AI-Assisted PHP2Shell Attack Roots 25 Servers, Including U.S. Government Systems
Cybersecurity researchers disclosed details on October 28, 2026, of an attack orchestrated by a suspected China-nexus threat actor that used AI-assisted tooling and PHP2Shell vulnerabilities to gain root access to 25 servers. The activity, observed starting October 25, 2026, compromised systems across the U.S., Japan, Taiwan, and South Korea, including three servers within a U.S. government-affiliated environment. The attacker combined the PHP2Shell flaws with a Linux kernel privilege escalation exploit to breach exposed firewall management interfaces and subsequently target internal Active Directory infrastructure.
The attack chain relied on two specific vulnerabilities: PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2, and Fragnesia, a Linux kernel local privilege escalation flaw tracked as CVE-2026-46300 with a CVSS score of 7.8. The targeted devices ran specific versions of a large vendor's firewall software using PHP 8.0.30. The attacker utilized a custom, non-public build of the PHP2Shell exploit tailored for the specific firewall platform, targeting the PHP session.upload_progress mechanism on the appweb management server. The high memory limit on the firewall OS enabled the memory corruption stages of the attack.
Evidence indicates the threat actor employed artificial intelligence to augment the development and execution of the campaign. The attack infrastructure included Anthropic's Claude Code, along with API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models from DeepSeek and Kimi. The code structure and commenting style across nearly 40 scripts suggested AI assistance. The attacker used FOFA to identify approximately 19,000 internet-facing firewalls, filtered them to 240 targets in specific regions running PHP 8.0.30, and used an automated batch runner to exploit the chain, planting PHP web shells and verifying root access.
Once root access was achieved on 24 servers, the attacker focused on three systems in the U.S. government-affiliated environment. They established a persistent reverse SSH tunnel from a compromised firewall to their infrastructure to access an internal firewall management server. The attacker then targeted Active Directory to decrypt LDAP service account passwords, enumerate users, and spray passwords using organization-themed passwords. They also attempted to create backdoor Active Directory accounts. The full extent of the compromise remains indeterminate, as it is unclear if valid credentials were successfully extracted or backdoor accounts created.
The incident highlights broader risks associated with PHP embedded in network infrastructure management interfaces. Eclypsium's October InfraTrust Pulse report warns that many firewalls, VPNs, and application delivery controllers embed PHP directly into firmware, preventing customers from installing security updates independently. Administrators must wait for vendors to release updated firmware. The report notes that PHP2Shell vulnerabilities put these web management interfaces at risk and recommends that administrators ensure such interfaces are not exposed to the Internet while waiting for patches.
InfraTrust also tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities. Of these, 37 were rated critical, and 58 could be exploited remotely without authentication. Sixteen advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog. The report specifically recommends prioritizing patching for NetScaler and Ivanti Connect Secure appliances, as well as Fortinet, Check Point, Cisco, Arista, F5, and Palo Alto Networks devices with exposed management interfaces or known active exploitation.