China-linked hackers chain PHP2Shell flaws to root firewalls and breach a US government-affiliated network

A China-linked threat actor exploited a chain of vulnerabilities to gain root access on internet-facing firewalls and breach the internal network of a U.S. government-affiliated organization, according to research from cybersecurity firm Dream reported by SecurityWeek and The Hacker News on October 28, 2026. Dream has not tied the activity to a named group but assesses it to be "Chinese-nexus," saying the targeting "indicates potential nation-state adversary efforts."

What happened

SecurityWeek reports that the attackers combined two PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called "PHP2Shell," with a Linux kernel privilege-escalation flaw known as Fragnesia (CVE-2026-46300). Chaining the PHP flaws with the kernel bug let them escalate to root on the targeted appliances. According to Dream, the actor first used the Chinese internet asset search engine FOFA to identify roughly 19,000 internet-facing firewalls from a specific vendor, which SecurityWeek says was not named. The attackers then filtered to devices located in the United States, Japan, Taiwan and South Korea that were running newer PHP releases, leaving a pool of about 240 potential targets.

Technical details

On October 23 and 24, the attackers exploited 25 firewalls, and an automated tool deployed a PHP root webshell on 24 of them for persistent access, Dream said. No post-exploitation activity was observed on 22 of those devices. The operation went much further against one victim. Dream reports that a first server at the U.S. government-affiliated organization crashed shortly after exploitation on October 23; the attacker ran roughly 240 automated probes over two hours waiting for it to recover, but it never did. A second attempt on October 24 succeeded against another firewall, and Dream says certificate data "definitively linked it to the target organization."

Who is affected

Inside the compromised organization, the attackers established a reverse SSH tunnel for persistence and used it to reach an internal firewall management server, Dream said. That exposed the configurations, credentials and settings of every firewall the organization manages. According to the research, the intruders then decrypted an LDAP service account password, enumerated domain users and groups, ran password spraying, and attempted to create backdoor accounts in Active Directory — a progression from a single edge device toward broad control of the internal network.

What to do

The reporting does not include specific vendor patch identifiers, so defenders should apply the latest fixes for the PHP2Shell flaws and the Fragnesia kernel vulnerability from their appliance vendor and operating system as they become available. Organizations running internet-facing firewalls should inspect devices for unauthorized PHP webshells and unexpected reverse SSH tunnels, review centralized firewall management servers for signs of compromise, and rotate any credentials those servers could expose, including LDAP service accounts. Active Directory should be audited for unfamiliar accounts and password-spraying activity.