Skip to content
PHP2Shell Attack Chain Compromises 25 Servers in U.S. Government Environment

PHP2Shell Attack Chain Compromises 25 Servers in U.S. Government Environment

First seen 27 Oct 2026, 22:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 23:17 UTC
  • •25 servers compromised, including U.S. government-affiliated systems.
  • •Attack chain combined PHP2Shell and Fragnesia vulnerabilities.
  • •Patches for critical vulnerabilities were released on October 21.

Dream reported a PHP2Shell attack chain that compromised 25 servers, including those in a U.S. government-affiliated environment. The investigation revealed that an exposed firewall management interface allowed attackers to access internal identity infrastructure. The attack utilized PHP2Shell (CVE-2026-109618 and CVE-2026-109619) combined with the Fragnesia kernel privilege escalation vulnerability (CVE-2026-46300). Dream confirmed credential extraction and directory enumeration but could not determine the success of additional attack vectors. The affected systems run specific versions of a major vendor's firewall software, which remains undisclosed for security reasons. The attack highlights the risks associated with exposed management interfaces and the challenges in containing compromised access. The PHP project has released patches for the critical vulnerabilities identified in this attack.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-21
PHP vulnerabilities published
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released to fix critical vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Unite.Ai
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
First public PoC for CVE-2026-109618
Proof-of-concept code for the PHP2Shell vulnerability was made publicly available.
Unite.Ai
2026-10-25
Attack discovery
Dream researchers uncovered the attack artifacts indicating a Chinese AI-assisted campaign that rooted 25 servers.
dreamgroup.com
2026-10-26
CISA KEV addition
CVE-2026-109618 and CVE-2026-109619 were added to CISA's Known Exploited Vulnerabilities catalog due to active exploitation.
Unite.Ai

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 2

Common questions

What vulnerabilities were exploited?
The attack exploited PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, along with the Fragnesia privilege escalation vulnerability (CVE-2026-46300).
How many servers were affected?
A total of 25 servers were compromised, including systems in a U.S. government-affiliated environment.
What should organizations do now?
Organizations should apply the latest PHP patches and review their firewall management interfaces for exposure.