PHP2Shell Attack Roots 25 Firewalls: Inside the AI-Assisted Campaign and How to Defend Against It

A firewall is supposed to be the most trusted device on a network. In late October 2026 researchers watched an attacker turn 25 of them into footholds, including three servers inside a US government-affiliated organisation. The attacker used PHP2Shell, the pair of critical PHP flaws disclosed on 21 October, and chained it with a Linux kernel flaw called Fragnesia to gain full root control.

The campaign was uncovered by Dream, an Israeli cyber security company, and reported by The Hacker News on 28 October 2026. It stands out for three reasons. It went after network devices rather than websites. It was industrialised, moving from a list of 19,000 candidates to a short list of 240 in a few automated steps. And the investigators found clear signs that artificial intelligence helped build and run it.

This article explains what happened, step by step, why it matters even if you have never written a line of PHP, and the practical actions to take this week.

What Is PHP2Shell?

PHP2Shell is the name given to two vulnerabilities in PHP, the language that powers a huge share of the web and, less obviously, the management interfaces of many network appliances. Both are tracked with a CVSS score of 9.2 and both can lead to unauthenticated remote code execution: an attacker who can send requests to the server can run their own code on it without logging in.

• CVE-2026-109618 concerns what happens when PHP runs out of memory while it is still setting up a request. Partly prepared data can be left behind and later treated as valid.
• CVE-2026-109619 concerns internal state that outlives the request it belonged to, so a later request on the same worker can use stale data.

The PHP project released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches, including 8.1 and 8.0, receive no upstream release. That detail matters here, because the firewalls in this campaign ran PHP 8.0.30. We covered the flaws themselves when they were disclosed in Two Critical PHP Flaws: What Website Owners Must Do Now. This campaign shows what they look like in real attacker hands.

The second ingredient was Fragnesia, a Linux kernel local privilege escalation flaw tracked as CVE-2026-46300 with a CVSS score of 7.8. On its own it needs a foothold on the machine. Paired with PHP2Shell, it supplied the missing step from "running as the web server" to "running as root".

How the Attack Unfolded

According to Dream, the operation began with exploit development in a lab and ended with persistent access to a government organisation's internal Active Directory domain. The attack surface was PHP's session upload progress mechanism on the firewall's web based management server, and the device's high memory limit made the memory corruption stages workable.

The numbers tell the story of a modern campaign. The attacker used FOFA, a search engine for internet-connected devices, to find around 19,000 firewalls with exposed management interfaces worldwide. A custom scanner asked each one for its version, and about 5,000 answered. Filtering to four countries (the United States, Japan, Taiwan and South Korea) and to newer release branches running PHP 8.0.30 produced a target list of 240.

An automated batch runner then worked through the list. For each device it ran the PHP2Shell and Fragnesia chain, planted a PHP web shell in a publicly reachable directory on the firewall, confirmed root access and logged the hostname and IP address to a spreadsheet. Twenty four devices were rooted this way.

Two of those 24 belonged to a US government-affiliated organisation. The first was rooted at 18:14 UTC on 23 October and crashed soon afterwards, never coming back online. The attacker then ran a dedicated campaign against the second, rooting it at 10:09 UTC on 24 October and building a persistent reverse SSH tunnel from the firewall back to their own infrastructure.

That tunnel is the turning point. At 11:35 UTC the same day, the attacker used it to reach and root a third server: an internal firewall management server that was not exposed to the internet at all. That brought the total to 25. From there the attacker went after Active Directory, decrypting the password of the LDAP service account the firewall used, listing users, trying organisation-themed passwords against every account and attempting to create backdoor accounts.

Dream says it notified the affected organisation, but it is not clear whether the attacker obtained valid credentials or managed to create those accounts. At the time of reporting, the other 22 rooted firewalls reportedly still had active web shells, and the attacker still held the list of around 19,000 fingerprinted targets.

Why Firewalls Make Such Attractive Targets

Edge devices such as firewalls, VPN gateways and load balancers sit in a privileged position. They see traffic, they often hold credentials for directory services, and they are trusted by everything behind them. Yet they are frequently the least monitored systems in an organisation. Many cannot run endpoint detection tools, their logs are rarely reviewed in detail, and their software stacks are hidden behind a vendor's interface.

That last point is why PHP2Shell reaches further than most people expect. Plenty of organisations heard "PHP flaw" and handed the problem to their web team. But the firewalls in this campaign ran PHP inside their management software, on a branch with no upstream fix. Only the appliance vendor can patch that, and only the customer can make sure the patch is applied. The vendor in this case was not named.

The campaign also shows how one compromised device changes the shape of a network. The third government server was never exposed to the internet. It was reached only because a trusted firewall had been turned into a tunnel. Internal systems that feel safe because they are "behind the firewall" are only as safe as the firewall itself.

The AI Factor

Dream describes the operation as AI-assisted, and the evidence it cites is specific. On the attack infrastructure the researchers found a commercial AI coding agent (Anthropic's Claude Code), FOFA API keys and an AI offensive security platform called aiscan, configured with large language models from DeepSeek and Kimi. The structure, commenting style and consistency across nearly 40 scripts also suggested AI-augmented development.

The exploit itself was a custom, non-public build. It follows the same idea as known PHP2Shell exploits but was developed independently for this firewall platform. That is significant because, in underground forums, would-be attackers had complained that real-world exploitation was hard: offsets differ for every PHP build and cannot simply be guessed. Adapting an exploit to a specific product was exactly the kind of tedious engineering that used to buy defenders time.

The lesson is not that AI invented a new kind of attack. Every step here, from internet scanning to web shells to password spraying, is familiar. What AI appears to have done is compress the effort. The time between a vulnerability being disclosed and a working, tailored exploit being used against a niche product is shrinking. Patch windows measured in weeks were already risky. For internet-facing devices they are now too long.

We explored this shift in AI-Powered Attacks Are Outpacing Defences. This campaign is one of the clearest real-world examples so far.

Who Is Behind It?

Dream assesses the actor as suspected China-nexus. Its reasoning is the targeting: the US, Japan, Taiwan and South Korea are primary strategic and intelligence targets for Chinese state-aligned cyber operations in the Pacific region, which points to possible nation-state activity. This is an assessment based on behaviour rather than a confirmed attribution, and it should be treated that way.

For most organisations the identity of the attacker matters less than the method. The same techniques are available to criminal groups, and the list of 19,000 fingerprinted firewalls is not limited to four countries.

What to Do Now

Start with the question this campaign answers for the attacker: which of your management interfaces can be reached from the internet? Then work through patching, hunting and credential hygiene. The version check below helps with the PHP side; the checklist covers the wider response.

Patch PHP Properly

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. Check the build your web server actually uses, because the command line version can differ. After updating, restart PHP-FPM, Apache or container workers so the old code is no longer loaded, and rebuild any container images created before the fix. Systems on PHP 8.1 or older need an upgrade or a vendor backport.

Treat Mitigations as a Bridge, Not a Fix

Setting session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool reduces exposure to CVE-2026-109619, and sensible request size limits help with CVE-2026-109618. The PHP project is clear that these measures reduce exposure to specific attack paths but do not make an installation safe. Settings made through ini_set() or .user.ini apply too late to help.

Ask Every Appliance Vendor

Contact the suppliers of your firewalls, VPNs and other appliances and ask directly whether their management software uses PHP, which version, and when a fix for PHP2Shell and the Fragnesia kernel flaw will be available. Until then, keep management interfaces off the internet.

Hunt for the Signs

Amazon's threat intelligence team reported an exploitation attempt against its honeypots on 17 October, four days before public disclosure, so review logs from at least that date. Look for unexpected PHP files in web directories, unusual outbound SSH connections from network devices, new local accounts, and password spraying or new privileged accounts in Active Directory. If a device looks compromised, assume any credentials it stored are exposed. Our guide to securing tier zero explains why directory service accounts deserve special protection.

The Bigger Picture

PHP2Shell will not be the last critical flaw to ripple out from a popular software component into appliances most people never think of as running it. What this campaign adds is a preview of the pace to expect: mass discovery, automated exploitation and rapid pivoting, with AI smoothing the hard parts. Defenders need the same qualities in return. That means an accurate inventory of what faces the internet, patching measured in days, monitoring that covers edge devices, and intelligence that flags when a flaw moves from theory to active use.

Cybergen tracks newly exploited vulnerabilities on Threat Watch and helps organisations close the gap through vulnerability management, CREST-certified penetration testing and 24x7x365 managed detection and response. If you think any of your devices may have been exposed, our incident response team can help you investigate.

Frequently Asked Questions