Hackers Exploit PHP2Shell Vulnerabilities to Gain Root Access on 25 Firewall Servers

Hackers chained PHP2Shell vulnerabilities with a Linux kernel privilege escalation flaw to gain root access on 25 servers, including three systems associated with a United States government-affiliated environment, according to Dream researchers.

Discovered on October 25, the operation progressed from exposed firewall management interfaces to credential theft, persistent tunneling, and Active Directory reconnaissance.

Dream recovered a custom exploit implementation, targeting lists, exploitation logs, and about 40 post-exploitation scripts. Researchers withheld the firewall vendor and affected software versions for security reasons, stating that the vendor had been notified. The reported compromises spanned the United States, Japan, Taiwan, and South Korea.

PHP2Shell Exploit Chain

The initial attack combined PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, identified as CVE-2026-46300. The custom PHP2Shell implementation targeted PHP’s session.upload_progress mechanism inside the firewall’s appweb management server, exploiting memory corruption to execute commands without authentication.

The attack used four coordinated stages rather than a single standalone request. The attacker first crafted multipart requests that exhausted memory and manipulated PHP’s allocation behavior. An information leak then exposed a libphp.so pointer through a Set-Cookie response header, enabling the attacker to calculate addresses required for subsequent exploitation.

Further memory pressure created a stale reference, allowing a forged PHP HashTable entry to redirect a cleanup callback to PHP’s system() function. This delivered command execution as the unprivileged nobody account. The final exploitation request also launched Fragnesia, completing the transition to root.

Fragnesia targeted the Linux kernel’s XFRM ESP-in-TCP subsystem. According to the recovered artifacts, page cache writes altered /etc/pam.d/su to permit authentication, allowing passwordless elevation. Dream reported that the complete chain established a root webshell in under 15 minutes.

The attacker used FOFA to identify approximately 19,000 exposed firewalls. Version scanning returned about 5,000 responsive devices, while geographic and software filtering narrowed the exploitation list to 240 targets. Automated attacks initially rooted 24 firewalls and installed 103-byte PHP webshells.

Two compromised perimeter devices drew particular attention because their configurations indicated a government affiliated environment. One subsequently crashed. After exploiting the second, the operator established reverse SSH tunnels and a SOCKS5 proxy, maintaining access through systemd and rc.local persistence.

The tunnel exposed an internal firewall management server, which the attacker compromised using the same vulnerability chain. That additional intrusion brought the total to 25 rooted servers. Comparable firewall management compromises have also enabled credential theft, reconnaissance, and internal pivoting.

From the management server, the attacker decrypted an LDAP service account password and enumerated domain users and groups. Scripts also attempted password spraying, backdoor account creation, Active Directory privilege escalation analysis, and SAML signing key extraction. Results for those attempts were unavailable, preventing confirmation of broader domain compromise.

Similar firewall credential-theft campaigns show how exposed appliance configurations can become entry points into identity infrastructure.

Chinese language prompts, UTC+8 timestamps, FOFA access, and configured DeepSeek and Kimi models suggested a Chinese nexus. However, Dream did not attribute the operation to a named actor. Installed AI tools and consistent scripting suggested assistance, not proven autonomous exploitation.

The findings underscore the importance of restricting management exposure and investigating downstream identity access after perimeter compromise, rather than treating firewall remediation alone as sufficient containment for affect.ed enterprise networks.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.