Summary
Dream Group researchers uncovered artifacts on October 25, 2026 showing a suspected China-nexus, AI-assisted campaign that rooted 25 servers using the PHP2Shell vulnerabilities, including systems in a US government-affiliated environment. Victims were spread across the United States, Japan, Taiwan, and South Korea, and included 24 firewalls and one internal management server.
For background on the flaws, see our earlier coverage: PHP2Shell critical PHP RCE emergency patches and CISA adds PHP2Shell flaws to KEV.
Exploit Chain
| Stage | Detail |
|---|---|
| Initial access | PHP2Shell: CVE-2026-109618 and CVE-2026-109619 |
| Privilege escalation | Fragnesia Linux kernel flaw, CVE-2026-46300 |
| Tooling | Target lists, exploitation logs, and about 40 custom post-exploitation scripts |
Government Network
After rooting the servers, the attacker focused on three servers in the US government-affiliated environment. Recovered artifacts confirm credential extraction and directory enumeration. Dream could not establish whether password spraying, backdoor-account creation, or SAML signing-key extraction succeeded, and directory access alone does not prove a full Active Directory takeover.
AI Involvement
- Claude Code was installed on the attacker's infrastructure.
- An AI offensive platform called
aiscanwas configured with DeepSeek and Kimi models. - API keys for the Chinese reconnaissance platform FOFA were present.
Dream stated it has no direct evidence these tools wrote the exploit or scripts, and did not describe the operation as fully autonomous. The China-nexus attribution is tentative and no threat actor was named.
Recommendations
- Upgrade PHP to a fixed release: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (PHP advisory of October 21).
- Patch Linux hosts against CVE-2026-46300.
- Treat any internet-facing PHP host that was unpatched as potentially compromised; hunt for new accounts, unexpected scripts, and credential access.
- On domain-joined infrastructure, review directory service logs and rotate SAML signing keys if exposure is suspected.
- Limit the blast radius of service accounts and API keys so a single rooted server cannot reach directory data.