Overview
Early reports of successful exploitation of the PHP2Shell bugs, CVE-2026-109618 and CVE-2026-109619, are emerging. CISA added both to its Known Exploited Vulnerabilities catalog this week, with a federal patch deadline of Thursday. The coverage reviewed did not list affected or fixed PHP versions, so check the vendor advisories.
Exploitation Reports
GreyNoise reported at least six successful exploitations of the two CVEs.
Dream described a more targeted campaign that chained PHP2Shell with CVE-2026-46300, a Linux vulnerability added to the KEV catalog on Wednesday. PHP2Shell alone gave command execution on a firewall but not full control, so the attacker added the second flaw for privilege escalation. The firewall vendor was not named.
Dream's Findings
- Dream attributes the campaign to a Chinese threat actor, citing Chinese language use, known Chinese tools, and Chinese AI models. It reported evidence of Claude Code installation and use of FOFA, DeepSeek, and Kimi.
- The attacker used FOFA to find about 19,000 internet-facing firewalls, narrowed them to about 5,000, filtered to the United States, Japan, Taiwan, and South Korea, and settled on 240 vulnerable targets.
- Of 24 compromised firewalls, 22 only had webshells planted for later access. Most activity took place on October 23–24.
- Two government-related servers were breached, tied to one US government-affiliated environment where three servers were singled out.
- One attacked firewall crashed and never came back online.
- Dream believes the attacker may retain persistent access and may have obtained Active Directory listings, credentials, private keys, and network topology. It has not confirmed the full extent.
- The exploit chain was non-public and customized, according to Dream.
Dream is working with the firewall vendor and relevant authorities. CISA declined to comment and pointed to its earlier PHP2Shell advisories.
Expert Commentary
Expel's Marcus Hutchins said the campaign fits a Chinese actor that targets edge devices. Viakoo's John Gallagher warned that the same scanning approach could target other internet-exposed gear, including operational technology, and urged replacing end-of-life devices affected by PHP2Shell.
Recommended Actions
- Patch PHP2Shell on every system running the affected PHP component, starting with internet-facing devices.
- Apply the fix for CVE-2026-46300 on Linux hosts.
- Hunt for webshells and unexpected files on firewalls and edge appliances.
- If an edge device was exposed and unpatched around October 23–24, rotate credentials, private keys, and review Active Directory access.
- Replace end-of-life devices that cannot be patched.