Dream says three affected systems were in a US government-affiliated environment, where the attacker used an external firewall to reach an internal server and attack the organization’s user-account directory.
An attacker combined flaws in PHP and Linux to gain root access—the highest level of administrative control—to 25 servers across the US, Japan, Taiwan and South Korea, Israeli cybersecurity firm Dream says. Three systems were in a US government-affiliated environment, including an internal firewall management server that was not publicly accessible.
Earlier attempts to exploit the PHP2Shell flaws had seen limited success, with attackers struggling to turn demonstration code into reliable attacks. Dream’s investigation, detailed by The Hacker News on October 28, describes a custom exploit tailored to specific firewall software. Dream observed the activity on October 25, 2026.
PHP2Shell consists of two flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code remotely without logging in. Dream says the attacker then used Fragnesia, CVE-2026-46300, a flaw in the Linux kernel—the core of the operating system—to raise that initial access to root privileges.
Dream describes the recovered PHP2Shell exploit as a custom, non-public implementation rather than a copy of known public exploit code. It targeted PHP’s upload-progress tracking on the firewall’s management server. The affected software used PHP 8.0.30 with a high memory limit that enabled the exploit’s memory-corruption stages, in which the attacker manipulated the program’s memory.
The attacker used an automated tool to run the combined exploit, check for root access and plant a web shell—a script that provides remote access—in a publicly accessible directory on each compromised firewall, Dream says.
404 Media reports precautionary shutdowns after researchers found flaws in PHP, a programming language used to run websites, prompting government instructions for immediate fixes.
2 min
| Stage | Count | What it means |
|---|---|---|
| Discovery | About 19,000 | Firewalls with exposed management interfaces found worldwide. |
| Version checks | About 5,000 | Devices that returned software-version information. |
| Selected targets | 240 | Systems in the four targeted locations matching newer release branches running PHP 8.0.30. |
| Reported compromises | 25 | Servers where Dream says the attacker obtained root access, including the internal server. |
Dream’s reconstruction dates the compromise and subsequent crash of one government-affiliated firewall to October 23, 2026, at 18:14 UTC. The device did not return online. The attacker successfully gained root access to a second external system on October 24 at 10:09 UTC.
From that second system, the attacker established a reverse SSH tunnel: an encrypted connection initiated by the compromised firewall back to the attacker’s infrastructure. Dream says this provided a persistent route into the internal network. At 11:35 UTC that day, the attacker used the route and the same exploit chain to compromise an internal firewall management server reachable only through the tunnel, bringing the total to 25.
Dream says recovered evidence confirms credential extraction and directory enumeration—listing user accounts—during attacks against Active Directory, the organization’s user-account directory. The activity included efforts to decrypt a password for an LDAP service account, an account used to access the directory.
The attacker also tried organization-themed passwords across user accounts, a technique called password spraying, and attempted to create backdoor accounts for later access. Whether those password attempts found valid credentials or the backdoor accounts were created remains unknown, leaving the full extent of the compromise unresolved.
Analysis
Dream suspects a possible China link because of the operation’s focus on the US, Japan, Taiwan and South Korea, which the company describes as strategic intelligence targets for Chinese state-aligned operations. That assessment does not identify a named attacker group or establish government responsibility.
Dream also sees signs of possible superintelligence (SI) assistance in developing the attack tools. Its evidence includes an installation of Anthropic’s Claude Code, keys for accessing FOFA’s programming interface, and aiscan, an offensive-security platform configured with DeepSeek and Kimi language models. The structure, comments and consistency of nearly 40 scripts also suggest assisted development, rather than establishing that SI independently conducted the attack.
Dream says it notified the affected firewall vendor, whose name remains undisclosed. The US government-affiliated organization has not been named either.
Dream says the 22 other rooted firewalls still contain active web shells and assesses that the tunnel into the government-affiliated environment is likely still running. The company warns that the attacker could revisit the roughly 19,000 discovered devices if it develops exploit profiles for additional operating-system versions.
The agency added both flaws to its exploited-vulnerabilities catalogue on 26 October, requiring US federal civilian agencies to apply fixes by 29 October.
12 min
Four fixed PHP releases are available. Operators using PHP 8.1 or older should upgrade or ask their vendor about a fix for their existing version.
9 min
