Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

Researchers uncovered a campaign that compromised 25 internet-facing firewalls in the United States, Japan, Taiwan, and South Korea, including systems tied to a US government-affiliated organization. The attacker chained two vulnerabilities: PHP2Shell (CVE-2026-109618/109619), which enabled unauthenticated command execution through a crafted sequence of memory-corruption requests, and Fragnesia (CVE-2026-46300), which bypassed restrictions to gain root access. The complete exploit ran in a single HTTP request and could take a firewall from an exposed management interface to a persistent root webshell in under 15 minutes. Recovered version profiles show the attacker tested and tuned the exploit for specific firewall software builds.

The operation narrowed roughly 19,000 discovered devices to 240 targets, then rooted 24 in an automated run; evidence from the broader campaign documents 25 compromised servers. Most were left with webshells, but the attacker focused on two firewalls associated with a government environment, using one system’s configuration to map internal infrastructure. A persistent reverse-SSH tunnel then provided access to domain controllers, VPN systems, and a management server, which the attacker also compromised. Recovered artifacts show credential extraction and Active Directory enumeration. Installed AI tools, Chinese-language model configurations, and consistent scripts suggest AI-assisted development, but do not establish that AI wrote the exploits. The findings underscore how exposed management systems can become gateways into organizational identity networks.