China-linked hackers exploit PHP2Shell to breach US government network

Suspected China-linked hackers exploited critical PHP vulnerabilities to break into a US government-affiliated network and go after its internal login systems, according to new AI-assisted research from cybersecurity firm Dream.

The breach follows last week's disclosure of two critical PHP vulnerabilities, each rated 9.2 in severity and collectively dubbed PHP2Shell, which have triggered widespread patching and exploitation efforts.

Uncovered on October 25th, the US government attack is the first documented case of PHP2Shell (CVE-2026-109618 and CVE-2006109619) being chained into a full government network breach.

Dream said the attackers combined 2 PHP2Shell flaws and a Linux kernel vulnerability dubbed “Fragnesia” (CVE-2026046300) to gain root access to vulnerable firewalls without authentication.

Kfir Fleischer, Dream’s VP of Product and Cyber Research, told Cybernews the attack would have been hard to exploit without chaining it to another flaw, indicating that PHP exploitation is hard to achieve.

“PHP2Shell is hard to reliably exploit since it requires precise, version-specific memory offsets and no universal exploit exists. In order to achieve full root access, the attacker had to chain it with an additional local privilege escalation vulnerability (Fragnesia), making the overall attack a two-stage chain.”

“Even against a specific appliance where offsets can be pre-computed from firmware, only about 10% of attempts succeeded.

“Most failures were timeouts. A 10% success rate under these ideal conditions indeed reflects a challenging exploit, but one, when used correctly, still managed to breach government networks.”

Twenty-four firewalls compromised

Dream researchers reconstructed the operation using its own internal AI research system, Hero, after recovering attacker logs, exploit tools, and approximately 40 post-exploitation scripts.

According to the Dream report, the attackers identified 19,000 internet-facing firewalls, narrowing their target to 240 vulnerable devices across the US, Japan, Taiwan, and South Korea.

The attackers were reported to have successfully compromised 24 firewalls before targeting an internal management server belonging to an unnamed US government-affiliated organization.

Dream said the attackers maintained access, hacked the main firewall management server, and stole Active Directory credentials, which could allow them to access more of the network.

The attackers then listed user accounts and groups, tried common passwords across many accounts, and attempted to create secret access accounts and steal signing keys.

However, the researchers could not establish whether these additional attacks succeeded.

Dream has not attributed the activity to a specific threat actor, but said it believes the campaign is part of a China-linked operation due to language prompts, timestamps, and geographical targeting.

“Since the United States, Japan, Taiwan, and South Korea are the 4 primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this points to possible nation-state involvement,” Dream said.

Evidence of AI-assisted exploitation

The security company also identified potential AI involvement in the campaign, including installations of Claude Code and offensive security tooling configured with Chinese models DeepSeek and Kimi.

The findings come amid mounting concerns over widespread PHP2Shell exploitation. Cybernews reported on Tuesday that new data revealed 32.5 million PHP services still run susceptible versions, including 10.3 million in the US.

CISA confirmed active exploitation and ordered federal agencies to implement mitigation by October 29th.

Last week, Cybernews reported that Amazon detected PHP exploitation attempts as early as October 17th, four days before public disclosure, while Cloudflare observed millions of attack attempts following the announcement.