Php2shell Hack Compromises U.s.-linked Network via 25 Servers
WHO:
The Hacker News - Cybersecurity firm Dream disclosed the attack and said it notified the affected entity; it did not identify the firewall vendor.
The Hacker News - Dream attributed the suspected operation to a China-nexus threat actor and said its evidence suggested possible nation-state activity.
The Hacker News - Three systems in a U.S. government-affiliated environment were compromised. The article says two successfully compromised systems were identified as belonging to the organization, then describes a third government server compromised through an internal tunnel.
The Hacker News - The operation used Anthropic’s Claude Code, FOFA API keys, and aiscan, an AI-powered offensive security platform configured with DeepSeek and Kimi large language models.
OReilly Radar - Wiz Research discovered two PHP remote-code-execution vulnerabilities called PHP2Shell.
WHAT:
The Hacker News - Palo Alto Networks said it observed active exploitation of PHP2Shell against internet-exposed management interfaces.
The Hacker News - The PHP Foundation patched PHP2Shell on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The Hacker News - CISA added Fragnesia, CVE-2026-46300, to its Known Exploited Vulnerabilities catalog; its notice said federal agencies must apply fixes by October 31, 2026.
The Hacker News - Palo Alto Networks said affected PAN-OS management services include the HTTPS web UI and XML API; a dataplane interface is affected only when a management profile is attached.
The Hacker News - Dream said recovered artifacts confirmed credential extraction and directory enumeration.
The Hacker News - Nearly 40 scripts had code structure, commenting style, and consistency that Dream said suggested AI-assisted development.
The Hacker News - The attacker’s remaining fingerprinted target pool was about 19,000 firewalls.
The Hacker News - A member using the handle c0d3x on the XSS forum said exploiting PHP2Shell against real targets requires build-specific `libphp.so` offsets that are “impossible to brute-force.”
The Hacker News - The attacker combined PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, each reported with a CVSS score of 9.2, with the Linux kernel privilege-escalation vulnerability Fragnesia, CVE-2026-46300, CVSS 7.8.
The Hacker News - The attack rooted 25 servers across the United States, Japan, Taiwan, and South Korea. The batch operation initially rooted 24; a further internal government server brought the total to 25.
The Hacker News - Recovered artifacts showed Active Directory attacks, including LDAP service-account password decryption, user enumeration, password spraying, credential-extraction attempts, and attempted creation of backdoor accounts. Dream said it was unclear whether valid credentials were obtained or backdoor accounts created.
The Hacker News - The attacker planted PHP web shells; Dream said 22 other rooted firewalls remained with active web shells and that the full extent of the compromise was indeterminate.
OReilly Radar - Wiz Research reported the PHP2Shell vulnerabilities to the PHP team, which began working on fixes.
WHERE:
The Hacker News - The campaign targeted exposed firewall management interfaces and reached a U.S. government-affiliated internal Active Directory environment, including an internal firewall management server accessible through a tunnel.
The Hacker News - The attacker used FOFA to identify about 19,000 internet-facing firewalls worldwide; about 5,000 returned version information, and filtering produced 240 targets in the United States, Japan, Taiwan, and South Korea.
WHEN:
The Hacker News - Palo Alto Networks listed October 29, 2026, as the estimated availability date for fixes PAN-OS 12.1.4-h13 and 10.2.10-h42; it listed October 30, 2026, for 12.1.10-h3, 11.2.4-h23, 11.1.7-h12, and 10.2.7-h39.
The Hacker News - The activity was observed on October 25, 2026.
OReilly Radar - Wiz Research reported the vulnerabilities on August 24; the PHP team began working on fixes on September 21.
The Hacker News - One government-affiliated system crashed after being rooted at 6:14 p.m. UTC; a second was rooted at 10:09 a.m. UTC, and a third at 11:35 a.m. UTC. The article also reports a separate attack observation date, omitted here under the date rules.
WHY:
The Hacker News - Dream said the selected countries are primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater.
HOW:
The Hacker News - Palo Alto Networks recommended restricting management-interface access to trusted internal IP addresses. For versions without fixes, it also recommended routing management-port traffic through a dataplane port, replacing the inbound-traffic management certificate, decrypting inbound management traffic, and enabling threat prevention.
The Hacker News - The attacker used a custom, non-public PHP2Shell exploit tailored to the firewall platform. It targeted PHP’s `session.upload_progress` mechanism on an appweb management server running PHP 8.0.30; the operating system’s high memory limit enabled the memory-corruption stages.
The Hacker News - After scanning and filtering targets, an automated batch runner exploited the PHP2Shell–Fragnesia chain, planted web shells, checked for root access, and recorded hostnames and IP addresses in a CSV file.
The Hacker News - A reverse SSH tunnel from a compromised firewall created persistent access to the organization’s internal network. Dream said the tunnel was likely still running.
OReilly Radar - The article says Amazon apparently detected PHP2Shell; it provides no further details in the supplied text.
(UPDATED October 29, 2026 16:03 UTC)
A China-linked threat actor used custom exploits to compromise 25 servers across four countries, including systems in a U.S. government-affiliated environment, and planted web shells on firewalls. The campaign chained two critical PHP2Shell vulnerabilities with the Fragnesia Linux flaw, enabling credential theft, Active Directory attacks and a reverse SSH tunnel into an internal network; the full extent of the breach remains unclear. PHP2Shell has been patched in several PHP versions, while Palo Alto Networks reported active attacks on exposed management interfaces and recommended restricting access to trusted internal addresses; federal agencies must fix Fragnesia by October 31, 2026.
--
(UPDATED October 29, 2026 15:00 UTC)
A suspected China-linked operation rooted 25 servers across the United States, Japan, Taiwan, and South Korea, including systems in a U.S. government-affiliated environment, by chaining two PHP2Shell flaws with a Linux privilege-escalation vulnerability. Dream said the attackers planted web shells, extracted credentials and enumerated directories, and used a reverse SSH tunnel to reach an internal government server; 22 rooted firewalls still had active shells, and the full extent of the compromise remained unclear. The campaign used AI-assisted tools and targeted exposed firewall management interfaces, while Wiz Research reported the PHP2Shell vulnerabilities to the PHP team, which began working on fixes.
--
(UPDATED October 29, 2026 14:08 UTC)
A suspected China-linked operation compromised 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment, using vulnerabilities in firewall management software and the Linux kernel to gain root access. The attacker used AI-assisted tools, planted web shells, and created a reverse SSH tunnel into an internal network; Dream said the full scope of the breach remains unclear and that 22 rooted firewalls still had active web shells. Separately, Wiz Research reported two critical PHP remote-code-execution vulnerabilities called PHP2Shell to the PHP team, which began working on fixes.