From Unauthenticated to Root in 15 Minutes: Inside the PHP2Shell and Fragnesia Firewall Campaign

On October 25, 2026, researchers from the Israeli cybersecurity company Dream brought to light a targeted intrusion operation in which two PHP runtime vulnerabilities were linked together with a privilege escalation bug in the Linux kernel in order to gain root access to 25 servers located in the United States, Japan, Taiwan, and South Korea; three of these systems were part of a U.S. government-linked environment. The exploit code that was recovered was not based on any publicly available proof-of-concept; instead, it was a custom, non-public version that had been specially tailored for the targeted firewall platform.

The transition from an unauthenticated HTTPS request to root-level access took place within 15 minutes. The following is a technical analysis explaining how this was achieved, why it is significant, and what the artifacts tell us about the attacker's toolchain.

The Foundation: PHP2Shell

PHP2Shell is the common name for two serious flaws in the PHP runtime, which were made public and corrected on October 21, 2026; both have a CVSS score of 9.2 and do not require authentication or any user interaction to exploit.

CVE-2026–109618 is a flaw that causes corruption of the out-of-memory state. If a request causes PHP to reach its memory limit, the interpreter may abort the processing while only part of the internal request data has been initialised. The request shutdown phase then regards this incomplete state as valid, which enables an attacker to affect the execution flow by sending multipart requests that are memory intensive.

CVE-2026–109619 is a use-after-free vulnerability due to stale global state; PHP keeps references to data that belongs to a request after the memory supporting that data has been freed. It is possible for a later request, which is handled by the same worker process, to use this stale state before the normal initialization process resets it. The session.upload_progress mechanism has been found to be a relevant vector.

What is so dangerous about PHP2Shell is the place it occupies in the software stack; the flaws are in the PHP interpreter, not in the application code. Even if a web application is completely secure, it can still be breached just because the PHP runtime underneath it has not been patched. The attack can take place before any of the application's logic is carried out, which means that WAF rules designed to protect business routes might never detect the malicious payload. Deployment scenarios that are affected include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

During the Dream campaign the attacker focused on the session.upload_progress feature of the firewall's appweb management server. The firewall operating system that was affected operated with PHP 8.0.30 and had a high memory limit, conditions which were necessary for triggering the memory corruption stages.

The Escalation: Fragnesia

The fact that the attacker was able to gain code execution in the capacity of the web server user represents only the first stage; in order to obtain root access they deployed CVE-2026–46300, a local privilege escalation vulnerability in the Linux kernel named Fragnesia, which has a CVSS score of 7.8.

Fragnesia is a member of the Dirty Frag family but functions as an independent vulnerability within the XFRM ESP-in-TCP subsystem. The flaw enables a local attacker to write any bytes into the kernel's page cache for read-only files; the attack achieves this by manipulating socket buffer coalescing in such a way that the kernel decrypts the data in place on page-cache-backed fragments, thereby corrupting the in-memory copy of the target file without affecting the version on disk.

During this campaign the attacker used Fragnesia to alter the file /etc/pam.d/su. They replaced the file's authentication rules with pam_permit.so, which allowed root to be su'd without a password. Since the target file was just 774 bytes in size, the attacker resorted to a technique involving the splicing of bytes in order to make the necessary modifications. The corruption of the page-cache is deterministic and does not depend on winning a race condition, which makes it very reliable.

The Kill Chain in Practice

The way Dream has reconstructed the campaign indicates that it was a systematic and automated operation which started well in advance of the public disclosure of PHP2Shell.

The evidence from the preparation stage shows that the attacker started constructing the exploit chain on October 8, 2026, about two weeks prior to the release of PHP's patches. The operational phase developed in this way:

1. Large-scale reconnaissance. The attacker employed FOFA, a search service from China for locating internet assets, to find about 19,000 firewalls with internet-facing management interfaces all over the world.
2. Version fingerprinting. A dedicated scanner was used to find out which devices were online and the version of the operating system that they were running. Approximately 5,000 devices replied with information about their version.
3. Focusing in on specific targets. The attacker selected only those systems located in the United States, Japan, Taiwan, and South Korea that were using PHP 8.0.30; as a result, 240 targets were obtained.
4. Automated exploitation. A batch runner linked PHP2Shell and Fragnesia, placed a PHP webshell in a publicly accessible directory, confirmed that it had root access, and recorded the target's hostname and IP address. This action succeeded in compromising 24 perimeter firewalls.
5. Penetration of the government environment. Two of the compromised systems were associated with a organisation affiliated with the U.S. government. When one of them crashed, the attacker managed to gain full control of a second one on October 24 and then used it to set up a reverse SSH tunnel into the internal network. A third server, which was an internal firewall management server accessible only via the tunnel, was compromised a short time later, making the total number of compromised systems 25.
6. Targeting of the identity infrastructure. Within the government-linked environment, the attacker obtained the credentials for the LDAP service account, listed the Active Directory users and groups, and tried password spraying against the domain accounts. There are also records of an attempt to create backdoor accounts and to extract the SAML signing keys, although Dream was unable to verify whether these particular objectives had been achieved.

The system included a systemd service and an rc.local boot script as persistence mechanisms. An eight-port reverse SSH tunnel provided access to the domain controller services, firewall management, and the VPN infrastructure, together with a SOCKS5 proxy. About 40 custom post-exploitation scripts were recovered, along with 11 JSON configuration profiles which matched the different versions of the firewall operating system.

The AI Question

The items associated with Dream consisted of installations of Anthropic's Claude Code, API keys for FOFA, and an AI-driven offensive security platform named aiscan which was set up to use the Chinese large language models DeepSeek and Kimi. The code's structure, the way it was commented, and the consistency seen in about 40 scripts led the researchers to conclude that the development had been assisted by AI.

The researchers were careful to point out that there is no direct evidence to show that AI was used in writing the main exploits or the post-exploitation scripts. It is possible that the tools were available without playing a central role in the breach. Nevertheless, the inclusion of coding assistants in an offensive toolchain is noteworthy. The same tools which assist developers with writing and debugging code can also help attackers refine their custom exploits and keep their scripting consistent throughout a campaign. The difficulty of creating tailored, non-public exploits for specific platforms is now lower than it used to be.

Attribution and Unanswered Questions

On the basis of a number of factors, Dream evaluated a likely connection with China: the presence of Chinese-language prompts in the toolchain, the systems being set to China Standard Time, the targets being located in the United States and East Asia, and the sophistication of the custom exploit chain. The company did not assign the activity to a specific threat actor, and no government has publicly stated that it was involved.

The firewall vendor in question was not identified; although Dream said it had informed the relevant party it had omitted the manufacturer and software version for security reasons.

Several important questions have still not been resolved. Dream was unable to establish whether the password spraying directed at Active Directory had been successful, whether the backdoor accounts had been created, or whether the SAML signing keys had been extracted. The researchers pointed out that these attack results "remained on the management server's local filesystem and were not included among the artifacts that we recovered". If any of those actions had been successful, then the compromise goes beyond the perimeter firewalls and reaches into the organisation's identity infrastructure.

What This Campaign Signals

What stands out to the defenders is three things.

First of all, the PHP runtime has become a direct target for attacks. PHP2Shell is not a vulnerability of an application; it is situated below the application layer and can be exploited before any business logic is executed. Any internet-facing system that uses an unpatched PHP interpreter — whether or not it is a web application, an appliance management interface, or a third-party product that comes bundled — is therefore potentially at risk.

Second, appliance management planes are high-value targets. Firewalls are relied upon to enforce segmentation, to inspect traffic, and to protect identity infrastructure; but when the firewall's own management interface becomes the means of entry, the security architecture is turned upside down, since the reverse SSH tunnel into the government-affiliated network turned a perimeter device into a persistent bridgehead.

Third, the exploit development cycle is getting shorter. The custom PHP2Shell exploit was designed for a particular firewall OS and PHP version. According to Dream's timeline, exploit development started on October 8, public disclosure took place on October 21, and by October 25 active exploitation of the chained exploit had begun. The time interval between the release of a patch and its weaponisation is no longer expressed in weeks. For defenders, the only reasonable position is to regard any internet-facing PHP installation as possibly compromised until it has been patched and verified, and to look out for the unusual worker crashes, the unexpected out-of-memory errors, and the unexplained child processes which might be signs of exploitation attempts.

The fact is that the firewall company has been informed and that the patches are available; the issue now is whether or not the organisations operating these systems have applied them and whether they will realise if they have been compromised before it happens.