A China-linked threat actor has been exploiting the PHP2Shell vulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports.
The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.
As part of the observed attacks, the hackers used the Chinese internet asset search engine FOFA to identify 19,000 internet-facing firewalls from a specific vendor, and proceeded to exploit 25 of them on October 23-24, Dream says.
After discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.
Using an automated tool, the attackers then targeted the firewalls with the full PHP2Shell-Fragnesia exploit chain, dropping a PHP root webshell on 24 devices for persistent access.
While no post-exploitation activity was observed on 22 of the firewalls, the hackers did progress further on two servers belonging to a US government-affiliated environment.
The first rooted server crashed shortly after exploitation, on October 23. The attacker launched a second wave of attacks on October 24, which was successful.
“The attacker monitored [the first firewall] with 240 automated probes over two hours, waiting for it to recover. It didn’t. The second firewall, whose certificate data definitively linked it to the target organization, had timed out during the original batch,” Dream notes.
To maintain access to the firewall, the attackers deployed a reverse SSH tunnel and then used it to target an internal firewall management server with the PHP2Shell-Fragnesia chain, gaining access to the configurations, credentials and settings of every firewall the organization managed.
The hackers then used the management server to access and decrypt the LDAP service account password, enumerate users and groups in the domain, perform password spraying attacks, and attempt to create Active Directory backdoor accounts, among others.
Dream has not attributed the activity to a specific threat actor but believes it is part of a Chinese-nexus operation.
“Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts,” Dream notes.
Related: Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Related: Hackers Start Probing Fresh Oracle EBS Vulnerability
Related: CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Related: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
