Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Systems

Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

Dream researchers uncovered a Chinese AI-assisted campaign that chained the PHP2Shell exploit (CVE-2026-109618/109619) with the Fragnesia kernel privilege escalation (CVE-2026-46300) to gain root on 25 firewalls across the US, Japan, Taiwan, and South Korea. Starting from roughly 19,000 internet-exposed devices found via FOFA, the attacker narrowed to 240 targets and rooted 24 in an automated batch. Two belonged to a US government-affiliated organization; from one, the attacker tunneled into the internal network, compromised a central firewall management server, and launched Active Directory attacks.