PHP2Shell Exploit Chain Roots 25 Enterprise Servers
Cybersecurity investigators recently uncovered a sophisticated multi-stage intrusion against government-affiliated infrastructure. Specifically, adversaries compromised a public management portal to infiltrate internal enterprise networks. Consequently, the attackers breached twenty-five servers across sensitive environments. According to an investigative research report by Dream, the intruders rapidly gained administrative domain control. Furthermore, this incident highlights severe risks stemming from exposed peripheral management interfaces.
Anatomy of the Chained Exploitation
The intrusion relied on an aggressive combination of web and kernel flaws. Initially, operators utilized the dangerous PHP2Shell exploit chain to execute arbitrary remote code. This initial vector chained two critical flaws, designated as CVE-2026-109618 and CVE-2026-109619. Furthermore, both vulnerabilities carry critical CVSS 4.0 severity ratings of 9.2. Subsequently, the threat actors escalated local privileges via a Linux kernel flaw named Fragnesia. Tracked as CVE-2026-46300, this local vulnerability permitted root access in under fifteen minutes.
Global Scanning and Perimeter Breaches
The threat actors conducted automated reconnaissance across public internet registries using the FOFA engine. Through these queries, the attackers identified roughly nineteen thousand exposed corporate firewalls. Afterward, automated scripts refined this target pool down to two hundred forty vulnerable appliances. These exposed units operated across the United States, Japan, Taiwan, and South Korea. Consequently, an automated payload compromised twenty-four edge gateways and deployed root web shells.
Infiltrating Government-Affiliated Infrastructure
Notably, two compromised appliances belonged to a prominent organization affiliated with the United States government. Although the first device went offline, operators breached the secondary firewall on October 24. Subsequently, the attackers established persistent administrative access through an encrypted reverse SSH tunnel. The intruders then pivoted directly to an internal firewall management appliance. By replaying the identical exploit chain, adversaries seized complete root authority over twenty-five connected servers.
Active Directory Compromise and Tactical Attribution
Once inside the centralized management server, the intruders decrypted stored LDAP service account credentials. Therefore, the threat actors quickly extracted complete user directories and organizational group hierarchies. In addition, forensic logs revealed widespread password spraying attempts across corporate accounts. The attackers also attempted to forge administrative identities and steal private SAML signing certificates.
Forensic artifacts uncovered during post-incident analysis contained references to artificial intelligence coding platforms. Specifically, investigators identified scripts associated with Claude Code alongside tools invoking DeepSeek and Kimi engines. However, analysts found no conclusive evidence confirming direct autonomous software generation. Additionally, activity timestamps in UTC+8 suggest a possible East Asian nexus. Ultimately, systems administrators must deploy updated PHP releases to protect sensitive enterprise perimeters from intrusion.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
