Dream Research Says Chained PHP2Shell Exploit Rooted 25 Servers, Including U.S. Government-Affiliated Systems

Since PHP's developers shipped fixes on Oct. 21 for two critical flaws known as PHP2Shell, the story has moved from scanning noise to a documented intrusion. Dream Research, an Israeli cybersecurity firm, published findings on Oct. 26 describing an attack it uncovered on Oct. 25.

The attacker combined a custom build of the PHP2Shell exploit with a Linux kernel privilege-escalation flaw to take root control of 25 servers. They sit in the United States, Japan, Taiwan and South Korea, Dream said.

What Dream says it found

The affected devices run specific versions of a large vendor's firewall software. Dream has not named the vendor or the versions and says it has notified the vendor.

The entry point was the firewall's PHP-based web management interface. According to Dream, a single unauthenticated HTTP request could trigger the exploit. That first step gave code execution with the privileges of the PHP process, not full control of the appliance.

The second step was Fragnesia, tracked as CVE-2026-46300, a flaw in the Linux kernel's XFRM ESP-in-TCP subsystem. Red Hat describes it as letting a low-privileged local attacker alter the page cache of read-only files, overwrite privileged binaries and gain root. Public proof-of-concept code for Fragnesia exists.

The PHP side is tracked as CVE-2026-109618 and CVE-2026-109619. Dream says the exploit it recovered is a custom, non-public build, not a copy of any known public exploit, and was tailored to the targeted firewall platform. It reports the firewall OS runs PHP 8.0.30 with a high memory limit that enables the memory-corruption stages.

Dream says the recovered artifacts include target lists, exploitation logs and roughly 40 custom post-exploitation scripts. They show an operation that began with exploit development in a lab and ended with persistent access to a U.S. government organization's internal Active Directory domain.

Three servers, or two

Dream says the attacker zeroed in on three servers in a U.S. government-affiliated environment. SecurityWeek reported two servers at the organization were compromised. That discrepancy is unresolved.

The composition of the 25 is also unsettled. Some accounts say it was 24 perimeter firewalls and one internal management server. Dream's own summary does not lay out that breakdown.

Dream confirmed extraction of an LDAP service-account credential and directory enumeration. It could not establish whether password spraying, attempted backdoor-account creation or SAML signing-key extraction succeeded. The full extent of the compromise is not known.

Dream has not named the government organization.

The AI and China claims

Dream found Claude Code installed in the attack infrastructure. It also found an AI-powered offensive security platform called aiscan configured with DeepSeek and Kimi models, plus API keys for the Chinese reconnaissance platform FOFA.

Dream's own limits on that evidence are explicit. "We have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts," the firm wrote. It says the code structure, commenting style and consistency across the scripts suggest AI-assisted development. It also says the operation "does not appear to be a fully autonomous nation-state attack."

On attribution, Dream points to the victim set. In its words, the U.S., Japan, Taiwan and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific, which "indicates potential nation-state adversary efforts." It named no threat actor. That is an inference from targeting and tooling, not a government attribution.

Dream also sells the product it used to find this. The firm says the research came from proactive threat hunting with its autonomous cyber research product, Hero. Its findings have not been independently confirmed in the material so far public, and neither the vendor nor the affected agency has commented publicly.

The wider PHP picture

The flaws sit in PHP itself, so a site can be exposed even when its own code and plugins are current. PHP's Oct. 21 advisory lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixed releases. It says the highest assessed risk is Apache's mod_php configuration.

CISA added both flaws to its Known Exploited Vulnerabilities catalog on Monday, Oct. 26, with an Oct. 29 deadline for federal civilian agencies. That reverses the agency's initial warning the week before, when it said it had not observed exploitation. The catalog entries do not identify victims or the evidence behind the decision.

The record on successful attacks has been messy. Cloudflare reported millions of exploitation attempts last week. Sophos has since said its initial report of successful exploitation actually reflected scanning and failed attempts. Palo Alto Networks' Unit 42 said Sunday, Oct. 25, that it could not confirm PHP2Shell was the entry point in an attack on a European government agency, retracting an earlier assessment.

Dream's report is the most detailed account so far of a confirmed chain of compromise.

Patching is moving. Censys' PHP2Shell tracker lists more than 10 million services as patched since Oct. 21. A Nextgov/FCW review found roughly 900 Shodan results tied to federal, state and local government websites showing signs of PHP use. Many of those builds may already have been updated.

CISA has told organizations to locate PHP across their systems, including where it is embedded in other software. It says internet-facing installations come first, and systems that cannot be promptly updated should be taken offline.

Federal civilian agencies must remediate by Thursday, Oct. 29. The firewall vendor has not been identified, and neither has the government-affiliated organization whose Active Directory domain was reached. Whether the stolen service-account credential led to deeper access is still unanswered.