Security Firms Report PHP2Shell Attacks on Firewalls

Several cybersecurity firms report successful exploitation of two recently disclosed PHP vulnerabilities, known as "PHP2Shell." One report alleges a breach of servers affiliated with the US government.

GreyNoise said it has seen at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619. The bugs were added to a US government catalog of exploited vulnerabilities this week, and federal agencies had until Thursday to install patches.

Dream's report

Another firm, Dream, published a report on what it says is a Chinese threat actor's campaign. The attacker chained PHP2Shell with a second flaw in the firewall software of a large, unnamed vendor, Kfir Fleischer, Dream's vice president of cyber research, said. PHP2Shell let the attacker run commands on the firewall but did not give full control, so the attacker added CVE-2026-46300, a Linux vulnerability added to the same catalog on Wednesday.

Dream found 24 compromised firewalls. Most attacks took place between October 23 and 24. The attacker could extract credentials and enumerate directories.

Fleischer said Dream tied the campaign to a Chinese actor because of the Chinese language, known Chinese tools and Chinese AI models involved. He said the team is working with the firewall vendor and the relevant authorities.

The attacker used the Chinese search engine FOFA to identify about 19,000 internet-facing firewalls, narrowed them to about 5,000 in the US, Japan, Taiwan and South Korea, and then built a target list of 240. On 22 of the 24 breached devices, the hackers only planted webshells for later access. Dream also found evidence that Claude code was installed and that DeepSeek and Kimi were used.

Two government-related servers among the breached firewalls drew a custom attack. One firewall crashed and never came back online. The other was targeted repeatedly. Dream did not specify the servers' affiliation. It said the hackers likely still have persistent remote access and obtained credentials, private keys and network topology.

Dream recovered a custom PHP2Shell implementation tailored to the targeted firewall platform, along with version-specific profiles, exploitation logs and post-exploitation scripts. According to Fleischer, the logs record successful exploitation, including a root-access check that ran the id command through the installed webshell.

The Cybersecurity and Infrastructure Security Agency declined to comment on the report.

Marcus Hutchins of Expel said the report appears to track a Chinese actor known for targeting edge devices. John Gallagher of Viakoo said any end-of-life devices using PHP2Shell should be replaced and taken off the network.

Source: Recorded Future News