Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Chinese hackers constructed a tailored PHP2Shell exploit and Linux kernel privilege escalation technique to compromise 25 servers, including US government-affiliated firewalls, according to cybersecurity researchers from Dream. The intrusion campaign commenced on October 23, targeting entities in the US, Japan, Taiwan, and South Korea.

The attackers breached US government-linked firewalls within hours, escalated privileges using Fragnesia, and executed a full Active Directory attack campaign. They maintained persistent access to compromised networks. The initial firewall compromise on October 23 crashed, likely due to over 900 MB of exploit traffic. The second firewall was successfully breached on October 24.

The compromised firewalls ran vulnerable versions of Palo Alto Networks' PAN-OS. Dream collaborated with Palo Alto Networks' Unit 42 researchers to validate the attacker's tactics. The attackers combined PHP2Shell (CVE-2026-109618, CVE-2026-109619) with Fragnesia (CVE-2026-46300), exploiting memory corruption and escalating privileges to root access.

They used four stages: memory corruption, memory layout prediction, stale reference creation, and command execution as the 'nobody' user. They also infiltrated Active Directory, stole sensitive data, enumerated users and groups, and attempted backdoor AD account creation and SAML key extraction. The attack, involving AI tools like Anthropic's Claude Code and Chinese models DeepSeek and Kimi, could still be active, targeting up to 19,000 internet-facing Palo Alto Networks firewalls.