Hackers Exploit PHP Flaw to Breach U.S. Government Internal Networks

Israel-based cybersecurity firm Dream Research has detected traces of a large-scale attack exploiting a PHP vulnerability. Top administrator privileges were stolen on 25 firewall servers across South Korea, the United States, Japan and Taiwan, and evidence was confirmed of penetration into the internal network of a U.S. government-affiliated agency.

Dream Research researchers released their analysis on the 26th (local time) of an attack using the PHP vulnerability "PHP2Shell." The attackers chained two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege-escalation flaw (CVE-2026-46300) to obtain root privileges on firewall servers. According to the researchers, the attack could begin without any separate authentication step and fully compromise a server within 15 minutes.

The attack began by scanning 19,000 firewalls exposed to the internet. Of the roughly 5,000 that actually responded, 240 vulnerable servers located in South Korea, the United States, Japan and Taiwan were selected as targets. As the automated attack proceeded, 24 external firewalls in those regions were seized, and one additional firewall management server inside a U.S. government-affiliated agency was breached.

In particular, at that U.S. government-affiliated agency, a channel for persistent access to the internal network was established, and Active Directory (AD) account credentials and internal network configurations were collected, the investigation found. However, it has not yet been confirmed whether additional account theft or backdoor installation succeeded.

The vulnerability is considered highly dangerous because it allows an attacker to execute malicious code remotely and seize a server without a login or prior administrator privileges.

Note: Compiled based on Dream Research's analysis

Traces of artificial intelligence (AI) tool use also emerged in the attack process. Attack tools configured with Anthropic's "Claude Code" and the Chinese AI models "DeepSeek" and "Kimi" were found. The researchers confirmed signs of AI use by analyzing the structure of 40 attack scripts.

Dream Research raised the possibility that China-linked actors were responsible, citing the targets, the use of Chinese-language commands and the application of China Standard Time. However, it could not confirm a specific hacking group or whether the Chinese government was involved. The manufacturers and product versions of the affected firewalls were not disclosed for security reasons.

The scale of damage in South Korea has not yet been determined. It has not been confirmed whether South Korean-based firewalls were among the 24 seized, how much sensitive information was actually leaked, or whether there were additional system compromises.

The incident shows that management servers exposed to the internet can be breached without authentication. If a firewall itself is turned into an attack foothold, an entire internal network can be exposed to danger, prompting calls for companies and public institutions to urgently apply patches and inspect exposed assets. With evidence that AI tools were mobilized to create attack scripts, concerns are also growing that the barrier to entry for automated attacks is falling.