; CISA - Known Exploited Vulnerabilities catalog.