Limited reports of PHP bug exploitation emerge

Multiple cybersecurity firms are reporting the successful exploitation of two recently announced PHP vulnerabilities, including one allegation of a breach involving U.S. government-affiliated servers.

Cybersecurity firm GreyNoise said it has seen at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619, colloquially known as “PHP2Shell.” The bugs were added to a U.S. government catalog of exploited vulnerabilities this week, and federal agencies were given until Thursday to install patches. 

Another cybersecurity company, Dream, released a lengthy report detailing what it claims is a campaign by a Chinese threat actor involving the compromise of U.S. government-affiliated servers using the PHP2Shell exploit chained with another exploit of a large, unnamed vendor’s firewall software.

Kfir Fleischer, Dream’s vice president of cyber research, told Recorded Future News that the attacker used PHP2Shell to execute commands on the firewall but it wasn’t enough to achieve full control, so they chained it with another vulnerability — CVE-2026-46300. 

The vulnerability, which affects Linux, was added to the same U.S. catalog of exploited bugs on Wednesday.

“We recovered a custom PHP2Shell implementation tailored to the targeted firewall platform, version-specific profiles, exploitation logs and post-exploitation scripts,” Fleischer said. “The recovered logs record successful exploitation, including verification of root access by executing the id command through the installed webshell.”

Dream did not specify the servers’ affiliation with the government. 

In total, the researchers  found 24 compromised firewalls that gave the hacker the ability to extract credentials and enumerate directories. Most of the attacks took place between October 23 and 24. 

Fleischer said they are working with the firewall vendor and relevant authorities on investigating their findings. The Cybersecurity and Infrastructure Security Agency (CISA) declined to comment on the report, directing Recorded Future News to previous advisories about PHP2Shell. 

Fleischer explained that they attributed the campaign to a Chinese actor due to the usage of Chinese language, known Chinese tools and Chinese AI models. 

Dream researchers found evidence that Claude code had been installed and that Chinese platforms like FOFA, DeepSeek and Kimi were used. 

FOFA, a Chinese internet asset search engine similar to Shodan, was used to identify about 19,000 internet-facing firewalls. Those were narrowed down to about 5,000 and then the attacker filtered it to find servers located in only the United States, Japan, Taiwan and South Korea.

That was narrowed further based on exploit profiles, giving them a target list of 240 firewalls. 

Narrow targeting

For 22 of the 24 firewalls attacked, the hackers did nothing beyond plant webshells that would allow later access. 

“While running mass exploitation on all targets related to the above geo-locations, which also had the relevant firewall version, they found 2 government-related servers among the breached firewalls, which they focused their efforts on, continuing a custom attack on those assets,” Fleischer explained. 

In the report, the researchers said the two servers were associated with one target and progressed beyond the initial stage. Both appeared to belong to a U.S. government-affiliated environment, they said. 

One of the firewalls that was attacked crashed and never came back online while the other was repeatedly targeted.

The report said the PHP2Shell exploit chain was non-public and customized for the specific targets — something dozens of experts have said will be necessary for most exploitation of the PHP bugs. 

While the exploit follows the same underlying concept as others that have emerged, it “appears to have been independently developed and tailored specifically for the targeted firewall platform,” they said. 

Once inside, the attacker “zeroed in on three specific servers in a U.S. government-affiliated environment.”

Dream was unable to determine the full extent of the compromise but said the hackers likely have still-active, persistent remote access to the organization’s internal network as well as a complete organizational blueprint through the full Active Directory user and group listing. 

They also obtained account credentials, private keys and network topology that includes IP addresses and more. 

“If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure,” they said. 

Dream added that there was a “clear-cut focus” on government targets and the operation demonstrated a significant level of preparation and capability that set it apart from simple opportunistic exploitation.

Expel cybersecurity expert Marcus Hutchins – who has been closely tracking PHP2Shell exploitation attempts — said the report appears to be tracking a Chinese threat actor known for targeting edge devices such as firewalls, routers, VPN appliances and more. 

He noted that the need to chain the PHP2Shell vulnerability with another kernel privilege escalation exploit was expected because it will allow the attacker to “go from unprivileged shell access to full root and kernel permissions, which enables them to do just about anything the device is capable of doing.”

Several other experts said the campaign tracked by Dream represents more to the nature of how PHP2Shell will be used in the future. 

Viakoo’s John Gallagher warned that the same methodology of using scanning tools to find internet exposed operational technology systems using PHP2Shell could be used across many other types of devices beyond firewalls. 

“For any end-of-life devices using PHP2Shell, time is of the essence to get them replaced and off the network,” Gallagher said.