China-linked hackers use PHP2Shell to breach US government network

Suspected China-linked hackers used PHP2Shell vulnerabilities and a Linux kernel flaw to breach a US government-affiliated network, according to cybersecurity firm Dream. The firm said the attackers compromised 24 firewalls after scanning 19,000 internet-facing devices across four countries. The breach was uncovered on October 25 and is described as the first documented case of PHP2Shell being chained into a full government network breach.

How the attack worked

The breach follows last week's disclosure of two critical PHP vulnerabilities, each rated 9.2 in severity and collectively dubbed PHP2Shell. Dream said the attackers combined two PHP2Shell flaws, CVE-2026-109618 and CVE-2006109619, with a Linux kernel vulnerability called Fragnesia, CVE-2026046300, to gain root access to vulnerable firewalls without authentication. Kfir Fleischer, Dream's VP of Product and Cyber Research, said PHP2Shell is hard to reliably exploit because it requires precise, version-specific memory offsets and no universal exploit exists. He said the attacker had to chain it with an additional local privilege escalation vulnerability, making the overall attack a two-stage chain. Dream said that even under ideal conditions, only about 10% of attempts succeeded, with most failures being timeouts.

Scope and targets

Dream researchers reconstructed the operation using its internal AI research system, Hero, after recovering attacker logs, exploit tools, and approximately 40 post-exploitation scripts. The attackers identified 19,000 internet-facing firewalls and narrowed their target to 240 vulnerable devices across the United States, Japan, Taiwan, and South Korea. They successfully compromised 24 firewalls before targeting an internal management server belonging to an unnamed US government-affiliated organization. Dream said the attackers maintained access, hacked the main firewall management server, and stole Active Directory credentials, which could allow them to access more of the network. The attackers then listed user accounts and groups, tried common passwords across many accounts, and attempted to create secret access accounts and steal signing keys, but researchers could not establish whether these additional attacks succeeded.

AI signals and wider response

Dream also identified potential AI involvement in the campaign, including installations of Claude Code and offensive security tooling configured with Chinese models DeepSeek and Kimi. The company has not attributed the activity to a specific threat actor, but said it believes the campaign is part of a China-linked operation due to language prompts, timestamps, and geographical targeting. CISA confirmed active exploitation and ordered federal agencies to implement mitigation by October 29. Cybernews reported that 32.5 million PHP services still run susceptible versions, including 10.3 million in the US, while Amazon detected PHP exploitation attempts as early as October 17, four days before public disclosure, and Cloudflare observed millions of attack attempts following the announcement.

Earlier coverage: CISA Adds Two PHP2Shell RCE Flaws to KEV Catalog

Sources: Cybernews